Privacy Policy

Effective date: September 15, 2026
Last updated: September 15, 2026
Service: Bazaarly (https://www.bazaarlyevents.com and related apps, emails, and APIs)
Controller / operator: Bazaarly Events LLC (“Bazaarly,” “we,” “us,” or “our”)
Privacy contact: bazaarlyevents@gmail.com

This Privacy Policy explains how we collect, use, share, and protect personal information when you use Bazaarly — a Blazor-based platform for craft fairs, markets, pop-ups, and theater-style events (Space Creator, Event Creator, published dates, vendor booths, QR tickets and scanning, and wallet passes).

Working launch policy. This Privacy Policy is the working launch policy for Bazaarly Events. It is not a substitute for a licensed attorney’s formal opinion — Greg/operator should still have counsel review.

1. Scope

This Policy applies to:

• Visitors to our marketing and public event pages;
• Planners / organizers and their invited team members;
• Vendors who reserve booths;
• Guests / buyers who purchase tickets, seats, parking, or similar items;
• Recipients of transactional emails we send.

It does not cover third-party websites linked from event pages, venue sites, or Planner-operated offline data collection outside Bazaarly.

2. Personal information we collect

2.1 You provide directly

2.2 Collected automatically

2.3 From third parties

• Stripe — payment success/failure, refunds, disputes, Connect account status (payouts_enabled, onboarding state);
• Brevo (email service provider) — delivery, bounce, and related transactional email telemetry;
• Identity / auth tooling embedded in our Blazor / ASP.NET Identity stack;
• Our cloud hosting and infrastructure providers (application hosting, databases, file/object storage, and related infrastructure).

2.4 Sensitive data

We do not intentionally collect government ID numbers, precise geolocation continuous tracking, or special-category data. Planners should not upload sensitive personal data about attendees unless necessary and lawful. Stripe Connect KYC may collect identity documents on Stripe’s systems during Planner payout onboarding.

3. How we use personal information

We use personal information to:

1. Provide the Service — accounts, Space/Event Creator, publishing, public pages, booth maps, ticketing, QR generation, door scanning, and wallet passes;
2. Process payments and payouts — package purchases (Basic / Advanced / Pro), publish-time booth/seat fees, Guest/Vendor charges via Stripe, Connect transfers/holds;
3. Send transactional email via Brevo — ticket confirmations, OTP / email verification codes, booth reservation confirmations, invoices/deposits, account confirmation and password reset, planner operational messages;
4. Secure the Service — fraud prevention, abuse detection, audit logs, chargeback response;
5. Support and operations — customer support, debugging email/wallet delivery, improving reliability;
6. Communicate about your account and transactions — transactional email only at launch; we do not send marketing email at launch;
7. Comply with law — tax, accounting, law-enforcement requests, and enforcing our Terms.

EEA/UK note: The Service is directed to users in the United States. If you access the Service from the EEA or UK, contact us at bazaarlyevents@gmail.com. We do not claim GDPR certification, appoint a DPO, or rely on Standard Contractual Clauses in this Policy; processing is described for a US-primary audience.

4. How we share personal information

We share personal information with:

4.1 Other users (role-based)

• Planners see Guest and Vendor names, emails, order/reservation details, scan history, and unpaid balances needed to run the event;
• Public event pages show information Planners choose to publish (event name, times, booth maps, publicly visible vendor listings, ticket tiers — not full payment card data);
• Team members invited by a Planner may access Planner-scoped data according to permissions.

4.2 Service providers (processors)

We require processors to use personal information only on our instructions and with appropriate security, subject to their standard terms where industry-standard SaaS is used.

4.3 Legal and business transfers

We may disclose information if required by law, to protect rights/safety, or in connection with a merger, acquisition, or asset sale. In connection with such a transfer, we will provide notice where required by law or as we deem appropriate.

4.4 No sale or sharing for cross-context behavioral advertising

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use analytics or advertising pixels on the Service at launch.

5. Payments (Stripe)

When you pay:

• Card entry is handled by Stripe; Stripe’s privacy notice applies to data it processes as an independent controller/processor (as applicable): https://stripe.com/privacy.
• For Guest ticket sales, Bazaarly may act as merchant of record while transferring net proceeds to Planners via Stripe Connect after eligibility rules (including a post-event hold window and dispute checks).
• We store payment-related metadata needed for receipts, refunds, payouts, and accounting (PaymentIntent/charge IDs, amounts, fees, transfer status).

6. Email (Brevo)

Bazaarly uses Brevo as its email service provider for:

• Guest ticket and OTP confirmation emails;
• Vendor booth reservation / invoice / deposit emails;
• Planner-initiated customer messages;
• ASP.NET Identity account confirmation and password reset mail when configured.

Emails may include event branding, QR codes (often as secure HTTPS links), order details, and — when configured — Apple Wallet pass attachments or links.

Important: Some email providers or Brevo account settings (for example, click-tracking) can wrap links. We engineer transactional ticket mail so Wallet / pass links remain usable; nonetheless, delivery behavior can vary by recipient client.

Default system sender addresses may include noreply@bazaarlyevents.com (system / transactional sender). That address may be unmonitored for inbound support. For privacy, legal, or support requests, use bazaarlyevents@gmail.com.

Brevo’s privacy terms apply to its processing: https://www.brevo.com/legal/privacypolicy/.

At launch we send transactional email only — no marketing email.

7. Apple Wallet and QR tickets

• QR ticket codes and public ticket URLs allow entry validation and self-service pass viewing.
• When Apple Wallet signing is configured on a public HTTPS host, we may generate signed .pkpass files containing ticket identifiers, event names, and related pass fields.
• Pass files reside on your device under Apple’s Wallet; uninstalling a pass does not delete our server-side ticket record.
• Google Wallet or other wallet links, if shown, involve the respective provider’s terms.

Anyone who receives a ticket email or link may be able to display the pass — treat confirmation emails as sensitive.

8. Cookies and similar technologies

We use essential cookies only (and local/session storage) to:

• Keep you signed in (authentication);
• Maintain checkout / OTP confirmation state (session continuity);
• Remember UI preferences (for example, portal nav or dark mode), where implemented.

We do not use analytics cookies or advertising pixels at launch.

Because we use essential cookies only for a US-primary launch, no cookie consent banner is required for this configuration. You can control cookies through browser settings; disabling essential cookies may break login or checkout.

9. Data retention

We retain personal information only as long as needed for the purposes above, including:

We may anonymize or aggregate data for analytics and product improvement.

10. Security

We implement administrative, technical, and organizational measures appropriate to our size and risk profile, including encrypted transport (HTTPS), hashed passwords, access-controlled planner dashboards, and secrets kept out of source control. No method of transmission or storage is 100% secure. Report suspected vulnerabilities to bazaarlyevents@gmail.com (subject: “Security”).

11. Your rights and choices

Depending on where you live, you may have rights to:

• Access, correct, or delete personal information;
• Export a copy of your data;
• Object to or restrict certain processing;
• Opt out of marketing emails (we do not send marketing email at launch; transactional mail required to fulfill a purchase will still send);
• Appeal a denied privacy request — reply to the same privacy email requesting an appeal.

How to exercise: Email bazaarlyevents@gmail.com with the subject “Privacy Request.” We may need to verify your identity (for example, confirming control of the account email).

Planners: You may act as an independent controller for attendee/vendor data you export or process outside Bazaarly. You are responsible for providing your own event privacy notices where required.

California / US state rights (CPRA-friendly notice): We collect the categories of personal information described in Section 2 for the purposes in Section 3, retain them as described in Section 9, and do not intentionally collect sensitive personal information for the purpose of inferring characteristics. We do not sell personal information and do not share it for cross-context behavioral advertising. To exercise access, deletion, correction, or other applicable rights, email bazaarlyevents@gmail.com with the subject “Privacy Request.” To appeal a denied request, reply to the same email requesting an appeal.

EEA/UK: The Service is directed to US users. If you access from the EEA or UK, contact us at the privacy email above. This Policy does not claim full GDPR compliance, a DPO appointment, or SCCs/DPF certification.

12. Contact

Privacy, legal, support, and security: bazaarlyevents@gmail.com

System / transactional sender (may be unmonitored): noreply@bazaarlyevents.com — automated platform email only; do not use for privacy or support requests.

Postal address: New Hampshire, United States

13. Children

The Service is directed to adults organizing and attending events. We do not knowingly collect personal information from children under 13 (COPPA). If you believe a child provided personal information, contact us and we will take appropriate steps to delete it. Planners who sell tickets that may be used by minors should ensure their own event policies and parental consent practices comply with law.

14. International users

We are based in the United States (New Hampshire). The Service is directed primarily to US users. If you access the Service from outside the U.S., you understand your information may be processed in the U.S. and other countries where our providers (including Brevo, Stripe, and our cloud hosting and infrastructure providers) operate. If you access from the EEA or UK, contact us at bazaarlyevents@gmail.com.

15. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, for material changes, provide additional notice (email or in-app) where appropriate. Continued use after the effective date means you acknowledge the updated Policy.

16. Relationship to Terms of Service

Use of Bazaarly is also governed by our Terms of Service. In case of conflict about data practices, this Privacy Policy controls privacy-specific disclosures; the Terms control contractual use of the platform.

Appendix A — Summary of key processors

End of Privacy Policy