Privacy policy

1. Who is responsible

Packdoor is responsible for the personal information it handles. Our person in charge of the protection of personal information (Privacy Officer) is our founder; you can reach them at info@packdoor.ca.

When you buy a ticket, the event's organizer also receives your information and is responsible for how they use it. Their contact details are on their website.

2. What we collect

• Ticket buyers: your name, email, what you bought, the price and taxes, how you paid (never your full card number: Stripe handles cards), your tickets and when they were scanned at the door, any transfer of a ticket to someone else, and whether you agreed to hear from the organizer.
• Organizers and their team: name, email, business details (legal name, address, phone, business type), sales-tax numbers, and what you do in the back office.
• Everyone: basic technical information to keep the service safe, such as the pages requested, errors, and a one-way coded (hashed) form of your IP address used to stop abuse. We don't store IP addresses in plain form in our database.

3. Why we use it

• To sell and deliver tickets, check them at the door, handle refunds, transfers and cancellations, and send you emails about your order.
• To give organizers what they need to run their event (the buyer list and door check-in).
• To pay organizers, keep financial and tax records, and meet legal obligations.
• To prevent fraud, abuse and security problems (for example bot checks and rate limits).
• To send marketing emails only if you agreed. You can unsubscribe at any time.

We don't sell personal information, and we don't use it for advertising profiles. An organizer may measure their own advertising with Meta, only with your consent: see sections 4 and 6.

4. Who we share it with

The organizer of the event you bought for. Service providers who help us run Packdoor, under contracts that require them to protect it:

• Supabase: database and sign-in (data stored in Canada, Montreal region).
• Vercel: website hosting (servers run in Montreal; pages may be served from other countries).
• Stripe: card payments and payouts to organizers (Canada and the United States).
• Resend: sending emails (United States).
• Cloudflare: domain names, email forwarding and the bot check (global network).
• Sentry: error reports, with emails masked (United States).

Meta Platforms (Facebook and Instagram), on the organizer's behalf: only when the organizer of the site you are on has turned on Meta tracking and you chose "Accept all" in the site's cookie notice. Then Meta receives the pages you view and what you buy on that organizer's site (the event, the order's value and currency), a one-way coded (hashed) form of your email, and of your phone number where one was given, and browser identifiers (Meta's cookies and your browser's name and network address). The organizer uses this to measure their advertising. Meta is in the United States. Nothing is sent to Meta before you accept, and nothing more after you change your answer under Cookie settings.

Some of these providers are outside Canada, and outside Quebec, so information may be handled under the laws of those places. We assess the privacy risks before sending information outside Quebec and protect it by contract.

We may also share information when the law requires it, to protect people from harm, or as part of a sale or merger of our business (the buyer would be bound by this policy).

5. How long we keep it

• Orders, payments, refunds and tax records: 7 years after the year of the sale, as Canadian tax law requires.
• Organizer accounts: while the account is open, then as long as needed for those records.
• Marketing consent records: as long as the consent applies, plus 3 years as proof.
• Abuse-prevention counters: a few days. Error reports: up to 90 days.
• Where an organizer uses Meta tracking: your cookie answer recorded with a checkout, up to 30 days; Meta's browser identifiers kept to report a purchase, until it is reported and at most 8 days.

6. Cookies

We use only the cookies needed to run the service: to keep you signed in, to remember what's in your cart, and to protect forms from bots (Cloudflare Turnstile). Packdoor itself doesn't use advertising cookies.

An organizer may add Meta's advertising tool (the Meta Pixel) to their site. That site then asks you first: Meta's script and its cookies (_fbp and _fbc) are loaded only after you choose "Accept all", and on an address ending in packdoor.ca those cookies are kept to that one organizer's site. You can change your answer at any time with the Cookie settings button on the site; Meta's cookies are then removed and nothing more is sent.

7. Your rights

You may ask to see the personal information we have about you, to correct it, to receive a copy in a common format, or to have it deleted when we no longer need to keep it. You may withdraw consent to marketing at any time. Email info@packdoor.ca; we answer within 30 days.

If you're not satisfied, you may complain to the Office of the Privacy Commissioner of Canada, or in Quebec to the Commission d'accès à l'information.

8. Security

Information is encrypted in transit, access is limited to the people and systems that need it, each organizer can see only their own data, and every change to money or tickets is logged. If a breach creates a real risk of significant harm, we'll tell you and the privacy regulators as the law requires.

9. Changes

We may update this policy. The date at the top shows the current version; for important changes we'll tell organizers by email and show a notice on packdoor.ca.