Privacy policy

This policy covers entrywick.com, the documentation and status pages, and the product itself. It is written for two different readers, and says which is which throughout:

• An organization using EntryWick — its staff, and the account it holds with us. For this we are the controller.
• Somebody who registered for an event run by one of those organizations. For this the organization is the controller and EntryWick is its processor: they decided to collect your details, they decide how long to keep them, and a request about them goes to them. We help them answer it; we do not answer for them.

[OWNER: the controller's legal name, registered address and, where one is required, the data protection contact.]

What we hold, and why

About an organization's staff

What	Why	Kept
Name, email, role, and the group scope of that role	So the right people can sign in and see the right things	While the account is open, then 30 days (terms §6)
Password (hashed), two-factor secret, recovery codes	So sign-in works and can be made harder to steal	As above
Sign-in times, IP address and the browser string of a login session	So a stolen login session can be spotted and ended	90 days
Every write, with who did it and from where	The audit log — so "who changed this?" always has an answer	With the event's record

About people who register

Whatever the organization's own form asks for — commonly a name, an email, a phone number, a group, and answers to questions they set — plus the tickets issued and every check-in. The organization decides all of it. EntryWick adds nothing of its own, profiles nobody, and never uses one organization's registrants to reach another's.

About visitors to this website

Nothing that identifies you. No analytics, no advertising, no fingerprinting, no third-party scripts on the marketing, documentation or status pages. Our server keeps ordinary request logs (the page, the time, the IP address) for 14 days, to find faults and to stop abuse.

Cookies, and the analytics we do not have

We run no analytics product, first-party or otherwise. Nothing on any EntryWick page reports your visit to a third party, and there is no tracking cookie, advertising cookie or tracking pixel anywhere in the product.

What does get set, and nothing else:

Cookie	What it is for	Lasts
entrywick_session	Keeps a signed-in member signed in, and protects the forms on our own pages from being submitted from somewhere else	Until the browser is closed, or 2 hours idle
XSRF-TOKEN	The readable half of that form protection	The same
A remembered-device cookie	Only if you ask a browser to be remembered for two-factor sign-in	30 days

All of them are set by us, from our own address, and read by nobody else. There is no consent banner because there is nothing to consent to: none of these can be turned off without breaking sign-in, and none of them watch you.

Who else sees it

Only the companies that do a specific job for us, listed one by one — what each does and what it sees — on the sub-processor list. We add one only where it is needed to run the product, and the list is the notice: it changes when they change.

Services you connect — your mailing list, your Eventbrite account, your own Twilio number, your Microsoft or Google sign-in — are not on that list, because we send data there on your instruction, to an account you own. What each one sends is documented per provider before you connect it.

We do not sell personal data. We have never sold personal data. There is no version of EntryWick's business where we do.

Where it is held

[OWNER: hosting provider and region.] Email is sent through Postmark and payments through Stripe, both of which may process data outside your country; each is covered by the standard contractual clauses in our agreement with them.

How long

As set out above, and in the tables. An organization keeps what it collects for as long as its plan's retention allows [LAWYER: the owner keeps the retention periods per plan — 12, 24, 24 and 36 months, and unlimited on Enterprise. Confirm they may be published as a promise.], and can delete a registration, an attendee or a whole event at any time.

• One person's details. An organization's Owner can export everything held about one person, or erase it. Erasing removes the person's name, date of birth, contact details, answers and uploaded files at once, and voids their tickets.
• The whole account. An organization's Owner (or we, at their request) can download everything as one file, and can schedule the account's deletion. Nothing is deleted for 30 days, so a deletion made by mistake can be cancelled; on the 30th day everything is deleted — every event, person, ticket, check-in, message, file and audit record, and the accounts of staff who belong to no other organization.
• Backups holding deleted data roll off within a further 30 days.

What is kept, deliberately:

• If a person complained about an organization's email, a one-way hash of their address is kept after their details are deleted — or after the organization is — so that organization never mails them again. The address itself cannot be read back from it.
• When one person's details are erased, the rows recording that they checked in stay (without their name — a check-in is never altered or deleted; a correction is a new row), as does any payment (a financial record the organization may be required to keep). Audit rows written before the erasure keep what they recorded until the plan's retention removes them, because an audit log that can be edited is not an audit log. [LAWYER: the owner keeps those earlier audit rows until retention removes them. Confirm the law that applies to our customers does not require them to be redacted on request instead.]
• We keep our own record that an account was deleted, when, by whom and why — not its contents.

Your rights

If you registered for an event, ask the organization that ran it: they hold the record and they decide. If they come to us, we help them.

If you are staff at an organization with an account, or you have written to us, you can ask us for a copy of what we hold about you, to correct it, to delete it, or to object to how we use it. Write to [OWNER: privacy contact address] and we will answer within 30 days. If we cannot do what you ask, we will say why. You can also complain to your data protection authority; we would rather you told us first.

Security

The short version: everything is over HTTPS; passwords are hashed; tokens, keys and webhook secrets are encrypted at rest and are never written to a log; a ticket's code is not guessable; and every write is audited. What a support message carries is shown to you before you send it, and it never includes your registrants' details.

If you find a problem, write to [OWNER: security contact address]. We will not treat a good-faith report as an attack.

Changes

A new version is published here with a new version number and date. Where a change matters to you, we will say so rather than rely on you noticing.