1. Controller
The controller of your personal data is TOURINGTUNES Sp. z o.o., ul. Złota 7 lok. 28, 00-019 Warszawa, Poland (KRS 0001053019, NIP 5252968519). Contact: [privacy@strobo.events].
Important — two roles. For data you give us as a user of Strobo (your account, your purchases, platform analytics) we act as controller and this Policy applies. Where an Organizer uses Strobo to manage their guest lists and marketing contacts, the Organizer is the controller of that data and we act as their processor under a Data Processing Agreement; the Organizer's own privacy notice applies to that use. When you opt in to marketing from a specific Organizer at checkout, or follow an Organizer on Strobo, that consent is given to the Organizer.
Messages from the Organizer of your event. The Organizer is the seller of your ticket. When it uses Strobo to write to ticket holders about that event — a changed time or venue, a cancellation or postponement, entry information — it does so as the controller, on the basis of the ticket contract (Art. 6(1)(b)), and we send the message on its behalf as processor. These messages contain no advertising and do not depend on marketing consent. Advertising from an Organizer is sent only to people who have consented to it, and every such message carries an unsubscribe link.
2. What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email and phone (optional) at checkout; the ticket holder's name when a ticket is transferred to you or issued in your name by the Organizer | Selling and delivering tickets, transactional email (ticket, receipt, reminders, event changes) | Art. 6(1)(b) — contract |
| Payment data | Processed by Stripe; we never store card numbers | Art. 6(1)(b); Stripe acts per its own terms |
| Order history, ticket status, entry scans | Operating entry control, fraud prevention (duplicate QR), support | Art. 6(1)(b), 6(1)(f) — legitimate interest |
| Account data (Clerk), organization membership | Providing organizer/fan accounts | Art. 6(1)(b) |
| Marketing opt-in to an Organizer | Passing your contact to that Organizer's audience | Art. 6(1)(a) — consent (withdrawable per organizer, unsubscribe link in every email) |
| Cookies/pixels (Meta, TikTok, GA4) on event pages; analytics cookies (GA4, PostHog) on strobo.events, with the pages visited, the campaign tags and advertising click identifiers in their addresses, the referring site and an approximate location derived from the IP address | Organizer's ad measurement; our analytics | Art. 6(1)(a) — consent via cookie banner (see Cookie Policy) |
| Session recording on strobo.events, only with the separate Session recording consent: what is on the page and how it is used (scrolling, clicks, pointer movement), with everything typed into fields masked, linked to the PostHog cookie identifier | Understanding how visitors use our marketing site and where they drop off | Art. 6(1)(a) — consent (Session recording); withdraw any time in Cookie settings — see Cookie Policy §3 |
Strobo's own advertising to Organizers, measured through Meta: if you accepted Marketing on strobo.events, two events are reported to Meta from our servers — a click from strobo.events to sign up, and the completion of your organization's registration. They carry the page address (without its query), your IP address and browser user agent, the Meta cookie identifiers _fbp / _fbc when present and, for the registration, the email address and phone number of your account in hashed (SHA-256) form |
Measuring and improving Strobo's Facebook/Instagram ads aimed at Organizers | Art. 6(1)(a) — consent (Marketing on strobo.events); withdraw any time in Cookie settings, after which nothing more is sent |
| Use of the organizer panel by signed-in Organizers and their team members (the identifier of the user account, panel pages opened, buttons and links used, browser, operating system, device type and screen size; no name or email address, and no location) | Product analytics: understanding how the panel is used and improving it | Art. 6(1)(f) — legitimate interest; nothing is left stored on the device and sessions are not recorded — see Cookie Policy §3A |
| Technical logs, IP | Security, abuse and fraud prevention | Art. 6(1)(f) |
| Waitlist entries | Offering tickets when they free up | Art. 6(1)(b) |
| "Notify me" sign-ups for a sale that has not opened yet (email, event) | One email when the sale opens | Art. 6(1)(a) — consent given when you sign up (we record the time, IP address and wording version) |
| Following an Organizer (email, your name if you gave one, the Organizer followed) | That Organizer's news and announcements by email | Art. 6(1)(a) — consent given to the Organizer; withdraw any time via the unsubscribe link or by unfollowing |
| Ticket transfer: the recipient's name and email typed by the person handing the ticket on, and that person's first name | One email to the recipient with the link to accept the ticket; after acceptance, letting the recipient open and recover the ticket | Art. 6(1)(b) for the person handing the ticket on; Art. 6(1)(f) for the recipient (legitimate interest in completing the transfer they were offered) |
| Cookie-consent record (random id, timestamp, choices, wording version, IP, user agent) | Demonstrating your consent choice (GDPR Art. 7(1)) | Art. 6(1)(c), 6(1)(f); kept 24 months — see Cookie Policy §5 |
| Organizer problem reports (the text written, the panel page, app version, screen size, language, time zone, browser; optionally a screenshot of the organizer's own screen, with buyers' names, emails and phone numbers masked before it leaves the browser) | Answering the report and fixing the product | Art. 6(1)(f) — legitimate interest; screenshots kept 90 days |
| Error reports when something fails in the app (app.strobo.events), in the browser or on our servers: the error message and the place in the code where it occurred, the page address without anything after the "?", browser and operating system, the app version and, from the browser, the last steps before the error (pages opened, clicks, requests and console messages). Before a report is sent, we remove email addresses, phone numbers, signed links and access tokens, and every field holding a name, contact details or login data; cookies and request headers other than the browser's identification are not sent. Reports from the browser pass through our own server, so Sentry does not receive your IP address, and Sentry is set not to store IP addresses | Detecting and fixing failures, keeping the service secure and reliable | Art. 6(1)(f) — legitimate interest; reports kept 30 days |
Is providing data obligatory? Providing an email address is necessary to buy and receive a ticket — without it the purchase cannot be completed. The phone number at checkout is optional. All other data is provided voluntarily.
We do not sell personal data. Apart from the measurement of Strobo's own ads to Organizers described above, which needs consent, we give no personal data to advertising platforms for our own purposes, and ticket buyers' data is never used to advertise Strobo.
3. Recipients
Data is shared with: the Organizer of the event you buy for (your order details — they are the seller); and our subprocessors (hosting, payments, email — full list at /legal/subprocessors: Stripe, Supabase, Vercel, Clerk, Resend). For our own analytics we use PostHog (PostHog, Inc.; data stored in the EU), which receives usage data about Organizers in the organizer panel and, with consent, about visitors to strobo.events. From the organizer panel it receives no ticket buyer's name, contact details or order contents (the address of an order's page contains that order's internal identifier), and it is not a subprocessor under the DPA; it is listed separately at /legal/subprocessors. To detect and fix failures we use Sentry (Functional Software, Inc.; error reports stored in the EU), which receives the error reports from app.strobo.events described in §2; it is not a subprocessor under the DPA either and is listed separately at /legal/subprocessors. Functional Software, Inc. (US) may process them under the EU–US Data Privacy Framework, with Standard Contractual Clauses as fallback. Meta Platforms Ireland Ltd receives the advertising measurement events about Organizers described in §2, only with consent; Meta Platforms, Inc. (US) may process them under the EU–US Data Privacy Framework. Some subprocessors process data outside the EEA; transfers rely on adequacy decisions (including the EU–US Data Privacy Framework) or Standard Contractual Clauses.
4. Retention
Order and ticket data: as long as needed for the contract and then for limitation periods and tax law (in Poland generally 5–6 years). Account data: until account deletion plus a short safety window. Marketing consent data: until you withdraw consent. Entry-scan logs: up to 12 months after the event. Technical logs: up to 12 months. Cookie-consent records: 24 months. Screenshots attached to organizer problem reports: 90 days. Session recordings (strobo.events, with consent): 30 days. Ticket transfers: if the transfer is cancelled or lapses (at the latest 72 hours after it was offered, or when doors open), the recipient's email and the sender's name are erased — immediately on cancellation, and within 15 minutes of a lapse; the recipient's name stays on the closed transfer record for as long as the ticket's order data. If it is accepted, the recipient's email is kept with the ticket, as order data. "Notify me" sign-ups: until 30 days after the event.
5. Your rights
You have the right of access, rectification, erasure, restriction, portability, objection (including to legitimate-interest processing), and to withdraw consent at any time without affecting prior processing. Write to [privacy@strobo.events]. You may lodge a complaint with your supervisory authority; in Poland this is the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa.
For data controlled by an Organizer (their marketing lists, followers and the messages they send to their ticket holders), we will forward your request to the Organizer or you may contact them directly.
6. Automated decisions
We do not make decisions producing legal effects based solely on automated processing. Payments are screened for fraud by our payment provider, Stripe, under its own terms.
7. Children
Strobo is not directed at children under 16. Events may carry their own age restrictions set by the Organizer.
8. Non-EEA users
If you use Strobo from outside the EEA, we apply the same standards described here. Where local law grants you additional rights (e.g. certain US state privacy laws), you may exercise them via [privacy@strobo.events].
9. Changes
We will announce material changes to this Policy in-product or by email. Version history is available on request.