Event Shepherd

1. Who we are and what this policy covers

Event Shepherd is operated by Group Hug Software, LLC, a Delaware limited liability company. In this policy, "we", "us" and "our" mean Group Hug Software, LLC.

Event Shepherd is an event management platform. Organizers use it to run registration, sell tickets, manage guest lists and check people in at the door.

This policy covers two different audiences, and it is written for both:

Organizers, meaning the people and organizations who hold accounts with us and run events on the platform, including the members of their teams.
Attendees, meaning the people who register for those events or are added to their guest lists. If you registered for an event and are reading this, section 6 is written for you.

It also covers anyone who visits our website or contacts us.

If you do not agree with how we handle information as described here, please do not use Event Shepherd.

2. Our two roles

We handle personal information in two distinct capacities, and which one applies changes what we can do with your information and who you should ask about it.

We are the controller of information about Event Shepherd accounts, including the account that registering for an event creates for each attendee (see section 6): the people who hold them, their profile details, their team memberships, how they use the platform, and the information we collect to keep the service running and secure. We decide how that information is used.

We are a processor of attendee personal data. When an organizer collects names, email addresses and answers to their own registration questions, they decide what to collect and why. We hold and process it on their instructions in order to provide the service to them. The organizer is the controller of that data. In the terms US state privacy laws use, the organizer is the business and we are its service provider.

This distinction matters in practice. If you registered for someone's event and you want your details corrected or deleted, the organizer makes that decision. We will help them act on it, and we will not act unilaterally on their data unless the law requires it.

The terms on which we process attendee data for an organizer, which an organizer's compliance team will be looking for, are set out in section 14.

3. Information we collect

From account holders

Account information. Name, email address, password (stored only as a cryptographic hash, never in readable form), profile photo, postal address and timezone.
Your user number. A personal identity code, carried on a QR pass, that lets the door at an event you are registered for find your registration. You can rotate or deactivate it. We keep your retired numbers and the reason each was retired, so that a retired pass is recognized if someone presents it.
Team information. The teams you belong to, your role in them, and invitations sent and received.
Event content. Everything you create: events, descriptions, schedules, venues, ticket tiers, registration questions, terminals, event pages and your team website.
Two-factor authentication data. Where you enable it, the secret that generates your codes and your recovery codes, both encrypted.
Connected accounts. Where you sign in with Google, the identifier, name and email address Google returns to us.
Payment connection details. Where you connect a payment gateway, the API credentials you supply. They are encrypted at rest, are never shown back to you in full, and are used only to verify your account and work with your provider's API on your behalf, as the Terms of Use describe: creating and expiring checkouts, receiving your provider's notifications, reading your recent transactions, making the refunds you request, and registering the webhooks the application needs to function properly.
Payment instructions. Where you publish bank or wallet details for buyers to pay you directly, we store them and show them to your buyers.
Billing details. Your billing currency, the fees accrued against your sales, and the invoices we raise for them.
Messages you send us. What you write to us through the contact page or by email, with the name and email address you give.

About attendees and event page visitors, on an organizer's behalf

Attendee details. The name of each attendee and, where given, their email address, and the name and email address of the billing contact responsible for each registration.
Registration answers. The responses to whatever custom questions the organizer has set. We do not control what those questions ask.
Ticket data. The ticket tier held, the QR identifier issued, and payment status.
Order data. The record of the registration's money: what was bought, the amounts paid and refunded, the times, the provider's reference for the transaction, and any proof of payment uploaded against it.
Attendance data. Each check-in, and each scan our servers refuse: the time, the terminal, the schedule, the outcome, and the guest's name and email address at that moment.
Event page visits. Each view of an organizer's event page: the address visited, the referring page, the browser, the IP address and the approximate location derived from it. Organizers see these as visit counts and top locations.

Automatically, from everyone

Technical data. IP address, browser and device information, and pages visited. We also keep the IP address and browser of each visitor's session while it lasts.
Approximate location. Derived from your IP address, down to the level of a city, when you view an event page. We do not collect precise device location.
Cookies, local storage and third-party tags. See section 12.
Security signals. Data generated by our bot protection when you use a protected form, and a record of sensitive account actions, such as connecting a payment provider, with the IP address and browser used.

Payments

Card numbers and wallet logins are entered on the payment provider's own hosted checkout page and never reach us. We receive the outcome of the payment and the provider's record of it, which can include limited details of how you paid, such as the type of payment method, the card brand and the last four digits of the card.

Where an organizer takes payment outside a gateway, you may be asked to upload a proof of payment: a photograph or document showing that a transfer was made. We store that file privately. The organizer's team owner and administrators can open it, you can view it on your order page while it is awaiting review, and our staff can open it only to support that organizer or to investigate abuse. Such a file often contains bank or wallet account details, so upload only what the organizer needs to identify your payment. An order carries one proof of payment, and once it has been received it cannot be replaced through the service.

4. How we use information

We use personal information to:

provide the service: create accounts, run events, issue tickets, take and reconcile payments, record check-ins
send transactional messages: registration acknowledgments, QR tickets, check-in confirmations unless the organizer turns them off, payment notices, team invitations, password resets and our invoices
prevent duplicate and fraudulent check-ins
protect the platform against abuse, spam and unauthorized access
respond to support requests
understand how our website and the platform are used, so we can improve them
measure how our own advertising performs, as described in section 12
comply with legal obligations

We do not use attendee data collected on an organizer's behalf to market anything to those attendees, or for advertising of any kind.

5. Legal bases for processing

Where the law requires us to identify a legal basis for processing, as the GDPR and the Philippine Data Privacy Act do, we rely on the following:

Purpose	Basis
Providing the service to an account holder	Performance of a contract
Sending transactional email	Performance of a contract
Keeping the account created for each attendee	Legitimate interests
Security, fraud prevention and abuse handling	Legitimate interests
Website analytics and advertising measurement	Legitimate interests
Retaining records we are legally required to keep	Legal obligation
Processing attendee data for an event	The organizer's legal basis, on their instructions

6. If you registered for an event

This section is for attendees.

The organizer decides. The organizer who ran the event chose what to ask you, why, and how long to keep it. They are the controller of your information. We hold it for them.

Ask the organizer first. To see, correct or delete your registration, contact the organizer directly. While the event is open they can edit your record and your answers, archive you, or remove you from their guest list, and they can do it immediately. Once an event is completed or cancelled its records are frozen, and the organizer can ask us to help with your request.

Your account. When you register for an event, or an organizer adds you to a guest list, we set up a Event Shepherd account under your email address if you do not already have one. It holds your name, your email address and a personal QR pass, and it is how the platform recognizes you across events. You do not have to use it. You can sign in to it by resetting its password or with Google, and you can delete it, or ask us to. Deleting it does not delete your registrations, which belong to the organizers who ran those events.

Your payment. If you paid online, you paid the organizer through their payment provider, such as Stripe, PayMongo or Xendit, on that provider's own checkout page. To take your payment, the provider receives your email address, in some cases your name, and the event, tickets and amount you are paying for. It handles your card or wallet details under its own privacy policy.

What we will do. If you cannot reach the organizer, or they do not respond, contact us and we will make reasonable efforts to put you in touch and to assist them in acting on your request. Where the law gives you a right we must honor directly, we will honor it.

What we will not do. We will not change or delete an organizer's records simply because someone asks us to. Guest lists and attendance records are the organizer's business records, and altering them on request from a third party would be a serious breach of our obligations to them.

We do not market to you. Your account is not a mailing list, and we do not send it marketing.

We share personal information only as set out here.

With the organizer. If you registered for an event, the organizer and everyone on their team can see your registration.

With service providers who process data on our behalf, under contract and only for the purposes we specify. These are our sub-processors:

Provider	What it does for us
Laravel Cloud	Hosts the application, its database and uploaded files
Postmark	Delivers the emails the service sends
Pusher	Carries live updates, including guest names, to the door scanner and guest list
Cloudflare	Renders PDF tickets, which carry the attendee's name and QR code, and runs the bot protection on our sign-in, sign-up, contact and checkout forms
ip-api.com	Looks up the approximate location of an IP address for event page statistics
Laravel Nightwatch	Monitors the application for errors and slow requests, which includes the address requested and the signed-in user's name and email
Stripe	Issues and collects our invoices to organizers
Plausible Analytics	Counts visits to our pages without cookies

For platform fee billing, Stripe, Inc. receives the team's name, the email address of the team owner, or of an administrator where needed, the billing currency, and the invoice line items: the fee on each order, identified by its order number. Stripe processes this data in the United States, under Stripe's own terms.

With third parties whose code runs on our pages, under their own terms and privacy policies:

Third party	What happens
Google Analytics	Measures how our pages are used, with cookies, on every page
Google Fonts	Serves the typefaces our pages and emails use, so your browser requests them from Google, which receives your IP address
Meta	Meta's pixel on our own website pages, including the order page buyers return to after paying, tells Meta that your browser visited, which Meta may link to your Facebook or Instagram account
Google sign-in	Signs you in with your Google account, where you choose to

Content an organizer adds to an event page, such as an image hosted elsewhere, loads from wherever the organizer chose to host it.

The organizer's own payment gateway. Where an organizer connects a payment provider, such as Stripe, PayMongo or Xendit, that provider is engaged by the organizer under the organizer's own account and its own terms. It is not our sub-processor. We interact with it only using the credentials the organizer gave us, on the organizer's instructions, and pass it only what it needs to take and refund payments.

Where the law requires it, or to establish or defend legal claims, or to protect the rights and safety of any person.

In a business transfer. If we are acquired or merged, information may transfer as part of that transaction. This policy continues to apply to it until it is replaced by one that is not materially less protective, and we will give notice before that happens.

8. International transfers

Group Hug Software, LLC is a United States company. We and the providers named in section 7 store and process information in the United States and in other countries, so your information may be transferred to, and processed in, a country other than the one you live in. Where personal information is transferred out of the jurisdiction it was collected in, we take reasonable steps to ensure it remains protected to the standard described in this policy and required by applicable law.

9. How long we keep information

Accounts are kept while they are open. If you delete your account, we delete your account information within a reasonable period, subject to any records we are legally required to retain. A team you own with no other members is deleted with it, along with its events. Records that organizers keep about you, such as your registrations for their events, stay with those organizers.

Event and attendee data is kept while the organizer's team exists and the organizer chooses to keep it. Organizers can remove individual guests at any time before an event closes, and can delete an entire event that has never had a guest registered on it. A removed guest disappears from the guest list and from exports, but the record stays in the event's history, with its check-ins, until the team is deleted.

Once an event is marked completed or cancelled, its guest records are frozen and can no longer be edited or removed through the interface. This preserves the accuracy of what happened. A completed event can be reopened, which lifts the freeze; a cancelled one cannot. Deleting the team removes the events it owns, along with their guests, orders and attendance records.

Attendance records and event page visits are kept for as long as the event that produced them.

Export files stay in the organizer's exports list until they delete them. Because they contain personal data outside the application, we recommend deleting them once they have served their purpose.

Order records are kept for as long as the event they belong to, because they are the organizer's record of a real transaction.

Proofs of payment are kept with the order they were uploaded against, including after a payment is rejected, and are removed with it.

Payment provider records. The notifications a payment provider sends us are kept for 90 days. Where our nightly check finds a difference between the provider's record of a transaction and ours, the provider's record is kept with that difference so the organizer can resolve it.

Billing records, meaning our invoices and the fee records behind them, are kept while the team exists. Stripe keeps its own copy of each invoice.

Messages you send us are kept for as long as we need them to respond and to keep a record of the conversation.

Technical logs are kept so that we can trace what happened on the platform, investigate problems and keep it secure.

Backups persist for a limited period after deletion, in line with our backup rotation, and are then overwritten.

Scanner storage, the minimal data a scanning device needs to check people in without a connection, stays on that device until an operator clears it or the browser's storage is cleared, as section 12 explains.

10. Security

We take reasonable and appropriate technical and organizational measures to protect personal information, including:

encryption in transit over TLS
passwords stored only as cryptographic hashes
payment credentials and two-factor secrets encrypted at rest
optional two-factor authentication on accounts, which applies when signing in with a password; signing in with Google relies on the security of your Google account instead
role-based access control within teams, with financial actions and proofs of payment limited to team owners and administrators
opaque, non-guessable ticket identifiers
administrative access, including the ability to act as a user when supporting them, limited to the small number of people who need it; each time this is started or stopped we log who acted as whom, when, and from which IP address, and the log is visible only to administrators

No system is completely secure, and we cannot guarantee absolute security. If a breach affects your personal information and the law requires us to notify you, we will do so without undue delay, and we will notify the relevant supervisory authority within the period the law prescribes.

Organizers share responsibility here. Use a strong, unique password, turn on two-factor authentication, give team members the minimum role they need, clear the scanner's stored data from shared devices after an event, and handle exported guest lists carefully.

11. Your rights

Everyone

Subject to the conditions in your local law, you may ask us to:

confirm whether we hold personal information about you, and give you a copy
correct information that is inaccurate or incomplete
delete information we no longer have a lawful reason to keep
restrict or object to certain processing
provide your information in a portable format
withdraw consent, where processing is based on consent

Where we hold your information on an organizer's behalf, we will refer your request to them and assist them in responding. See section 6.

United States

Depending on the state you live in, and on whether its privacy law applies to us, you may have the right to know what personal information we collect and how we use and disclose it, to get a copy of it, to correct it, to delete it, and not to be discriminated against for exercising those rights. Some states also give you the right to opt out of the sale of personal information, of sharing it for targeted advertising, and of certain kinds of profiling.

We do not sell personal information for money, we never sell or share the attendee data organizers collect through us, and we do not use personal information for profiling that produces legal or similarly significant effects. Our website does use Google Analytics and Meta's pixel, described in section 12, and some state laws treat that kind of tracking as selling or sharing personal information. Section 12 explains how to limit it.

In the categories California law uses, the personal information described in section 3 consists of identifiers, customer records, commercial information, internet or other electronic network activity, approximate geolocation, visual information such as a profile photo, and account login credentials. We collect it from you, from organizers, from your browser, from the payment providers organizers connect, and from the providers named in section 7, for the purposes in section 4, and we keep it for the periods in section 9. We use login credentials only to sign you in and keep your account secure.

You may make a request yourself or through an authorized agent. If we decline a request, you can appeal by replying to our decision and asking us to reconsider it, and we will respond within the period the law allows.

Philippines

If you are in the Philippines, the Data Privacy Act of 2012 (Republic Act No. 10173) gives you the rights to be informed, to access, to object, to rectification, to erasure or blocking, to data portability and to damages, and the right to lodge a complaint with the National Privacy Commission.

European Economic Area and United Kingdom

Where the General Data Protection Regulation or the UK GDPR applies, you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your local supervisory authority.

How to exercise a right

Contact us with enough detail to identify what you are asking about. We may need to verify your identity before acting, particularly for deletion requests, and we will ask an authorized agent for proof of their authority. We will respond within the period required by applicable law.

12. Cookies, local storage and third-party tags

Cookies we set

Session cookie, set for every visitor, which keeps you signed in and ties your requests together. Strictly necessary. It expires after two hours without activity.
Security token, which protects forms against cross-site request forgery. Strictly necessary.
Appearance preference, remembering the light or dark theme you chose, for a year.
Sidebar state, remembering whether you collapsed the sidebar in the organizer panel, for a week.

Storage on your device

Scanner storage. A device running the door scanner keeps only the minimal data it needs to check people in without a connection: the guest manifest for the event it is scanning, with each guest's name, ticket validity, check-in state, whether their payment is still pending, a one-way hash of their user number so a personal QR pass can be matched, and any flag or archive note, plus a queue of the scans it has made. This data stays on the device until an operator clears it or the browser's storage is cleared. Pressing Clear in the scanner removes scans that have synced or been rejected, so clear the browser's site data on shared devices after an event.
Scanner settings, such as which camera to use.
Raffle wheel sound, remembering whether the raffle wheel plays sound.
Appearance preference, also kept in local storage.
Connection settings that keep live updates working.

Analytics and advertising

Plausible Analytics counts visits to every page without cookies or any other storage on your device, and without identifying you.
Google Analytics measures how every page is used. It sets cookies, named _ga and _ga_ followed by an identifier, that last up to two years, and Google receives the address of each page you view, your browser details and your IP address.
Meta's pixel runs on our own website pages, such as the home page, the documentation and this policy, and on the order page buyers return to after paying. It does not run on organizers' event pages or in the organizer panel. When one of our pages loads, your browser contacts Meta, which can link the visit to your Facebook or Instagram account, so that we can measure our advertising.

Your choices

You can clear or block cookies in your browser. Blocking the strictly necessary ones will stop you signing in, and clearing site data will remove the scanner's offline copy. You can stop Google Analytics with Google's opt-out browser add-on, and limit how Meta uses what its pixel sees in your Facebook or Instagram ad settings. Blocking third-party cookies, or using your browser's tracking protection, limits both.

Do Not Track. Our site does not currently respond differently to Do Not Track or Global Privacy Control signals. Google and Meta may collect information about your activity on our site and on other sites that use their services, as described above.

13. Children

Event Shepherd is not directed at children, and only adults may sign up for an account or run events. Attendees are sometimes children, registered by a parent or guardian. In that case the organizer is responsible for obtaining any parental consent their law requires, and we process the child's details on the organizer's behalf like any other attendee data. Because registering creates an account for each email address given (section 6), a child registered with their own email address will have one.

If you believe a child has given us personal information without a parent's consent, contact us and we will work with the organizer to delete it.

14. Data processing terms for organizers

This section is the data processing agreement between an organizer, as controller of Attendee Data, and us, as processor of it. It forms part of the Terms of Use and applies wherever we process personal data about your attendees on your instructions.

It is written to be readable. If your own compliance team needs a signed agreement on their paper, contact us.

Roles and instructions

For personal data about your attendees ("Attendee Data"):

You are the controller. You decide what data to collect, why, and how long to keep it.
We are the processor. We process Attendee Data on your documented instructions in order to provide Event Shepherd to you.

Your use of the service, and your configuration of it, constitute your documented instructions. We will not process Attendee Data for our own purposes, and we will not sell it or use it to market to your attendees.

For personal data about you and your team members, and for the account created for each attendee (section 6), we are the controller. That processing is described in the rest of this policy.

Subject matter, duration, nature and purpose

Subject matter. Provision of the Event Shepherd event management platform.

Duration. For as long as your team holds the data in the service, and thereafter as described under Return and deletion below.

Nature and purpose. Collecting registrations, issuing tickets, taking and reconciling payments, maintaining guest lists, recording check-ins, counting event page visits, sending transactional email at your direction, and generating exports you request.

Location. In the United States and the other countries where we and the sub-processors listed in section 7 operate.

Data subjects and categories of data

The data subjects are attendees who register for your events, billing contacts responsible for registrations, people you add to a guest list by import or by hand, visitors to your event pages, and your team members to the extent your event records name them, for example as the person who recorded a payment.

The categories of personal data are those listed in section 3: identity and contact data, registration answers, ticket data, order and payment data including any proof of payment uploaded, attendance data, event page visits and technical data.

Sensitive data. The service is not designed for sensitive personal data. What counts as sensitive varies by law. It usually includes health information, and under Philippine law it also includes a person's age and government-issued identification numbers. If your registration questions collect sensitive data, such as dietary or access requirements that reveal health information, you are responsible for having an appropriate lawful basis and appropriate safeguards, and you must tell us if the volume or sensitivity is material.

Our obligations as processor

We will:

process Attendee Data only on your documented instructions, unless required otherwise by law, in which case we will tell you before processing unless the law forbids it
tell you if we believe an instruction of yours breaks the law
ensure that people authorized to process Attendee Data are bound by confidentiality
implement appropriate technical and organizational security measures, as described in section 10 and below
respect the conditions below for engaging sub-processors
assist you, taking into account the nature of the processing, in responding to data subject requests
assist you with security, breach notification and data protection impact assessments, taking into account the information available to us
delete or return Attendee Data as described below
make available the information reasonably necessary to demonstrate compliance with these terms

US state privacy laws

Where a US state privacy law applies, we act as your service provider or processor, and we will not:

sell or share Attendee Data, as those terms are defined in that law
keep, use or disclose Attendee Data for any purpose other than providing the service to you, or outside our direct business relationship with you
combine Attendee Data with personal information we receive from anyone else, except as that law permits

We will comply with the obligations that law places on us, give Attendee Data the level of protection it requires, and tell you if we can no longer meet them. You may take reasonable steps to stop and remedy any use of Attendee Data that is not authorized.

Sub-processors

You give us general authorization to engage sub-processors to provide the service. The sub-processors we use are listed in section 7.

We will impose data protection obligations on each sub-processor that are no less protective than those set out here, and we remain responsible to you for their performance.

We will give reasonable notice, by email or through the service, before adding or replacing a sub-processor in a way that materially affects the processing of Attendee Data. If you have a reasonable objection on data protection grounds, tell us, and if we cannot resolve it you may terminate the affected part of the service.

Security measures

The measures described in section 10 apply to Attendee Data. In addition, guest manifests held on scanning devices are deliberately limited to the fields the door needs: the guest's name, ticket validity, check-in state, whether their payment is still pending, a one-way hash of their user number so a personal QR pass can be matched, and any flag or archive note your team has written. They exclude email addresses, payment amounts and details, and registration answers.

We may update these measures over time, provided the level of protection is not reduced.

Data subject requests

Attendees can exercise their rights through you directly, using the tools in the service: you can view, edit, archive and remove guest records, and correct their registration answers, at any time before an event is closed.

Removing a guest through the interface takes them off your lists but keeps the record in the event's history. If an attendee asks for their data to be erased completely, or a request concerns an event that has closed, ask us and we will provide reasonable assistance.

If an attendee comes to us instead, we will refer them to you and will not act on their data unilaterally unless the law requires it, as described in section 6.

Return and deletion

You control deletion through the service, on the terms described in section 9. On termination of your account, we will delete Attendee Data within a reasonable period, except where we are required by law to keep it. Backups persist for a limited period in line with our backup rotation and are then overwritten.

Export your data before you terminate. Guest sheets, which include each guest's check-ins, and QR code archives are available through the exports tool, and each session's attendance can be downloaded from the door desk.

Personal data breach

If we become aware of a personal data breach affecting Attendee Data, we will notify you without undue delay, with the information reasonably available to us about the nature of the breach, its likely consequences, and the measures taken or proposed.

Notifying your supervisory authority and your attendees, where required, is your responsibility as the controller. We will provide reasonable assistance.

International transfers

Transfers are as described in section 8. Where a transfer of Attendee Data requires a safeguard under applicable law, we will put an appropriate one in place.

Audits

On reasonable written request, and no more than once a year unless required by a supervisory authority, we will provide information reasonably necessary to demonstrate compliance with these processing terms. Where an on-site audit is legally required, the parties will agree on a reasonable scope, timing and confidentiality arrangement in advance.

Order of precedence

If these processing terms conflict with the rest of the Terms of Use in respect of the processing of Attendee Data, these terms prevail.

15. Changes to this policy

We may update this policy. The version and the date it was last updated appear at the top of this page.

Where a change materially affects your rights, we will give notice by email or through the platform before it takes effect. Continuing to use Event Shepherd after a change takes effect means you accept the updated policy.

16. Contact us

Questions, requests and complaints about this policy or about how we handle personal information can be sent to Group Hug Software, LLC through our contact page or by email to [email protected].

Privacy Policy.