Privacy Policy

Effective date: June 24, 2026 · ollin.club

1. Who we are

Ollin (“we”, “us”, “our”) operates the platform at ollin.club. The platform enables venue operators to collect RSVPs, track marketing attribution, sell tickets, and run branded guest loyalty programs with Apple and Google Wallet passes.

This Privacy Policy describes how we collect, use, and protect personal data. It applies to everyone who uses our platform — both venue operators who hold accounts and guests who interact with operator-branded RSVP or loyalty pages.

For guests: when you RSVP to an event or join a loyalty program on a venue's page, the venue operator is the data controller for your information. We act as a data processor on their behalf, subject to this policy.

Contact: contact@ollin.club

2. Data we collect

From venue operators

• Name and email address (via Clerk authentication)
• Billing information — processed by Stripe; we never receive or store raw card numbers
• Venue details: name, URL slug, branding (logo, colors, fonts), and event configuration
• Stripe Connect account data for venues collecting paid ticket revenue
• Platform usage data (pages visited, features used, dashboard interactions)

From guests

• Name, email address, and phone number — submitted on RSVP or loyalty join forms
• Custom fields defined by the venue operator (e.g., dietary preferences, table size, VIP code)
• IP address — hashed with SHA-256 before storage; the raw IP is never saved
• Approximate location (city and country), derived from the IP hash via an in-process geolocation library
• Device type, operating system, and browser, parsed from the browser's User-Agent string
• Attendance data: check-in timestamps and attended/absent status
• Loyalty data: stamp history, coin balance, tier level (Explorer → Legend), promo completions, and reward codes
• Apple Wallet push tokens and device IDs (registered when a guest adds a wallet pass to their device)
• Anonymous, cookieless product analytics events (pages viewed, form interactions) — see Section 6

3. How we use your data

For operators

• Provide, maintain, and improve the platform
• Process subscription billing and paid event transactions
• Send transactional communications (billing receipts, account notices)
• Generate per-channel analytics dashboards

For guests

• Deliver QR code confirmation emails after RSVP or ticket purchase
• Generate and update Apple Wallet and Google Wallet loyalty passes
• Send background push notifications to update wallet passes after each stamp (APNs)
• Provide venue operators with attendance and channel attribution analytics
• Maintain your cross-venue loyalty identity (keyed by email), coin balance, and tier

4. Legal basis for processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Contract performance — processing necessary to operate your account, bill your subscription, or fulfil your RSVP
• Legitimate interests — security monitoring, analytics, platform improvement, and fraud prevention
• Consent — optional marketing emails (where separately obtained)
• Legal obligation — retaining billing records as required by applicable tax law

5. Third-party services and sub-processors

We share personal data only with service providers necessary to operate the platform:

We do not sell, rent, or trade personal data to any third party for advertising or marketing purposes.

6. Cookies and product analytics

We use cookies strictly necessary for authentication and session management, set by Clerk.

We also use PostHog, a product analytics service, to understand how our software is used. On operator pages — the dashboard, onboarding, sign-in, and staff scanning tools — PostHog stores an anonymous analytics identifier in your browser's local storage and a first-party cookie. On public guest pages — venue pages, RSVP pages, and loyalty join and pass pages — analytics run in cookieless mode: no identifier is written to your device, and nothing persists once you close the tab. Analytics requests are served from a first-party endpoint on ollin.club, so your browser never contacts a third-party analytics domain directly.

We never transmit names, email addresses, phone numbers, RSVP form answers, staff PINs, or loyalty card links to our analytics provider. Page addresses containing a loyalty card link are redacted before any analytics event leaves your browser.

We do not use advertising cookies, tracking pixels, or third-party ad-network analytics. No third-party advertiser receives data from cookies or analytics identifiers set on ollin.club.

7. Data retention

• Operator account data — retained while the account is active and for 30 days following a deletion request
• Guest RSVP and loyalty data — retained until the venue operator requests deletion or closes their account
• Hashed IP and geo/device data — retained for up to 24 months for analytics purposes
• Product analytics events (PostHog) — retained for 12 months
• Stripe billing records — retained per Stripe's policies and applicable tax law
• Apple Wallet device tokens — retained until the device deregisters from the pass or the loyalty card is deleted

8. Your rights

GDPR — European Union and UK

• Access a copy of your personal data
• Correct inaccurate or incomplete data
• Request erasure (“right to be forgotten”)
• Object to processing or request restriction
• Receive your data in a portable format
• Lodge a complaint with your supervisory authority

CCPA / CPRA — California residents

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the sale of personal information — we do not sell personal information
• Non-discrimination for exercising your rights

LFPDPPP — Derechos ARCO (Mexico)

• Acceso — obtener información sobre los datos personales que conservamos
• Rectificación — corregir datos inexactos o incompletos
• Cancelación — solicitar la eliminación de sus datos personales
• Oposición — oponerse al tratamiento de sus datos en determinadas circunstancias

To exercise any of these rights, email us at contact@ollin.club. We will respond within 30 days.

9. Security

• IP addresses are hashed with SHA-256 before storage — raw IPs are never retained
• Data is encrypted in transit (TLS) and at rest (Supabase, Vercel)
• Authentication tokens and QR payloads are signed with HMAC-SHA256
• Clerk manages all credential storage and authentication flows
• Stripe handles all payment card data under PCI DSS compliance

10. International data transfers

Our sub-processors are primarily based in the United States. Data transferred outside Mexico is protected by the contractual safeguards and data processing terms of each sub-processor (Supabase, Clerk, Stripe, Resend, Vercel, Apple, Google). Where required, we rely on standard contractual clauses or equivalent mechanisms.

11. Children

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from minors. If you believe a minor has provided data to us, please contact us and we will delete it promptly.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to registered operators at least 14 days before taking effect, and noted with an updated effective date at the top of this page. Continued use of the platform after the effective date constitutes acceptance of the revised policy.

13. Contact

Ollin
México
contact@ollin.club

This document was prepared as a starting point and does not constitute legal advice. Consult a qualified attorney for advice specific to your jurisdiction and business.