Privacy Policy

This describes what Promotah collects, why we collect it, and what we do with it. It reflects how the product actually works rather than the broadest permissions we could ask for.

What we collect

When you create an account: your email address, the handle you choose, and optionally your city. If you sign in with Google, we receive your email address and basic profile information from Google — not your password.

When you promote: the links and codes you create, and activity on them.

When someone clicks your link: a timestamp, the referring page, browser user-agent, country, and a hashed form of the IP address. We do not store raw IP addresses. They are hashed with a secret and a rotating daily salt before they are written, which lets us detect a link being refreshed by the same visitor without retaining anything that identifies that visitor.

When you buy a ticket: your email address, what you bought, and the amount. Card details go directly to Stripe and never touch our servers.

When you get paid: Stripe collects the identity and bank details required by financial regulation. We store only the identifier of your Stripe account and whether it is cleared to receive money.

Cookies

We use one cookie that matters: a signed attribution cookie set when you arrive through a promoter's link. It records which link brought you, so the right person is credited if you buy. It lasts 30 days, is not readable by JavaScript, and is not used for advertising. We also use the cookies Supabase needs to keep you signed in.

We do not run third-party advertising or tracking pixels.

Why we collect it

• To run the service — attribute sales, calculate what you have earned, deliver tickets, and pay you.
• To detect fraud. Hashed IPs and refund rates are used to identify patterns like self-dealing and inflated clicks, which protect the promoters who are doing this honestly.
• To send transactional email: your tickets, and notifications about your account or earnings.
• To meet legal obligations, including tax reporting on money we pay out.

We do not sell personal data. We do not share it for advertising.

Who we share it with

• Stripe — payments, payouts, and identity verification.
• Supabase — database and authentication hosting.
• Resend — transactional email delivery.
• Vercel — application hosting.
• Event organizers — for tickets you purchase, so they can admit you and handle refunds.
• Law enforcement or regulators, where legally required.

What a promoter's public page shows is limited on purpose: their handle, city, tickets sold, events worked, and the events they are currently promoting. Their earnings are never public.

How long we keep it

Account and transaction records are kept while your account is open and for as long as afterwards as tax, accounting and dispute-resolution rules require — generally seven years for anything involving money. Click records are kept for a rolling window used for attribution and fraud detection, then aged out.

Your choices

• Access — ask us for a copy of what we hold about you.
• Correction — change your handle or city from your profile at any time.
• Deletion — ask us to close your account and delete your data. We must retain financial records where the law requires it, and we will tell you what is being kept and why.
• Objection — depending on where you live, you may have additional rights under the GDPR or CCPA. We honour them regardless of where you are.

To exercise any of these, email support@promotah.com.

Children

Promotah is not for people under 18. We do not knowingly collect data from children. If you believe a child has created an account, tell us and we will remove it.

Security

Traffic is encrypted in transit. Database access is restricted by row-level security so one account cannot read another's data. Payment and payout details are held by Stripe, not by us. No system is perfect; if a breach affects you we will notify you as required by law.

Changes

We will post material changes here with a new date. See also our Terms of Service.