This policy applies to information we process about: (a) visitors to our marketing website; (b) event organizers (“Hosts”) who create and operate events on Otaly; and (c) attendees who register for events hosted on Otaly (“Attendees”). When a Host operates an event on our platform, the Host is the controller of the personal information of their Attendees, and Otaly acts as a processor on the Host’s behalf in accordance with applicable law.

If you are an Attendee, the Host’s own privacy notice may also apply to you. Please review the Host’s notice for details about how they use your information.

We collect information you provide directly, information generated by your use of the Services, and information from third parties.

Information you provide directly includes:

• Account information — name, email, password, and (optionally) profile photo, organization, and bio.
• Event information — event titles, descriptions, schedules, locations, ticket settings, branding, and uploaded media.
• Registration and ticketing information — name, email, ticket selections, custom registration answers, and (where applicable) phone number.
• Payment information — billing address and the last four digits of the card used; full payment card numbers are processed by our payment processors (e.g., Stripe) and are never stored by Otaly.
• Communications — messages you send through chat, email, support requests, and survey or feedback responses.

Information collected automatically includes:

• Device and connection data such as IP address, device type, operating system, browser type, language, and approximate location derived from IP.
• Usage data such as pages viewed, links clicked, referrer URL, session length, and the actions you take inside the product.
• Cookies and similar technologies — see our Cookie Policy for details and choices.

Information from third parties may include data received from authentication providers (e.g., Google, Apple, Microsoft), payment processors, calendar integrations, analytics providers, and partners that help us prevent fraud.

We use personal information to:

• Provide, maintain, and improve the Services, including hosting event pages, processing registrations and tickets, and powering AI-assisted features (such as event description drafting, attendee chat, and voice agents).
• Authenticate users, prevent fraud, enforce our Terms of Service and Acceptable Use Policy, and protect the rights, property, and safety of Otaly, our users, and the public.
• Communicate with you about your account, transactions, security alerts, product updates, and (with your consent where required) marketing.
• Personalize the product experience, such as remembering your language and event preferences.
• Comply with legal obligations, respond to lawful requests, and resolve disputes.

We rely on the following legal bases under the GDPR and equivalent laws: performance of a contract with you, your consent (which you may withdraw at any time), our legitimate interests in operating and improving the Services, and compliance with legal obligations.

Otaly uses AI to help Hosts draft event descriptions, generate cover art, answer Attendee questions over chat and voice, and summarize feedback. When AI processes your content, the following principles apply:

• Your event content and Attendee data are not used to train third-party foundation models without your explicit consent.
• We use trusted AI subprocessors that have signed data processing agreements with Otaly and that contractually agree not to train their models on customer data routed through their APIs.
• AI-generated outputs are suggestions. Hosts remain responsible for reviewing, editing, and publishing content shown to Attendees.
• You can disable AI assistance for an event or workspace at any time in Settings.

We share personal information only as necessary to operate the Services or as permitted by law:

• With Hosts — when you register for an event, we share your registration details with the Host so they can run the event.
• With Attendees — limited Host information (name, photo, organization) is shown on event pages.
• With service providers and subprocessors — for hosting, analytics, payments, email/SMS delivery, customer support, fraud prevention, and AI processing. They are bound by contractual obligations to protect your information.
• For legal reasons — when we believe in good faith that disclosure is required by applicable law or legal process, or to protect rights, property, or safety.
• In a business transaction — if Otaly is involved in a merger, acquisition, financing, or sale of assets, information may be transferred subject to standard confidentiality protections.

We do not sell personal information, and we do not “share” personal information for cross-context behavioral advertising as those terms are defined under California law.

Otaly is a global service. We may transfer personal information to countries other than the one in which it was collected. When we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been deemed adequate, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.

We retain personal information for as long as needed to provide the Services and to fulfill the purposes described in this policy, unless a longer retention period is required by law (for example, for tax, accounting, or legal-hold reasons). When you delete your account, we delete or anonymize personal information associated with it within 90 days, except for records we are required to retain.

We implement administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include encryption in transit and at rest, role-based access controls, secure software development practices, regular vulnerability scanning, and employee security training. See our Security page for more.

No method of transmission or storage is 100% secure. If we become aware of a security incident that affects your personal information, we will notify you and the relevant authorities as required by law.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your information, subject to certain legal limitations.
• Restrict or object to processing, including processing based on legitimate interests.
• Receive a portable copy of your information.
• Withdraw consent at any time where processing is based on consent.
• Opt out of marketing communications by following the unsubscribe link in any marketing email.
• Lodge a complaint with your local data protection authority.

To exercise these rights, contact us at contact form. We will respond within the timelines required by applicable law. If you are an Attendee whose information is controlled by a Host, please contact the Host first; we will assist them in fulfilling your request.

Otaly is not directed to children under the age of 16, and we do not knowingly collect personal information from children under 16. If we become aware that a child under 16 has provided us personal information without the appropriate parental consent, we will delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Effective date” at the top of the policy and, for material changes, provide additional notice (such as an in-product notification or email).

If you have questions about this Privacy Policy or our privacy practices, contact our privacy team at contact form.