Skip to main content
let’s revel.

Privacy Policy

Privacy Policy

Effective Date: October 02, 2026

Last Updated: October 02, 2026

1. Introduction

Welcome to Revel's Privacy Policy. This document explains how we collect, use, store, and protect your personal information when you use the Revel platform (also branded as Let's Revel) at letsrevel.io.

Data Controller:

Biagio Distefano

Van-der-Nüll-Gasse 69-71/19, 1100 Vienna, Austria

VAT ID: ATU81173837

Email: [email protected]

Revel is committed to protecting your privacy and giving you full control over your personal data. We operate under the principles of transparency, data minimization, and user autonomy. We are based in Austria and comply with the General Data Protection Regulation (GDPR).

Our Privacy Commitments:

  • We collect only the data necessary to provide our services
  • We never sell or share your data for marketing purposes
  • We do not use tracking cookies or analytics
  • You have full control over your data with GDPR rights
  • Your data is stored securely in the European Union

2. Information We Collect

2.1 Information You Provide Directly

Account Information

When you create an account, we collect:

  • Email address (required for authentication and communication)
  • Password (stored in hashed form, never in plaintext)
  • Name (first and last name, optional)
  • Preferred name (optional)
  • Pronouns (optional)
  • Profile picture (optional)
Guest Access

If you RSVP to an event or buy a ticket as a guest (without registering), we collect only your email address and, where the organizer requires names on tickets, the name(s) to put on the ticket(s). A limited guest record is created to deliver your ticket or RSVP confirmation; it becomes a full account only if you later register with the same email.

User Profile Information

You may optionally provide:

  • Preferred city (for distance-based event sorting)
  • Dietary restrictions (allergies, intolerances, preferences)
    • Restriction type (allergy, intolerance, preference)
    • Public/private visibility setting
    • Custom notes
  • Dietary preferences (vegetarian, vegan, gluten-free, etc.)
  • Language preference (English, German, Spanish, French, Italian, Portuguese)
Two-Factor Authentication (2FA)

If you enable 2FA:

  • TOTP secret key (stored encrypted)
Event and Organization Content

When you create or interact with events and organizations:

  • Event details (name, description, location, dates, capacity, pricing)
  • Venue and seat-map layouts created by organizers (sectors, rows, seats, price categories)
  • Organization details (name, description, contact information)
  • Uploaded files (photos, documents, logos)
  • Tags and categories
  • RSVP responses (Yes, No, Maybe)
  • RSVP notes (an optional short note you attach to an RSVP, where the organizer has enabled notes — e.g. dietary info or arrival time; shared with the organizer)
  • Questionnaire submissions (answers to screening and membership-application questions)
  • Potluck item assignments
Ticketing and Seating

For tickets, season passes, and seated events:

  • Ticket and season pass records (event, tier, status, QR code, ticket number, and time of issue)
  • Seat assignment (the specific seat on your ticket, where the event is seated) and the price you paid for it
  • Box-office records created by organizers at the door (e.g. door sales, complimentary tickets, seat changes at check-in, and any outstanding amount you agreed to pay the organizer on site)
  • Campaign tags (utm_source, utm_medium, utm_campaign, utm_content) taken from the address of the page you bought on, when the organizer tagged the link you followed. The labels are chosen by the organizer, contain no identifier of you, and are stored on the ticket or season pass record. Nothing is read from your device: if the tags are not in the address at checkout, none are stored.
Membership Subscriptions

If you hold or apply for a membership in an organization:

  • Membership tier, plan, and status (active, cancelled, lapsed, etc.), including start/renewal dates
  • Membership applications and their outcome, including questionnaire answers where a questionnaire is attached
  • Subscription payment history (amounts, dates, status — not card details)
  • Stripe identifiers (a per-organization Stripe Customer ID and subscription ID; see Section 5.3)
Payment Information

For ticket, pass, and membership purchases:

  • Payment information is collected and processed by Stripe (not by Revel)
  • We store only:
    • Stripe transaction ID
    • Purchase details (event, tier, quantity, price, seat where applicable)
    • Payment status (pending, completed, refunded)
    • Payment method type (online, offline, at-door, free)

We never store credit card numbers, bank account details, or other sensitive payment data. For recurring memberships, your payment method is stored by Stripe, not by us.

Billing Details for Invoices

Where an organizer issues you an invoice through the Platform, we collect and store the billing details needed on the invoice:

  • Billing name and billing address
  • VAT ID and country (where applicable)
  • Billing email

These appear on the invoice document, which is retained as a financial record (see Section 6.3).

Where country-specific rules prevent an invoice or credit note from being issued through the Platform, we keep a record of the billing details and the purchase instead, so that the organizer can issue the document from their own system. This record is retained as a financial record too.

Referral Program (Referrers Only)

If you participate in the referral program, we additionally collect:

  • Billing name (legal name for invoicing)
  • Billing address
  • VAT ID (optional, validated against the EU VIES register if provided)
  • Self-billing agreement (consent to Revel issuing invoices on your behalf)

This data is used solely for payout processing and tax-compliant statement generation.

If you apply to the referral program, we collect your email address, the code you request, and your note, together with our decision and any note from the reviewer.

Organization Creation

If you create an organization after following a link that carries campaign tags (utm_*), the tags are stored on the organization so that we can see which of our pages or campaigns led to it. As with ticket purchases, nothing is read from or stored on your device.

Developer Apps

If you register an app that uses Sign in with Revel, we store the app's name, logo, redirect addresses, and client credentials.

Communications

We may collect:

  • Support inquiries sent to [email protected]
  • Notification preferences (in-app, email, Telegram)
  • Unsubscribe tokens for email management
  • Muted organizations whose announcements you have turned off
  • Email suppression records: when an email to an address bounces, is blocked, or is reported as spam, or when someone without an account opts out of invitations, we record the address, the reason, and the date, and stop emailing it

2.2 Information Collected Automatically

Technical Information

When you use Revel, we automatically collect:

  • IP address (used transiently for geolocation, not stored)
  • Device information (browser type, operating system)
  • Session information (login time, JWT token metadata)
  • Request metadata (request ID for debugging and support)
Cookies and Local Storage

We use only essential cookies required for the Platform to function:

  • Session cookies (JWT authentication tokens)
  • Invitation cookies to automatically let you join organizations and events
  • Referral code cookie (stores a referring user's code for 30 days, for referral attribution at registration)
  • Language preference
  • CSRF protection tokens

We do not use:

  • Analytics cookies (Google Analytics, etc.)
  • Advertising cookies
  • Tracking pixels
  • Third-party tracking technologies
Usage Information

We collect minimal usage data for service operation:

  • Login/logout events (for security)
  • Error logs and sampled request traces (for debugging and reliability)
  • Background task execution (Celery tasks)

We do not track:

  • Page views
  • Click behavior
  • User navigation patterns
  • Time spent on pages

2.3 Information from Third Parties

Geolocation Data
  • IP2Location database is used to suggest your city based on IP address
  • This data is used transiently during the request and never stored
  • No IP address data is associated with your account
Identity Providers (Optional)

If you sign in through an identity provider (currently Google), we receive and store your account identifier at that provider and the email address it reports, linked to your Revel account. If you create your account this way, we also import your profile picture from the provider and process it like any other upload. You can unlink an identity in your account security settings.

Brevo

Our email provider tells us when an email to you bounces, is blocked, or is reported as spam. We use this only to stop emailing that address and to show you a notice in your account.

Stripe

We receive transaction confirmation data from Stripe:

  • Payment success/failure notifications (including subscription renewal outcomes)
  • Refund confirmations
  • Transaction IDs
Telegram (Optional)

If you link your Telegram account to Revel:

  • Telegram username (for bot communication)
  • Telegram user ID (for message delivery)
  • Language preference (for i18n)

We do not access your Telegram messages, contacts, or other data beyond what's necessary for notification delivery.

2.4 Information We Do NOT Collect

We explicitly do not collect:

  • Precise geolocation or GPS coordinates
  • Browsing history outside Revel
  • Device identifiers (IDFA, Android ID, etc.)
  • Biometric data
  • Social media activity
  • Health information (beyond dietary preferences)
  • Financial account details

3. How We Use Your Information

3.1 Service Provision

We use your personal data to:

  • Create and manage your account
  • Authenticate your identity (login, 2FA)
  • Process event registrations, RSVPs, ticket, season pass, and membership purchases
  • Operate recurring membership billing (via Stripe) and apply grace periods on failed payments
  • Assign and manage seats for seated events, including box-office operations at the door
  • Generate your tickets, passes, and membership cards (QR codes, PDFs, Apple Wallet and Google Wallet passes)
  • Issue invoices and credit notes on behalf of organizers, where applicable, and record the ones that country-specific rules prevent us from issuing
  • Facilitate communication between organizers, members, and attendees
  • Send transactional notifications (event updates, ticket confirmations, RSVP confirmations, membership and payment confirmations)
  • Display events and organizations according to your preferences
  • Calculate distances between events and your preferred city
  • Manage dietary preferences for event planning
  • Enable questionnaire submissions and evaluations (for event admission and membership applications)
  • Coordinate potluck assignments

3.2 Platform Operation

We process data to:

  • Maintain platform security (detect fraud, prevent abuse)
  • Troubleshoot technical issues (debug errors, investigate bugs)
  • Improve platform reliability (monitor performance)
  • Scan uploaded files for malware (ClamAV)

3.3 Legal Compliance

We may process data to:

  • Comply with legal obligations (tax reporting, law enforcement requests)
  • Retain financial records as required by Austrian law (typically 7 years)
  • Respond to legal processes (court orders, subpoenas)
  • Protect our rights (enforce Terms of Service, defend legal claims)

3.4 Communication

We send only service emails necessary for service operation:

  • Account verification emails
  • Password reset emails
  • Event invitation emails
  • Ticket, season pass, and membership confirmation emails
  • RSVP confirmation emails
  • Questionnaire result and membership application outcome emails
  • Invoice, credit note, and payout statement delivery emails
  • Notification emails (if enabled in preferences)
  • Emails from organizations you interact with (announcements, invitations, event updates), sent on their behalf
  • Setup tips to organization owners (can be switched off)
  • Platform notices, such as changes to our Terms or this Privacy Policy

We do not send:

  • Marketing emails
  • Newsletters
  • Promotional materials
  • Advertisements

You can control most of these emails in your notification preferences. Payment, ticket, and subscription receipts, security emails, ban notices, and platform notices are always sent.

3.5 What We DO NOT Do

We never:

  • Sell your personal data to third parties
  • Share your data for advertising or marketing purposes
  • Use your data to build advertising profiles
  • Track you across other websites or apps
  • Send unsolicited marketing communications

4. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on:

4.1 Contractual Necessity (Art. 6(1)(b) GDPR)

Processing necessary to provide services you've requested:

  • Account creation and management
  • Event registration and ticketing (including seat assignment)
  • Membership subscriptions and recurring billing
  • RSVP and attendance management
  • Payment processing and invoicing (via Stripe)

4.2 Legitimate Interests (Art. 6(1)(f) GDPR)

Processing necessary for our legitimate interests:

  • Platform security and fraud prevention
  • Technical troubleshooting and error resolution
  • Service improvement and reliability
  • Helping organizers measure which of their own communications led to ticket sales (the campaign tags described in Section 2.1)
  • Understanding which of our pages and campaigns lead people to create organizations (Section 2.1)
  • Not emailing addresses that bounced, were reported as spam, or opted out
  • Alerting our administrator to new sign-ups, organizations, and referral applications

4.3 Consent (Art. 6(1)(a) GDPR)

Processing based on your explicit consent:

  • Telegram notifications (you choose to link your account)
  • Optional profile information (dietary preferences, preferred city)
  • RSVP notes (you choose whether to attach one)
  • Apps you connect (you approve each app and its permissions)

You may withdraw consent at any time by adjusting your settings or contacting us.

4.4 Legal Obligation (Art. 6(1)(c) GDPR)

Processing required by law:

  • Financial record retention (Austrian tax law), including invoices and subscription payment records
  • Responding to law enforcement requests
  • Reporting illegal content (e.g., CSAM)

4.5 Special Categories of Personal Data (Art. 9 GDPR)

Revel is an event platform that may be used for events related to lifestyle, identity, or sexuality. By registering for such events, applying for membership in such organizations, or providing related information in questionnaires or RSVP notes, you may reveal special category data (e.g., data concerning sexual orientation or health) as defined by Art. 9 GDPR.

We process such data only with your explicit consent (Art. 9(2)(a) GDPR), given when you:

  • Voluntarily register for events or join organizations whose nature may reveal special category data
  • Submit questionnaire responses or RSVP notes containing such information

Additional safeguards for special category data:

  • We apply the same security measures described in Section 6.2 to all data, including special category data
  • Event organizers are bound by our Terms of Service to handle attendee data responsibly
  • You can withdraw consent at any time by cancelling your registration or deleting your account

5. Data Sharing and Disclosure

5.1 We Do Not Sell Your Data

We never sell, rent, or trade your personal data to third parties for marketing or any other purpose.

5.2 Sharing Within the Platform

Your data is shared within Revel according to your privacy settings and the organizer's event settings:

Public Information

Visible to all users (including non-registered visitors):

  • Public events and their details
  • Public organizations, their details, and their published membership tiers
  • Your name (when you attend public events or belong to public organizations, subject to the event's attendance-visibility settings)
Organization Members

Visible to members of organizations you belong to:

  • Your profile information (as configured)
  • Your event attendance (for organization events, subject to the event's attendance-visibility settings)
  • Your dietary preferences (if made public, for event planning)
Event Organizers and Their Staff

Visible to organizers (and authorized staff) of events you attend or organizations whose membership you hold or apply for:

  • Your name and email
  • Your RSVP status and any RSVP note you attach
  • Your ticket, seat assignment, and season pass information, including box-office records
  • The campaign tags through which you arrived before buying, where the organizer tagged their own links
  • Your membership tier, plan, subscription status, and payment history (not card details)
  • Your membership application and questionnaire submissions
  • Your billing details, where an invoice is issued to you, or where the organizer must issue it from their own system
  • Your profile picture, name, and pronouns, shown to door staff when they scan your membership card
  • Your dietary restrictions/preferences (for meal planning)
  • Your potluck item assignments
Other Attendees

What other attendees can see is controlled by the organizer's attendance visibility settings, configured per event:

  • Attendee count, event capacity, and the guest list can each be shown or hidden independently
  • Anything the organizer withholds is genuinely not exposed (not merely hidden in the interface)
  • Aggregated dietary summaries may be visible for potlucks

5.3 Third-Party Service Providers

Stripe (Payment Processing, Subscriptions, and Referral Payouts)

When you purchase tickets, season passes, or memberships:

  • Your payment information is sent directly to Stripe
  • Stripe processes payments on behalf of event organizers
  • For recurring memberships, Stripe stores your payment method and charges renewals on the organizer's behalf; a Stripe Customer object is created for you on the organizer's connected Stripe account, and we store only its identifier
  • Stripe's Privacy Policy applies: https://stripe.com/privacy
  • We receive only transaction confirmations, not payment details
  • We keep what Stripe receives to a minimum: checkout items carry generic labels (no event or tier names), and Stripe customers are created with your email address only

When you participate in the referral program:

  • Referrers connect a Stripe Express account to receive payouts
  • Stripe handles identity verification and bank account setup directly
  • We store only the Stripe account ID and connection status — not bank details or identity documents

Financial data retention: Transaction records are stored on Stripe as required by Austrian tax law (typically 7 years). This data remains on Stripe even after you delete your Revel account.

Telegram (Optional Notifications)

If you enable Telegram notifications:

  • Telegram username and user ID are stored
  • Notifications are sent via Telegram's Bot API
  • Telegram's Privacy Policy applies: https://telegram.org/privacy
  • We do not access your Telegram messages or contacts
Apple Wallet (Optional)

You can download tickets and season passes as Apple Wallet passes (.pkpass files):

  • The pass is generated on our servers and contains your ticket details (event, seat, QR code)
  • Once added, the pass is stored on your device in Apple Wallet; Apple's terms and privacy policy apply to your use of Wallet
  • We do not send your data to Apple; you download the pass directly from us
Google Wallet (Optional)

You can add tickets, season passes, and membership cards to Google Wallet:

  • This only happens when you choose to, by tapping an "Add to Google Wallet" link or button
  • When you add a pass, its contents are transmitted to Google and stored in your Google Account. The pass contains your ticket or membership details: event or organization name, date, time and venue, ticket or membership type, price, holder name, and the identifier encoded in the QR code
  • Google may also retrieve the event's public images (organizer logo, event cover) from our servers to display on the pass
  • Once added, the pass is governed by Google as an independent controller; Google's Privacy Policy applies: https://policies.google.com/privacy
  • If you never use the Google Wallet option, none of your data is sent to Google Wallet
Apps You Connect (Optional)

If you authorize an app through Sign in with Revel, the app receives the account data covered by the permissions you approved (for example, your name and email address, or your tickets) and can act on your behalf within those permissions. The app's developer is an independent controller, and their privacy policy applies. We store your authorization and the app's access tokens. You can disconnect an app at any time under Settings > Connected apps.

Eventbrite (Optional, for Organizers)

If an organizer connects an Eventbrite account, we send the event's public details and ticket tiers to Eventbrite. We send no attendee data, and we receive only the number of tickets sold per tier.

Cloudflare (CDN and Security)

All traffic to Revel is routed through Cloudflare's network:

  • Purpose: DDoS protection, TLS termination, and content delivery
  • Data exposed: All data transmitted between your browser and our servers transits through Cloudflare's infrastructure
  • Cloudflare is a US company with a global network of data centers
  • Safeguards: Cloudflare provides a Data Processing Agreement (DPA) as part of their service terms and is certified under the EU-US Data Privacy Framework
  • Privacy Policy: https://www.cloudflare.com/privacy/

Important: While your data is stored in the European Union (see Section 6.1), it transits through Cloudflare's network for delivery. Cloudflare may process request data (including IP addresses, headers, and request bodies) on servers outside the EU.

Brevo (Email Delivery)

Transactional emails (e.g., ticket confirmations, event updates) are delivered via Brevo (formerly Sendinblue):

  • Data sent: Recipient email address, email content
  • Brevo is an EU company (headquartered in Paris, France)
  • Safeguards: Brevo complies with GDPR and provides a Data Processing Agreement (DPA)
  • Privacy Policy: https://www.brevo.com/legal/privacypolicy/

For the Platform, we use Brevo only for service email delivery and for the delivery events (bounces, blocks, spam reports) described in Section 2.3.

Note: Brevo applies anonymous link tracking to transactional emails (e.g., click-through redirects). This tracking is anonymized and does not identify individual users. We do not use this data. We are currently unable to disable this feature.

Hetzner (Infrastructure Hosting)

All Revel services (application, database, background tasks, monitoring, and logging) are hosted by Hetzner Online GmbH:

  • Hetzner is an EU company (headquartered in Gunzenhausen, Germany)
  • Data location: Germany
  • Safeguards: Hetzner complies with GDPR and provides a Data Processing Agreement (DPA)
  • Privacy Policy: https://www.hetzner.com/legal/privacy-policy/

5.4 Embedded Content on Other Websites

Organizers can embed their Revel event listings on their own websites. If you visit a website that embeds Revel content:

  • The embedded content is served from letsrevel.io, so your browser makes a request to our servers (subject to this policy, including the Cloudflare transit described above)
  • Embeds are cookie-free: they set no cookies and run no tracking code on the embedding website
  • We do not learn anything about your activity on the embedding website beyond the request for the embedded content itself. One exception: if the organizer installs our loader script and the address of their page carries campaign tags, the loader passes those tags to the embed so that a purchase can be attributed to that page (see Section 2.1). Nothing else about the page is read.
  • The embedding website's own privacy policy governs that website

5.5 Legal Disclosures

We may disclose your information if required by law:

  • Law enforcement requests (with valid legal process)
  • Court orders or subpoenas
  • Reporting illegal content (e.g., CSAM to authorities)
  • National security requests (if legally required)

We will notify you of legal requests unless prohibited by law.

5.6 Business Transfers

If Revel is acquired, merged, or undergoes a business transition:

  • Your data may be transferred to the successor entity
  • We will notify you before your data is transferred
  • The successor must honor this Privacy Policy

5.7 With Your Consent

We may share data for other purposes with your explicit consent.

6. Data Storage and Security

6.1 Data Location

Your data is stored in the European Union, specifically in Germany, hosted by Hetzner Online GmbH (an EU company based in Germany), ensuring GDPR compliance and strong privacy protections.

Data in transit: Traffic between your browser and our servers is routed through Cloudflare's global network for security and performance (see Section 5.3). While data at rest remains in the EU, data in transit may pass through Cloudflare infrastructure outside the EU.

6.2 Security Measures

We implement industry-standard security measures:

Technical Safeguards
  • Encryption in transit: All data transmitted over HTTPS/TLS
  • Encryption at rest: Database and file storage encryption
  • Secure authentication: JWT tokens with expiration, 2FA support
  • Password hashing: Passwords stored using Django's secure hashing (PBKDF2)
  • Malware scanning: All uploaded files scanned with ClamAV
  • Input validation: Protection against XSS, SQL injection, CSRF
Organizational Safeguards
  • Access controls: Limited access to production data
  • Regular updates: Security patches applied promptly
  • Monitoring: Error tracking and security logging
  • Backup systems: Regular backups for disaster recovery
File Security
  • Malware scanning: ClamAV scans all uploaded files
  • Quarantine system: Suspicious files are isolated and flagged
  • Notifications: Uploader, organizers, and platform staff are notified of malware detections

6.3 Data Retention

We retain your personal data only as long as necessary:

Active Accounts
  • Data retained while your account is active
  • You can delete data manually at any time
Deleted Accounts
  • Personal data deleted immediately upon account deletion
  • Financial records retained as required by Austrian law (typically 7 years for tax purposes): Stripe transaction records, invoices/credit notes and subscription payment records generated on the Platform, and records of invoices and credit notes that the organizer had to issue from their own system
  • Anonymized data may be retained for aggregated statistics (no personal identifiers)
Specific Retention Periods
  • Session tokens: Expire after inactivity
  • Email verification tokens: Expire after 24 hours
  • Password reset tokens: Expire after 1 hour
  • 2FA backup codes: Retained until used or 2FA is disabled
  • Checkout reservations and seat holds: Expire automatically within minutes if payment is not completed
  • Transactional emails: Retained in logs for 90 days for support purposes
  • Error logs and request traces: Retained for 30 days for debugging
  • Email suppression records: Kept until the address owner asks us to clear them, so that we do not email the address again

6.4 Data Breach Notification

In the event of a data breach:

  • We will notify affected users within 72 hours (as required by GDPR)
  • We will report the breach to the Austrian Data Protection Authority if required
  • We will provide details on the nature of the breach and steps taken to mitigate harm

7. Your Rights Under GDPR

As a user in the European Union, you have the following rights:

7.1 Right of Access (Art. 15 GDPR)

You can request a copy of all personal data we hold about you.

How to exercise:

You will receive a machine-readable file (JSON format) containing all your data. The export contains your data only — it never includes other people's personal data.

7.2 Right to Rectification (Art. 16 GDPR)

You can correct inaccurate or incomplete personal data.

How to exercise:

7.3 Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR)

You can request deletion of your personal data.

How to exercise:

Exceptions: We may retain data when required by law (e.g., financial records for tax compliance).

7.4 Right to Restriction of Processing (Art. 18 GDPR)

You can request that we limit how we process your data.

How to exercise: Contact [email protected] with your request.

7.5 Right to Data Portability (Art. 20 GDPR)

You can receive your data in a structured, commonly used, machine-readable format.

How to exercise:

  • Use the Data Export feature in Account Settings
  • You'll receive a JSON file containing all your data

7.6 Right to Object (Art. 21 GDPR)

You can object to processing based on legitimate interests.

How to exercise: Contact [email protected] explaining your objection.

7.7 Right to Withdraw Consent (Art. 7(3) GDPR)

For processing based on consent (e.g., Telegram notifications), you can withdraw consent at any time.

How to exercise:

  • Disable features in Account Settings > Notification Preferences
  • Contact [email protected]

7.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority.

Austrian Data Protection Authority:
Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Wien, Austria
Email: [email protected]
Website: https://www.dsb.gv.at

7.9 Exercising Your Rights

To exercise any of these rights:

  • Email us: [email protected]
  • Postal mail: Biagio Distefano, Van-der-Nüll-Gasse 69-71/19, 1100 Vienna, Austria

We will respond to your request within 30 days (as required by GDPR).

8. Children's Privacy

Revel is not intended for children under 16 years old. We do not knowingly collect personal data from children under 16.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected]. We will delete such data promptly.

Age verification: We do not provide age verification services. Event organizers are responsible for enforcing age restrictions for their events.

9. International Data Transfers

9.1 EU Data Storage

All user data is stored in the European Union (Germany), ensuring GDPR compliance. Data in transit may pass through Cloudflare's global network (see Section 5.3 and 6.1).

9.2 Third-Party Services Outside EU

Some third-party services may process data outside the EU:

Stripe (Global)
  • Data sent: Payment information (sent directly from your browser to Stripe), including stored payment methods for recurring memberships
  • Safeguards: Stripe is certified under various international frameworks for data protection
  • Privacy Policy: https://stripe.com/privacy
Cloudflare (United States)
  • Data exposed: All request and response data transits through Cloudflare's network
  • Purpose: DDoS protection, TLS termination, content delivery
  • Safeguards: Cloudflare is certified under the EU-US Data Privacy Framework and provides a standard DPA
  • Privacy Policy: https://www.cloudflare.com/privacy/
Google Wallet (United States)
  • Data sent: Ticket, pass, or membership card details (see Section 5.3), only when you choose to add a pass to Google Wallet
  • Safeguards: Google LLC is certified under the EU-US Data Privacy Framework
  • Privacy Policy: https://policies.google.com/privacy

9.3 Your Consent

By using payment processing or the platform generally (which routes traffic through Cloudflare), you acknowledge that your data may be transferred outside the EU.

10. Cookies and Tracking Technologies

10.1 Essential Cookies Only

We use only essential cookies required for the Platform to function:

  • Authentication tokens (JWT): To keep you logged in
  • CSRF tokens: To protect against cross-site request forgery
  • Language preference: To display the correct language
  • Invitation token: To keep an invitation link you followed while you join, RSVP, or check out
  • Referral code: To attribute your registration to the referring user (expires after 30 days)

Embedded Revel content on third-party websites sets no cookies at all (see Section 5.4).

10.2 No Tracking or Analytics

We do not use:

  • Google Analytics or similar analytics tools
  • Advertising cookies
  • Social media tracking pixels
  • Third-party tracking scripts
  • Fingerprinting technologies

10.3 Cookie Management

Essential cookies cannot be disabled without breaking core functionality. If you block cookies:

  • You will not be able to log in
  • Your language preference will not be saved
  • Some features may not work correctly

10.4 Local Storage

We may use browser local storage for:

  • Temporary session data
  • UI preferences (e.g., dark mode)

This data is stored locally on your device and is not transmitted to our servers.

11. Automated Decision-Making and Profiling

11.1 No Profiling

We do not create user profiles for:

  • Targeted advertising
  • Behavioral analysis
  • Predictive modeling
  • Personalized marketing

11.2 Questionnaire Evaluation

Questionnaires used for event admission or membership applications may be scored automatically, reviewed manually by the organizer, or both (see our Terms). Only multiple-choice answers can be scored automatically, using rules set by the organizer, and no AI is used. Where an automatic evaluation affects your admission, you may request human review by the organizer.

12. Notification Preferences

12.1 Transactional Notifications

We send transactional notifications via:

  • In-app notifications (notification center)
  • Email (transactional emails only)
  • Telegram (optional, if you link your account)

12.2 Notification Types

You can control notifications for:

  • Event updates (created, updated, cancelled, reminders)
  • RSVP confirmations and changes
  • Ticket, season pass, and membership purchases and confirmations
  • Membership application outcomes
  • Invitation notifications
  • Questionnaire results
  • Potluck assignments
  • Organization announcements
  • System notifications (e.g., malware detected)
  • Setup tips for organization owners
  • Digests of invoices and credit notes the organization must issue itself (organization staff)

12.3 Managing Preferences

You can manage notification preferences in:

  • Account Settings > Notification Preferences
  • Email unsubscribe links (one-click unsubscribe)
  • Muting an organization to stop its announcements without changing anything else

Note: Payment, ticket, and subscription receipts, security emails (e.g., password reset, email verification), ban notices, and platform notices cannot be disabled.

12.4 Unsubscribe

To unsubscribe from email notifications:

  • Click the unsubscribe link at the bottom of any email
  • Your preferences will be updated via a secure token. Unsubscribing from an organization's announcement mutes that organization; from other organization mail, it stops that kind of email; from a digest, it stops email notifications
  • You will still receive the emails listed in Section 12.3 that cannot be disabled
  • If you do not have an account, you can stop invitation emails from the link in any invitation

13. Open Source and Self-Hosting

13.1 Open Source Software

Revel's source code is available under the MIT License at:
https://github.com/letsrevel/

13.2 Self-Hosted Instances

This Privacy Policy applies only to the hosted service at letsrevel.io.

If you self-host Revel:

  • You are the data controller for your instance
  • You are responsible for GDPR compliance
  • You must create your own privacy policy for your users
  • This policy does not apply to self-hosted instances

13.3 Data Portability for Self-Hosting

You can export your data from letsrevel.io and import it into your self-hosted instance using the Data Export feature.

14. Changes to This Privacy Policy

14.1 Policy Updates

We may update this Privacy Policy from time to time. When we make material changes:

  • We will update the "Last Updated" date at the top
  • We will notify you via email or in-app notification
  • We will request your consent if required by law

14.2 Review of Changes

We encourage you to review this Privacy Policy periodically. Continued use of Revel after changes constitutes acceptance of the updated policy.

14.3 Objection to Changes

If you do not agree to changes:

  • You may delete your account via Account Settings
  • You may contact us at [email protected] to discuss concerns

15. Contact Us

15.1 Privacy Questions

For questions about this Privacy Policy or our data practices:

Email: [email protected]
Postal Address:
Biagio Distefano
Van-der-Nüll-Gasse 69-71/19
1100 Vienna, Austria

15.2 Data Protection Requests

To exercise your GDPR rights or request data access/deletion:

We will respond within 30 days as required by GDPR.

15.3 Data Protection Authority

If you have concerns about our data practices, you can contact the Austrian Data Protection Authority:

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Wien, Austria
Email: [email protected]
Website: https://www.dsb.gv.at

16. Acknowledgments

16.1 Third-Party Data Sources

We use the following third-party data sources:

These databases are used for non-personal geolocation features and do not track individual users.

By using Revel, you acknowledge that you have read, understood, and agree to this Privacy Policy.