Privacy policy

Roomful ("we", "us") is based in Delhi, India. You can reach us at hello@getroomful.com.

This policy covers this website, the Roomful app inside the Shopify admin, the ticket emails we send, the ticket pages buyers open from those emails, and the check-in page that door staff use.

Two kinds of people meet Roomful, and our role is different for each.

• –Merchants install Roomful on their Shopify store. For a merchant's own account details (for example the shop owner's email), we decide how the data is used, so we are the controller.
• –Buyers buy tickets from a merchant's store. The merchant decides why buyer data is collected and is the controller. We process it on the merchant's behalf, only to provide Roomful to them. In US state privacy laws, this makes us a "service provider" or "processor".

If you bought a ticket, the merchant's own privacy policy also applies to you. You'll usually find it in the footer of their store.

From the merchant's Shopify store

When a merchant installs Roomful, they approve the Shopify permissions it asks for. With that permission, we read and store:

• –Shop details: shop name and domain, the shop owner's email, time zone, currency, and the store's logo and colours (so tickets look like the shop).
• –Products and inventory: the products and variants that are events and sessions, their stock levels, and the shop's locations.
• –Orders: orders that contain tickets, and refund and cancellation updates for them.
• –Fulfilment: we mark ticket items as fulfilled once the ticket is sent.
• –Store access: the permission Shopify gives us to work with the store, which we keep encrypted.

What merchants create in Roomful

Event names, dates, sessions, venues and addresses, capacities, prices, reminder settings, and the text of ticket emails, reminders and messages to guests.

About buyers, from their order

• –The buyer's name and email address.
• –The order number, what they bought, how many tickets, the order total and currency, and whether it was later refunded or cancelled.

We don't request buyers' phone numbers or postal addresses from Shopify. We never see or store payment card details: checkout and payment happen entirely in Shopify.

Tickets and check-in

• –Tickets: a ticket code and QR code for each ticket, the session it's for, and the attendee's name and email.
• –Check-ins: when a ticket was scanned, at which door or device, and whether it was a repeat scan.
• –Emails we send: who each ticket email or reminder went to, and whether it was sent, delivered or bounced.

Door staff

Merchants give door staff a check-in link. We store the link's name (for example "Door A") and, for each phone that uses it, a device name and when it was last used. So check-in keeps working without signal, the page keeps a copy of that event's guest list (names and ticket status) on the phone.

Visitors to this website

This website has no analytics, advertising or tracking scripts, and sets no tracking cookies. Our hosting providers process standard request data, such as IP address and browser type, to serve pages and protect against abuse.

When you contact us

If you email us, we keep the email and our reply so we can help you.

We use data only to run Roomful:

• –Issue tickets when an order is paid, and email them to the buyer with a QR code and calendar file.
• –Host the buyer's ticket page.
• –Send reminders and the messages a merchant writes to their guests.
• –Let staff check guests in, and show merchants who has arrived.
• –Keep spots and stock in sync with Shopify so events don't oversell, and mark ticket orders as fulfilled.
• –Give support, fix problems, keep the service secure, and meet legal duties.

We don't sell personal data. We don't share it for advertising. We don't use buyer data for our own marketing, and we don't use it to train AI models.

If you're in the UK or EU: for merchant account data we rely on performing our contract with you, and on our legitimate interest in running and securing the service. For buyer data, we act on the merchant's instructions, and the merchant chooses the legal basis.

Besides Shopify, we use a small number of trusted service providers for hosting and email. They handle data only to provide their service to us, under contracts that require them to protect it.

• ShopifyThe platform Roomful runs on: shop data, orders, checkout and app billingGlobal
• Cloud hostingStoring data and running the Roomful app and ticket pagesUnited States, India and a global network
• Email deliverySending ticket emails and remindersVaries

Buyer data is shown to the merchant who sold the ticket and their door staff, never to other merchants. We may also share data if the law requires it, or to protect people's safety. If Roomful is ever sold or merged, data would move to the new owner under this policy, and we would tell merchants first.

Roomful's data is stored in the United States. Parts of the service run in India, and parts of the service run on global networks, so data may be processed in countries other than yours. Where the law requires it, we rely on safeguards such as the Standard Contractual Clauses in our providers' data processing terms.

• –While Roomful is installed: we keep a shop's events, orders, tickets and check-ins so the merchant can see their history and export it.
• –Order updates from Shopify: deleted 14 days after we've used them.
• –When a shop uninstalls Roomful: we stop all work for that shop straight away. About 48 hours later, once Shopify confirms the uninstall, we delete all of the shop's data: events, orders, tickets, check-ins, staff links and settings.
• –When a buyer asks to be erased: when Shopify passes on a buyer's request to be erased, we remove their name and contact details from their orders, tickets and email records. Anonymous counts (for example, that a ticket was sold) stay, so the merchant's totals still add up.
• –Backups: deleted data can stay in our database provider's backups until those backups expire on their normal cycle.
• –Our own records: we may keep a short log of support actions our team took on a shop, for security, after the shop's data is gone.

Once a shop's data is deleted, its buyers' ticket pages and QR codes stop working. Merchants should export their guest lists first.

• –All traffic is encrypted in transit (HTTPS).
• –Store access is kept encrypted.
• –Each shop's data is kept separate, so no shop can see another's.
• –Check-in links are stored in a protected form, and merchants can turn them off at any time.
• –Ticket QR codes can't be forged.
• –Only the people who run Roomful can reach the systems that hold the data, and only to run and support the service.

No system is perfectly secure. If a breach affects your data, we'll tell affected merchants without undue delay, so they can tell their buyers where needed.

If you're a merchant

You can see your data in the app and export your guest list as a CSV at any time. To ask for a copy, a correction, or deletion of anything we hold about you, email hello@getroomful.com. Uninstalling Roomful deletes your shop's data as described above.

If you bought a ticket

Please contact the shop you bought from first: they control your data and can ask us to act on it. Shopify also passes privacy requests (to see or erase your data) on to us, and we act on them for the shop. You can also email us at hello@getroomful.com. We'll pass your request to the right shop and help them deal with it.

Everyone

Depending on where you live (for example under the GDPR, UK GDPR, India's Digital Personal Data Protection Act, or US state laws such as California's), you may have the right to access, correct, delete or export your personal data, to object to or restrict some uses, and to complain to your local data protection authority. We won't treat you differently for using these rights.

Roomful is a tool for businesses and isn't aimed at children. A parent may buy a ticket for a child's class; in that case the parent's details are on the order, and the merchant is responsible for any child's information they ask for.

If we change this policy, we'll update the date at the top. If a change matters, for example a new kind of data or a new service provider, we'll tell merchants by email or in the app before it takes effect.

Email hello@getroomful.com. A person reads every message. Roomful, Delhi, India.