EventSquare
Last updated: September 16, 2026
EventSquare is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use our event ticketing and management platform at eventsquare.online.
The data controller responsible for your personal data is:
Please read this policy carefully. By using the Platform you acknowledge you have read and understood it. If you do not agree with its terms, please discontinue use of the Platform.
When you register, we collect your full name, email address, phone number (optional), password (hashed and never stored in plain text), profile photo (if uploaded), country, preferred currency, and membership tier.
Organisers who wish to publish events or request fund withdrawals must complete a two-step identity check: (a) verifying their phone number via a one-time SMS code sent through Twilio, and (b) completing a 3-photo liveness selfie check. Selfies are reviewed by EventSquare staff and stored securely for fraud prevention and platform integrity. Phone numbers are stored on your account and used solely for OTP delivery and account security. OTP codes are held in a temporary server-side cache (Redis) for a maximum of 10 minutes and then permanently deleted.
Verified organisers may optionally provide a Company Name, which is displayed publicly as the organiser on any events they publish. This name must be unique across the platform.
We store records of events you save ("Saved Events") and organisers you choose to follow. This data is used solely to power those features (such as notifying you when a followed organiser publishes a new event) and is not shared with third parties or used for advertising.
When you access the Platform our servers automatically record: your IP address, browser type and version, operating system, referring URL, pages visited, time and date of access, and session duration. This data is used for security monitoring, debugging, and analytics.
We do not store full card numbers, CVV codes, or bank account credentials. Payment details are transmitted directly to Paystack via their secure SDK. We receive and store only transaction references, amounts, statuses, and Paystack-assigned identifiers.
We store messages you send through our support ticket system and live chat, including any file attachments. We also store email correspondence relating to your account for customer service and dispute resolution purposes.
If you are an organiser, we store event titles, descriptions, banners, logos, ticket plan details, promo code configurations, and attendee data generated by your events.
We use the information we collect to:
If you click "Enable Location" or allow the browser location prompt on our homepage, your browser will transmit your device's GPS coordinates (latitude and longitude) to our server via the GET /api/nearby-events/ endpoint. We use those coordinates to call the OpenStreetMap Nominatim reverse-geocoding API, which returns a city name. The city name is cached in Redis for up to 1 hour keyed by rounded coordinates (4 decimal places). We do not store your raw GPS coordinates in our database.
Your location permission preference is stored in your browser's localStorage under the key es_loc_granted. Dismissing the toast stores es_loc_toast_dismissed. These values never leave your browser; we do not transmit or read them server-side.
You can revoke GPS permission at any time via your browser settings (Site settings → Location → Block eventsquare.online).
All payment processing on EventSquare is handled by Paystack (paystack.com), a PCI-DSS compliant payment processor. When you make a deposit or purchase, your card or bank account details are entered directly into Paystack's hosted fields or redirected to Paystack's checkout. EventSquare never sees, transmits, or stores your full card number, expiry date, or CVV.
We receive and store from Paystack:
Paystack's own Privacy Policy governs how they handle your payment data: paystack.com/privacy.
Every credit and debit to your EventSquare wallet is recorded as a Transaction object in our database. We retain transaction records indefinitely for financial compliance, dispute resolution, and audit trail purposes. Transaction records contain: type, amount, balance-after-transaction, description, reference, status, and timestamp.
Withdrawal requests additionally store: the destination bank name, account number (visible to EventSquare staff processing the transfer), bank code, and fee breakdown. This data is necessary to execute the Paystack bank transfer and is stored only for the duration required by applicable financial regulations.
When you purchase a ticket we create a Ticket record linked to your account, containing: event reference, ticket plan, price paid, unique QR code identifier, check-in status, and check-in timestamp (if scanned). This data is shared with the event organiser for attendance management purposes. Organisers can view and export attendee lists (name, email, ticket type, check-in status) via their organiser dashboard and CSV export.
QR code data (EVENTSQUARE:uuid:salt) is embedded in the PDF ticket and PNG image generated at purchase. It is not transmitted to any third party.
When you submit a contact form or support ticket, we store your name, email, subject, message, category, and any attached files. Support threads (user replies and staff replies) are retained for the lifetime of the ticket plus 2 years, for quality assurance and dispute resolution.
Live chat sessions between users and support agents are stored as ChatSession and ChatMessage records in our database. Chat histories are retained for 12 months after the session closes. Do not share passwords, full card numbers, or other highly sensitive information over the chat interface.
EventSquare stores a Notification record for each in-app alert (ticket purchased, refund approved, deposit credited, withdrawal updated, event reminder). Notifications are delivered in real time via a persistent WebSocket connection (wss://eventsquare.online/ws/notifications/) and stored in the database for your review. You can mark notifications as read or delete them from the notifications page. Unread notifications are retained indefinitely; read notifications are retained for 90 days.
Every email we send is logged with a reference. We do not share your email address with mailing list or advertising partners. You cannot opt out of transactional emails (e.g., ticket confirmation, security alerts) as they are necessary for the service, but we minimise email volume to events that directly concern your account activity.
Each registered user is assigned a unique referral code. When a new user signs up using your referral code, we store the association between the referrer and the referred user to credit any applicable referral bonuses. We do not share referral data with third parties. Referral bonus transactions appear in your wallet transaction history.
EventSquare maintains an ActivityLog for fraud prevention and regulatory compliance. Every significant action generates a log entry recording: the acting user, action type, timestamp, affected object, IP address, and user-agent. Logged actions include (but are not limited to): account logins and logouts, password changes, 2FA enable/disable, ticket purchases, wallet deposits, withdrawal requests, and moderator admin actions.
Activity logs are accessible only to EventSquare staff and are retained for a minimum of 2 years. They may be disclosed to law enforcement in response to a lawful request.
EventSquare uses a Django session cookie (sessionid) to maintain your authenticated state. This cookie is HTTP-only, secure (HTTPS-only), and expires when your browser session ends or after a defined inactivity timeout. You cannot use authenticated features of the Platform without this cookie.
A CSRF token cookie (csrftoken) is set to protect against cross-site request forgery. This is a security requirement and cannot be disabled.
We write two keys to your browser's localStorage for the GPS location feature: es_loc_granted (whether you previously granted GPS permission) and es_loc_toast_dismissed (whether you dismissed the location prompt). These values are read only by our homepage JavaScript and are never transmitted to our servers.
EventSquare does not use third-party advertising cookies, tracking pixels, or analytics cookies (e.g., Google Analytics). We do not participate in cross-site behavioural advertising networks.
We do not sell, rent, or trade your personal data. We may disclose your information in the following limited circumstances:
We may disclose your data if required to do so by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of EventSquare, our users, or the public.
When you purchase a ticket, your name, email address, and ticket details are shared with the event organiser for attendance management. The organiser is bound by our Terms of Use and must not use your data for any purpose other than managing attendance at their event.
Your email address and transaction reference are shared with Paystack to facilitate payment processing. No additional personal data is shared beyond what is necessary to complete the transaction.
We engage trusted third-party service providers who process data on our behalf under data processing agreements. These include our hosting provider (PythonAnywhere), our Redis provider (Upstash), our email delivery provider (Resend), and our SMS delivery provider (Twilio). These providers are prohibited from using your data for their own purposes.
If EventSquare is involved in a merger, acquisition, or asset sale, your personal data may be transferred as part of that transaction. We will provide notice before your data is transferred and becomes subject to a different privacy policy.
EventSquare integrates with the following third-party services. Each has its own privacy policy governing its use of data:
| Service | Purpose | Data Shared |
|---|---|---|
| Paystack | Payment processing & bank transfers | Email, amount, reference |
| OpenStreetMap Nominatim | GPS reverse geocoding (city from lat/lng) | GPS coordinates (rounded to 4 d.p.) |
| Upstash (Redis) | Cache & task broker | GPS city cache, session tokens |
| Resend / SMTP | Transactional email delivery | Name, email, ticket/order details |
| Twilio | SMS delivery for phone OTP verification | Phone number, one-time code |
| Google Fonts | Web font delivery | IP address (standard CDN request) |
We implement the following measures to protect your personal data:
rediss:// TLS connection; data at rest is encrypted by our cloud provider (Upstash).While we implement reasonable security measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee the absolute security of your data.
We retain your personal data for as long as your account is active or as needed to provide you with our services. Specific retention periods:
Upon account deletion, personal identifiers are removed from your records and replaced with anonymised placeholders. Transaction records are retained in anonymised form for financial compliance.
Subject to applicable law, you have the following rights regarding your personal data:
To exercise any of these rights, email privacy@eventsquare.online. We will respond within 30 days. We may ask you to verify your identity before processing your request.
EventSquare is not directed at children under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have collected data from a child under 18 without verified parental consent, we will take immediate steps to delete that data. If you believe a child has provided us with personal data, please contact us at privacy@eventsquare.online.
EventSquare is based in Nigeria. Your data may be processed outside of Nigeria by our service providers (including Paystack, Upstash Redis, Google Fonts, and Resend), some of which are based in the United States or the European Union. Where data is transferred internationally, we ensure it is protected by appropriate safeguards such as the provider's compliance with applicable data protection standards.
We may update this Privacy Policy from time to time to reflect changes to our data practices or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page and, where the changes significantly affect your rights, notify you by email. Continued use of the Platform following notification of changes constitutes acceptance of the updated policy.
For all privacy-related enquiries, data access requests, or to report a data breach, please contact our Privacy team:
We aim to respond to all data-related requests within 30 calendar days. Complex requests may take longer, and we will inform you if an extension is needed.