Privacy Policy

1. Who We Are

NOCTVM is a nightlife and event discovery platform with a ticketing service for venues and organisers. This policy explains how we collect, use, and protect your personal data when you use our service.

NOCTVM is for people aged 18 and over. We do not knowingly collect data from anyone younger; if we learn an account belongs to someone under 18, we close it and delete its data.

Contact: support@noctvm.app

2. What We Collect

• Account data: name, email, username, profile picture, bio
• Authentication data: user ID, OAuth provider data, session logs
• Profile & social data: photos, posts, comments, likes, saves, follows, blocks, reports
• Ticket data: the tickets you buy, the event, the order and the name and email the ticket is issued to, and when it was checked in at the door
• Payment data: card payments are handled by Stripe. NOCTVM never receives your card number; we receive the payment's status and amount
• Moonrays data: your balance and the history of how points were earned and spent
• Location data: approximate city-level location; precise GPS only with explicit permission
• Event data: event listings, venue interactions, search history
• Device data: IP address, browser and app version, error and crash reports
• Consent data: cookie preferences and consent logs
• Facebook Page data (venues only): if a venue manager connects their Facebook Page, we store the Page's number and name, an encrypted access token for that Page, and the manager's app-specific Facebook user number. From the Page we read only its upcoming events (name, description, start time, cover image, ticket link and whether it is cancelled) and save each one as a draft on the venue's dashboard. We do not read attendees, comments, messages, posts, followers or who is interested or going, and we never post to Facebook

If you run a venue and sell tickets, Stripe collects the identity and bank details it needs to pay you out, directly in its own secure form. NOCTVM does not receive your ID documents or bank account number.

3. How We Use Your Data

• To create and manage your account (contractual necessity)
• To display your profile and social content (contractual necessity)
• To sell, issue, deliver and check tickets, and to handle refunds with the seller (contractual necessity)
• To keep the records that accounting and tax law require for ticket sales and fees (legal obligation)
• To send transactional emails — verification, tickets, security alerts, account notices (contractual necessity and legitimate interest)
• To recommend events based on your city and preferences (legitimate interest)
• To moderate content, prevent fraud and abuse, and keep the platform safe (legitimate interest)
• To find and fix errors, using error reports (legitimate interest)
• To count visits and measure performance with cookieless analytics that don't identify you or follow you to other sites (legitimate interest)
• Any other analytics, and marketing, only with your consent

When you buy a ticket, the venue or organiser selling it sees your name and NOCTVM username on their door list, and your email address and payment in their Stripe payment records, because the sale is theirs. They use this as a separate controller, for your entry and for their own legal obligations.

Where you came from. When you create an account we record which link brought you to NOCTVM (the campaign tags in the link, such as utm_source, and the website you came from, host name only) so we can see which of our channels work. It is stored once, kept apart from your public profile, and visible only to us. If you accept Measurement cookies, we remember it on your device until you sign up; if you do not, it is used only for the visit you are on. During sign-up this information is passed through Clerk, our sign-in service.

4. Third Parties We Work With

• Supabase — database and file storage (EU hosting)
• Clerk — sign-in and account security (US-based, Standard Contractual Clauses)
• Stripe — ticket payments, refunds and venue payouts. For verifying venues and preventing fraud, Stripe also acts as an independent controller under its own privacy policy (Stripe Payments Europe, Ireland)
• Vercel — website hosting and cookieless performance and visit analytics (US-based, EU–US Data Privacy Framework)
• Umami — cookieless analytics of visits and of actions in the app (for example opening an event, tapping a ticket link, signing up, or arriving through an invite link, including that link's invite code), run on our own Vercel hosting; no cookies, no cross-site tracking, and no names, emails or account IDs
• Cloudflare — DNS, and storage and delivery of uploaded photos and media (US-based, EU–US Data Privacy Framework)
• Resend — transactional and ticket emails, sent through Amazon SES in the EU (Ireland) (US-based, EU–US Data Privacy Framework)
• Sentry — error monitoring; error reports can include your IP address and device details. Also the bug reports you send from the app (from the menu, Settings, or by shaking your phone): your message, the page you were on, your screen size and device, your account ID if you are signed in, and your email and a screenshot only if you add them (data stored in the EU)
• Microsoft Clarity — only if you accept Measurement cookies: heatmaps and session replays of how the app is used, never what you type, with ticket, payment and account screens hidden (US-based, EU–US Data Privacy Framework)
• OpenFreeMap — map tiles. Your browser loads them directly, so OpenFreeMap receives your IP address when you view a map
• GIPHY — GIF stickers. Your browser loads them from GIPHY directly, when you open the GIF picker and whenever a story with a GIF is shown, so GIPHY receives your IP address, what you search for and which GIFs you tap or view, under a random ID from GIPHY, never your NOCTVM account
• Google — OAuth sign-in (limited profile data)
• Facebook / Meta — OAuth sign-in (limited profile data). Also, only for venues that choose to connect a Facebook Page: Facebook Login for Business with the permissions pages_show_list (the list of Pages the manager runs, so they can pick one), business_management (only so that list includes Pages run through a Meta business portfolio; nothing in the portfolio is read or changed) and pages_read_engagement (the chosen Page's upcoming events). The Page access token is stored encrypted and used only to read those events once a day and when the venue taps "Sync now". Imported events arrive as drafts the venue edits and publishes itself; nothing is ever posted to Facebook
• Spotify, SoundCloud and YouTube — music players embedded on artist pages load from these services, which receive your IP address and may set their own cookies under their own policies

5. Your Rights (GDPR)

You have the right to: access, rectify, erase, restrict processing, data portability, object to processing, and withdraw consent at any time.

To exercise these rights, email support@noctvm.app, download your data from Settings, or use in-app account deletion. See how account deletion works.

You also have the right to lodge a complaint with the Romanian data protection authority (ANSPDCP).

6. Data Retention

We retain your data while your account is active. After deletion, data is anonymised or deleted within 90 days. Security logs are retained for up to 180 days. Ticket and payment records are kept for as long as accounting and tax law requires, even after your account is deleted.

A Facebook Page connection (Page number and name, encrypted access token, and Facebook user number) is kept until the venue taps Disconnect on its dashboard, until the person who connected it removes NOCTVM in their Facebook settings (Settings, Apps & Websites) or asks us through the data deletion page, or until the venue is deleted. Events already imported stay as the venue's own listings, because they belong to the venue.

7. Cookies

See our Cookie Policy for details on how we use cookies and similar technologies.

8. Invites, Rewards and Team Roles

Invites. If you join through someone's invite link, we record who invited you so they can be credited. They see how many people joined and stayed active. They never see who.

Rewards check. To decide whether an invite counts, we look at whether the new account finished setting up (including choosing its own @username) and saved an event. This is a simple rule, not profiling. You can ask us to look at a decision.

Team and Promoters. If you are on the NOCTVM team or a Promoter, we keep your role, when and by whom you were added, and a log of your actions in the team area. Legal basis: the agreement you accept when you join, and our legitimate interest in running the team safely.