Privacy Policy

2. What we collect

• Account data: name, email, hashed password, billing plan, verification status, IP address at signup.
• Content you upload: event names, descriptions, dates, locations, guest lists (name, email, phone, seating, custom fields), invitation background images, and ticket templates.
• Check-in activity: QR scans, their outcome (checked in, already in, preview, denied, invalid), the scanner's email (if signed in), IP address, and user-agent — retained as an audit log.
• Payment data: handled by Stripe. We store the minimum identifiers (customer ID, subscription status) needed to give you access. Card numbers never touch our servers.
• Cookies & local storage: a session cookie for authentication, a short-lived cookie for password-gated scanners, and functional local storage for the designer interface.

3. Why we use it (legal bases)

• Providing the service (contract, Art. 6(1)(b) GDPR): running your account, rendering tickets, scanning QR codes, sending verification and account emails.
• Security & audit (legitimate interest, Art. 6(1)(f) GDPR): logging scans, preventing abuse, blocking bots via Cloudflare Turnstile.
• Legal compliance (Art. 6(1)(c) GDPR): billing records, responses to lawful requests.
• Consent (Art. 6(1)(a) GDPR): where we ask separately, e.g. optional product updates. You can withdraw consent at any time.

4. Sub-processors

We use a small set of trusted providers to run Factra:

• MongoDB Atlas — database hosting.
• Resend — transactional email delivery.
• Stripe — payment processing.
• Cloudflare Turnstile — bot protection at signup/login.
• Google Fonts — font files fetched by the ticket renderer.

These providers process data only under our instructions or their own privacy commitments. Where they are outside the EEA, transfers rely on Standard Contractual Clauses.

5. Retention

• Account data — until you delete the account.
• Events, guests, and templates — until you delete them or archive/close the event.
• Check-in audit logs — retained for the life of the event and for a reasonable period after, to support disputes and security investigations.
• Billing records — retained as required by Cyprus tax law (currently up to 6 years).

6. Your rights (GDPR)

Where GDPR applies, you have the right to access, rectify, erase, restrict processing, port your data, and object to processing based on legitimate interest. You may also lodge a complaint with your national supervisory authority — in Cyprus, the Office of the Commissioner for Personal Data Protection (dataprotection.gov.cy).

For account data, contact us via resitech.ai. For guest data uploaded to an event, contact the event organiser (the controller); we will assist them in fulfilling your request.

7. Security

Passwords are stored with bcrypt hashing. Sessions use signed JWTs in HTTP-only, SameSite cookies. Communications with the browser use HTTPS. We follow the principle of least access when handling event data. However, no service is 100% secure — see our Terms for the applicable risk allocation.

8. Children

Factra is not directed at children. If you believe a child has provided us personal data, contact us and we will delete it.

9. Changes

We may update this Policy. Material changes will be signalled by updating the “Effective” date and, where appropriate, by an in-app or email notice.

10. Contact

Resitech Ltd · Cyprus · Web: resitech.ai