Privacy Policy

1. Who we are

atmsphr is operated by Black Label Creators LLC, 575 Sixth Avenue, San Diego, CA 92101. For anything in this policy, write to privacy@atmsphr.club.

2. What we collect

What you give us

An email address or a phone number, so you can sign in and so we can send you a ticket. A display name and, if you upload one, an avatar. Your notification preferences. If you put on events: your organizer profile, your event details and your payout details.

What a purchase creates

Orders, tickets, the events they are for, and the entry scans at the door. Payment card details are entered directly into Stripe and never reach our servers — we store an identifier for the payment and the amount, in whole cents, and nothing else about the card.

What you share with Studio

Your messages, conversation context, event drafts, attached artwork and contact files you choose to import. Studio retrieves workspace records relevant to your request within your account permissions. Contact imports are stored in your workspace; importing a contact does not by itself grant messaging consent.

What we record as you use it

Which events you viewed and saved, who you follow, and — where a link carried one — the source a visit arrived from, as a short label like instagram. We do not build advertising profiles and we do not sell any of it.

Website traffic

We count page visits using a random identifier in your browser’s session storage, renewed after 30 minutes of inactivity. We record the public page path, event or host, referring website domain, screen-size category and time. We also record checkout steps, button actions, coarse page-scroll milestones, ticket quantities, promo-code outcomes and categorized errors to identify where checkout becomes difficult. We do not record keystrokes, field contents, screen recordings or card information in these analytics. These records do not include your account ID, full referring URL, search terms or payment details. They are deleted after 180 days. We honor Do Not Track and Global Privacy Control for this measurement. This helps us understand which pages and events are being discovered.

Optional Google Analytics

For visits identified as originating in the United States, Google Analytics is enabled automatically unless you opt out. Elsewhere, or when the visitor’s country is unknown, it stays off unless you enable it through “Analytics choices” in the footer. We use analytics cookies to measure public-page visits, referring website domains, device/browser information and checkout milestones. Google receives this usage information and processes network information such as your IP address to provide the service. We do not send names, email addresses, phone numbers, account IDs, card details, form contents, URL query strings or private ticket links to Google Analytics. Advertising personalization and Google Signals are disabled. Analytics cookies expire after 180 days. You can turn this measurement off at any time through “Analytics choices” in the website footer; the site and checkout work without it. Do Not Track and Global Privacy Control also disable this measurement. See how Google uses information from sites that use its services.

We do not ask for, and have no use for, government identification, biometrics, precise background location, or any of the special categories of data under GDPR and comparable laws.

3. Why we are allowed to hold it

To perform the contract you entered when you bought a ticket or listed an event; to meet legal obligations, principally tax and financial record-keeping; for our legitimate interest in operating a service that is not defrauded; and, for text updates and anything else you switch on, because you consented and can withdraw it.

4. Who else sees it

Processors who do a specific job for us and may not use your data for their own purposes: Supabase (database and authentication), Stripe (payments), Resend (email), Twilio (text messages), Vercel (hosting), Mapbox (maps), OpenAI (Studio responses) and Google (optional website analytics).

Studio sends messages, conversation context, attached images and relevant event or workspace information to OpenAI to interpret requests and prepare responses. Depending on your request, this can include personal information in messages, guest lists or staff records. Only provide information you are authorized to share. The mobile app asks for permission before your first Studio message. You can turn sharing off in Studio privacy and use the regular host controls without sending requests to OpenAI. Turning sharing off does not delete previous requests; contact us for data-access or deletion questions.

Hosts see what they need to run their event: who is on the guest list, order records for their own events, and the name and contact details of people who bought tickets from them. They see this for their events and no others. A host cannot browse the people who bought from someone else, and the database enforces that rather than the interface hiding it.

Other attendees see initials, not names, unless you have chosen otherwise. Being publicly listed as attending a 21+ event is not something to opt somebody into by omission.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have never done either, so there is nothing to opt out of.

5. Mobile information and text messaging

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be sold, rented or shared for those purposes. Service providers acting on our behalf may process this information to deliver, secure and support the service, or as required by law.

A contact number alone does not authorize texts. Verification messages are sent only when requested; recurring ticket confirmations require a separate opt-in tied to your provided number. Ticket-text consent is never reused for promotions. Separately opted-in host event alerts are sent by atmsphr for the host you chose; hosts see aggregate counts and cannot export the underlying SMS audience or consent.

Twilio processes phone numbers and message content to deliver texts and collects and monitors content to detect spam, fraud and abuse. Supabase stores account, consent, withdrawal and delivery records. We record the date, method, phone number, program and disclosure version for consent, and provider identifiers and status for delivery. Replies may be retained to process opt-outs and support requests.

These restricted records may be retained after you turn off texts or delete your account to honor opt-outs, demonstrate consent and address legal obligations or disputes. They are not used to build marketing lists. Contact us about access, deletion or retention questions.

Message frequency varies. Message and data rates may apply. Reply STOP or turn off Text updates in settings to unsubscribe. Reply HELP or email support@atmsphr.club for help.

SMS terms explain how to opt in, request help and stop texts. The SMS guide shows the ticket-checkout, membership-signup and account-settings consent flows.

6. How long we keep it

Your account and its contents for as long as the account exists. Orders, tickets and the financial records attached to them for seven years after the event, because tax law and card-scheme dispute windows require it. Entry scans for two years. Analytics in aggregate indefinitely, with nothing in it that identifies a person.

7. Security

Account permissions and database rules control access to your data. Server-only operations handle payments, notifications and account requests with restricted credentials. Those credentials are not included in the website or the app.

Entry codes are signed inside the database and change every thirty seconds. The key material that signs them is in a table that no account can read — not yours, not a host’s, not ours through the ordinary interface. A screenshot of a code is a picture of something that has already stopped working.

No system is perfectly secure. If a breach affects you we will tell you, and we will tell you what actually happened.

8. Your rights, and how to use them

You can ask for a copy of your data or ask us to delete it, from Settings → Your data. In the app, Account → Privacy & account data → Delete account removes your profile and cancels active memberships before closing your login. Data-export requests and website deletion requests are recorded for processing by our team.

Deletion scrubs the identifiers. Financial records survive it, because we are required to keep them and because a refund or a chargeback six months later has to be answerable.

You can correct your details, withdraw consent for text updates, and object to processing, at any time. Depending on where you live you may also have the right to complain to a supervisory authority, and if you are in California to know what we collect and to opt out of sale or sharing — neither of which we do.

9. Minimum age

atmsphr is available to people aged 16 and older. Individual events may have higher age requirements, such as 18+ or 21+, as shown on their listings.

We do not knowingly collect personal information from anyone under 16. If we learn that we have collected it, we delete it. To report this, contact privacy@atmsphr.club.

10. Changes

If we change this policy in a way that matters, we will say so on this page and change the effective date at the top. Material changes to how we use your phone number will be notified before they take effect, not after.