Storia Privacy Policy

Effective date: {{EFFECTIVE_DATE}}

1. Who we are

Storia is an online platform that lets people discover events, book tickets for themselves and others, and lets event organisers publish and manage events. Storia is operated by {{OPERATOR_NAME}} (ABN {{OPERATOR_ABN}}) (“we”, “us”, “our”).

This policy explains how we collect, use, disclose and look after personal information when you use the Storia mobile apps and website at https://landing-staging.storiading.workers.dev (together, the “Platform”). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”).

If you have any questions, contact us using the details in section 13.

2. The kinds of personal information we collect

2.1 Account and profile information

• Your email address and the information needed to sign you in ({{SIGN_IN_METHODS}}).
• Your name and any profile details you choose to add (for example a display name or photo).
• Your account preferences, such as language and notification settings.

2.2 Booking information

When you book tickets we collect:

• The event, the number of tickets, the booking status (for example confirmed, cancelled, checked in) and the time of booking.
• For each ticket, the attendee’s name and email address. If the ticket is for you, we may fill in your account email automatically.
• If the event is paid, the amount paid, fees, refunds and a payment reference from our payment provider (see section 2.5).
• Answers to booking questions, if the organiser asks questions when you book (for example dietary or accessibility needs). We collect your answers and share them with that organiser for that event only. Questions that may reveal sensitive information are optional. We delete your answers {{REGISTRATION_ANSWERS_RETENTION_DAYS}} days after the event ends (see section 8).
• Whether you chose to appear on the guest list (“Show me on the guest list”), if the event shows one. This is off unless you turn it on, and you can turn it off at any time.

2.3 Information about other people you book for (companions)

You can book tickets for other people (“companions”). When you do, you give us the companion’s name and email address. We use this to issue the companion’s ticket, send it to their email address, and let the event organiser know who is attending.

If you give us someone else’s personal information, you must make sure they know you are giving it to us, what it will be used for, and that they can read this policy. When a companion receives their ticket email, it will tell them who we are and link to this policy.

We do not send marketing to a companion unless that companion has agreed to receive it themselves. Your booking on their behalf is not their consent. See section 5.

Ticket transfers (if enabled). If someone transfers a ticket to you, they give us your name and email address. We use them only to issue the ticket to you and send you transactional messages about it. The email you receive tells you who transferred the ticket, how we use your details and links to this policy. Answers the original attendee gave to the organiser’s booking questions stay with the original booking and are not shown as yours. We do not send you marketing because of a transfer.

2.4 Organiser and venue information

If you publish events as an organiser, we also collect the information you provide about yourself or your organisation (for example organiser name, description, contact details), the events you create, and the information our payment provider needs to pay you (see section 2.5).

If you list a venue or register interest as a venue, we collect the business and contact details you give us (for example venue name, contact person, phone, email, ABN and website).

We also keep a record of your progress in getting set up (for example when you signed up, completed your profile, published your first event, how you heard about us) and of our conversations with you about using the Platform.

2.5 Payment information

Payments for paid events are processed by {{PAYMENT_PROVIDER_NAME}}. We do not receive or store your full card number. Card details are entered into and held by {{PAYMENT_PROVIDER_NAME}}. We receive limited information back, such as a payment reference, the amount, the payment status and, in some cases, the card brand and last four digits.

Organisers who receive payouts provide identity and bank account information directly to {{PAYMENT_PROVIDER_NAME}} for verification. {{PAYMENT_PROVIDER_NAME}}’s handling of that information is covered by its own privacy policy: {{PAYMENT_PROVIDER_PRIVACY_URL}}.

2.6 Device and technical information

• A push notification token for your device, if you allow notifications in the app.
• Technical information that is generated when you use the Platform, such as IP address, device and browser type, operating system, app version and server logs. Our hosting provider also processes this information to deliver and protect the service (for example against abuse and attacks).

We use PostHog to understand how the website and apps are used (for example, which pages are visited, which device type and operating system are used, and whether a booking was completed). On the website we do this without cookies or similar browser storage. We do not send your name, email address or other contact details to PostHog; if you are signed in, we link usage to a random account identifier. PostHog is configured not to store your IP address. On the website we also use Cloudflare Web Analytics, which counts page visits and shows device, browser and country statistics without cookies or similar browser storage and without identifying you. We do not use advertising tools in the Platform.

We use Sentry to find and fix errors in the website and our servers. When something goes wrong, an error report is sent to Sentry with technical details (the error message, the page address without any query or link codes, browser and operating system type, and recent steps in the app). Before a report is sent we remove email addresses, sign-in and link codes and similar tokens; if you are signed in, the report includes only a random account identifier, not your name or email address. Sentry is configured not to store your IP address.

2.7 Communications

If you contact us, we keep the messages and any information you include in them.

If you email an organiser (or an attendee) through our anonymous email relay, neither side sees the other’s real email address. We pass the message on without storing its subject, text or attachments; we keep only a record of the conversation (the event, the two people in it, when each message was sent and whether it was delivered) and, for delivery, the address each relayed email was sent to. Our email provider, Resend, sends the relayed message and keeps a copy of it for {{RESEND_EMAIL_RETENTION}}.

2.8 Sensitive information

We do not ask for sensitive information (such as health information, religious beliefs or sexual orientation). Some events may by their nature suggest something about the people who attend them. Please do not include sensitive information in free-text fields unless it is needed.

If an organiser asks a booking question about dietary or accessibility needs, your answer may reveal health or religious information. Answering is optional. If you answer, you consent to us collecting it and sharing it with that organiser for that event only.

2.9 Registering interest on our website

If you register interest on our website (for example to host events or list a venue), we collect your email address, your name if you give it, which page you used, and whether you agreed to receive marketing (with the exact wording you agreed to and when).

3. How we collect personal information

• From you, when you create an account, edit your profile, book tickets, publish events, register interest on our website or contact us.
• From the person who booked for you, if you are a companion.
• Automatically, from your device when you use the Platform (see section 2.6).
• From our payment provider, about the status of payments, refunds and payouts.

You can browse public event pages without an account. If you choose not to give us the information we ask for, we may not be able to create your account, issue tickets or process your booking.

4. Why we collect, use and disclose personal information

We use personal information to:

• create and manage your account and sign you in;
• process bookings, issue tickets and send them to each attendee’s email address;
• send transactional messages about your bookings and events, such as confirmations, reminders, changes, cancellations and refunds (by email and, if enabled, push notification);
• let organisers manage their events, including seeing the name and email address of each attendee and checking people in;
• process payments, refunds, platform fees and payouts;
• provide support and respond to enquiries and complaints;
• keep the Platform secure, prevent fraud and misuse, and enforce our Terms of Service;
• if enabled, suggest events you may like, based on organisers you follow, events you have saved and interests you have chosen. Events you recently viewed are kept on your device and used there for this; we do not keep a record of your browsing history on our servers;
• contact organisers and venues to help them get started and to follow up on how the Platform is working for them, and keep a record of those contacts and of their set-up progress in our own systems. Only our staff who work with organisers and venues can see these records. We only use business contact details for this, never attendee information;
• improve and fix the Platform, including by testing different versions of a feature with different groups of users and comparing how they are used. We do not test different prices, fees, refund terms or eligibility rules on different people this way;
• comply with our legal obligations (for example tax, accounting and record-keeping).

4.2 Automated decisions

[Draft — APP 1.7–1.9, applies from 10 December 2026; pending lawyer review, #141, #727] Some decisions on the Platform are made by computer programs using personal information, and could affect what you can do on the Platform:

• Payment screening. {{PAYMENT_PROVIDER_NAME}} automatically screens card payments for fraud using payment, device and booking details, and may decline a payment.
• Age-restricted events. If an event has a minimum age, you can only book after confirming you meet it; the booking is refused automatically if you do not confirm.
• Organiser tax details. When an organiser enters an ABN, we check it automatically against the Australian Business Register. An ABN that is not valid cannot be saved, and the GST status shown on tax invoices follows the register.
• Abuse and security limits. We automatically limit or block requests that look like spam, scraping or attacks, based on account and technical information such as an anonymised IP address.

If you think one of these decisions about you is wrong, contact us (see section 13) and a person will review it.

4.1 Who we disclose personal information to

• Event organisers. When you book an event, the organiser of that event can see the name and email address of each attendee on the booking, the booking and check-in status and, for paid events, payment and refund status. Organisers are independent from us and handle that information under their own privacy obligations. They may only use it to run their event and as permitted by law.
• Other people viewing the event page, only if you choose “Show me on the guest list”: we show your name and profile photo (never your email address). You can withdraw at any time and you will disappear from the list straight away. Organisers can turn the guest list off for their event, and it is off by default for 18+ events.
• Service providers who help us run the Platform (listed in section 6). They process personal information on our behalf.
• Our payment provider, {{PAYMENT_PROVIDER_NAME}}, to process payments, refunds and payouts.
• Professional advisers, such as lawyers and accountants, where needed.
• Authorities, where required or authorised by law (for example in response to a court order or a lawful request from a regulator or law enforcement).
• A successor, if our business or the Platform is sold or transferred, subject to this policy.

We do not sell personal information.

5. Marketing

We send transactional messages (such as tickets and event changes) because they are needed to provide the service you or the person who booked for you asked for.

We will only send you marketing messages (for example news or recommended events) by email or push notification if you have consented to receive them, as required by the Spam Act 2003 (Cth) and APP 7. Every marketing email will identify us and include a working way to unsubscribe. You can also turn marketing notifications off in the app settings at any time.

Other messages you can choose to receive:

• New events from organisers you follow. Following an organiser is your consent to be told when they publish new events. Every alert has a link to stop them without signing in, and you can turn them off in your settings.

• Venue listing updates. If you tick “Email me when venue listings open”, we record when you agreed and the exact wording you agreed to. You can untick it at any time.

• Hosting and venue news. If you tick the box when you register interest on our website, we email you news and offers about hosting events and listing venues. If you don’t tick it, we only reply about your enquiry.

Organisers and venues. If you sign up as an organiser or venue, we may email or call you about getting set up and using the Platform. Messages that promote our services will identify us and include a way to opt out, and we will stop within 5 business days of your request. You can also tell us at any time that you don’t want to be contacted this way.

Organisers can send a short update about an event you have a ticket for. These updates must be about that event only; they are not marketing.

Companions: a person who booked a ticket for you cannot consent to marketing on your behalf. We may invite you, in your ticket email, to sign up for marketing yourself. If you do not, we will only send you messages about your ticket and the event.

6. Overseas disclosure and service providers

We use the following service providers to operate the Platform. Some of them store or process personal information outside Australia, so your personal information may be disclosed to recipients in the countries listed below (APP 8).

We take reasonable steps to make sure overseas recipients handle personal information in a way that is consistent with the APPs, including by using providers that are bound by data processing terms. We will update this table if our service providers change.

7. How we hold and protect personal information

Personal information is stored electronically with our service providers. We take reasonable steps to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure, including:

• encryption of data in transit;
• database access rules so that each user and organiser can only access the records they are entitled to see;
• restricting administrative access to people who need it. Our platform staff may access account information (for example your profile, bookings and notification history) to provide customer support and to keep the platform safe; this access is read-only and every access is logged;
• keeping secret keys out of the apps and source code.

No system is completely secure. If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (“OAIC”) where required under the Notifiable Data Breaches scheme.

8. How long we keep personal information

• Account and profile information: while your account is active. If you delete your account in the app, we delete or de-identify this information straight away; if you ask us by email, we do it within 30 days. If you still have events or venue bookings that haven’t finished, we complete the deletion when they end. The records below are kept as described.
• Money records (orders, tickets, payments, refunds, chargebacks, payouts, tax invoices and adjustment notes): for 7 years after the transaction, to meet tax and accounting record-keeping requirements and for disputes and legal claims. If you delete your account, we keep these records without your name or email address.
• Answers to booking questions: only the organiser of that event can see them. We delete them automatically {{REGISTRATION_ANSWERS_RETENTION_DAYS}} days after the event ends, or sooner if you delete your account. The organiser may export them before then for running the event; after export the organiser handles that copy under its own privacy obligations.
• Anonymous email relay: we don’t store relayed messages. The record of a relay conversation is deleted {{RELAY_RETENTION_DAYS}} days after the event ends. If you ask to delete your account, we close your relay conversations and remove your email address from our records of the messages you received through the relay straight away.
• Website enquiries (registering interest): 24 months after our last contact with you; after that we delete it or make it non-identifiable.
• Backups: deleted information may remain in backups for up to 5 weeks before the backup is deleted.

When we no longer need personal information for any purpose permitted by law, we take reasonable steps to destroy or de-identify it.

9. Accessing, correcting and deleting your information

You can view and update most of your account information in the app. You can also ask us to:

• give you access to the personal information we hold about you;
• correct personal information that is inaccurate, out of date, incomplete, irrelevant or misleading;
• delete your account.

Contact us at {{PRIVACY_CONTACT_EMAIL}}. We may need to verify your identity first. We will respond within {{PRIVACY_REQUEST_RESPONSE_PERIOD}}. We will not charge you for making a request. If we refuse a request, we will tell you why (unless it would be unreasonable to do so) and how to complain.

If you are a companion and want your details corrected or removed from a booking, contact us at the same address.

10. Cookies and similar technologies

The website uses cookies and browser storage that are necessary to keep you signed in, remember your preferences and protect the service. Our hosting provider may also set cookies needed for security (for example to detect bots). We do not use advertising cookies or third-party analytics cookies: our website analytics (see section 2.6) work without cookies or browser storage.

You can block or delete cookies in your browser settings, but parts of the website (such as signing in) may not work without them. The mobile apps store similar information on your device for the same purposes.

11. Children

The Platform is not intended for people under {{MINIMUM_AGE}}. You must be at least {{MINIMUM_AGE}} to create an account. If you book a ticket for someone under that age, you are responsible for providing their information and for their attendance.

12. Complaints

If you have a complaint about how we have handled your personal information, contact us at {{PRIVACY_CONTACT_EMAIL}} with details of your complaint. We will acknowledge it, look into it, and respond in writing within a reasonable time.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner: www.oaic.gov.au.

13. Contact us

{{OPERATOR_NAME}} {{OPERATOR_ADDRESS}} Email: {{PRIVACY_CONTACT_EMAIL}}

14. Changes to this policy

We may update this policy from time to time, for example when we add features or change service providers. We will publish the new version on the Platform with a new effective date and, for significant changes, let you know by email or in the app.