This Privacy Policy explains how Cybentis Oy, doing business as Affair ("we," "us," or "our"), collects, uses, and protects personal information when you use the Affair event platform and related services at affair.events (the "Services").
Affair is a Finnish company registered under Business ID 3593125-1. Our registered address is PL 157, 00101, Helsinki, Finland.
For privacy inquiries, contact us at [email protected].
1. Who this policy is for
Affair is an event platform. Two kinds of people use it, and we treat their data differently:
- Organizers — people and teams who create events, sell tickets, build event websites, manage audiences, and receive payouts. For organizer account, billing, and team data, Affair is the data controller.
- Attendees — people who buy tickets, register or RSVP, view public event pages, appear in event photo galleries, or use networking and check-in features. Much of this data is collected by an organizer using Affair as a tool. For attendee data that an organizer collects through their event, the organizer is the controller and Affair acts as a processor on the organizer's instructions, under a data processing agreement. This policy describes what Affair does as a platform; an organizer's own privacy notice governs how that organizer uses attendee data.
When this policy says "you," it means whichever of these roles applies to your interaction with the Services.
2. Information we collect
2.1 Organizer account information
When you create an Affair account, we collect:
- Name and email address — to create and manage your account, managed through our identity provider (Clerk)
- Organization and team data — organization name, team members, roles, and permissions
- Profile and event details — organizer profile, event names, descriptions, schedules, venues, and the content you publish on your event pages and websites
- Billing information — subscription tier and billing details, processed securely by Stripe; we do not store full payment card numbers
- Payout information — to receive ticket revenue you connect a Stripe account; payout and identity-verification data is collected and held by Stripe under Stripe's own terms
- Authentication data — managed by our identity provider; if you sign in with Google or another social provider, we receive your name, email, and profile picture. A legacy Auth0 sign-in path is being retired
2.2 Attendee information
When attendees interact with an event run on Affair, we may process, on the organizer's behalf:
- Contact and registration data — name, email address, and phone number, plus any custom registration questions the organizer configures
- Ticket and order data — tickets purchased, order history, ticket types, promo codes, check-in status, and QR ticket identifiers
- Payment data — card payments are processed by Stripe; Affair receives transaction metadata (amount, status, last four digits), not full card numbers
- RSVP and networking data — RSVP responses, networking profile information attendees choose to share, and connections made at an event
- Media — photos and videos uploaded to an event's media hub, which may contain images of attendees
2.3 Facial-biometric data (media hub face liveness)
Some event photo galleries offer a "find your photos" feature. To use it, an attendee completes a short face-liveness check: the device camera captures a brief sequence of face images that is processed by Amazon Rekognition to confirm a live person and to match that face against photos in the gallery.
This is biometric data and a special category of personal data under GDPR Article 9 (and may be regulated biometric identifier data under laws such as the Illinois Biometric Information Privacy Act).
- The face-liveness check is optional and is only run when an attendee chooses to start it.
- It is processed for the sole purpose of liveness verification and matching the attendee to their own photos in that specific gallery.
- The liveness session is transient. Affair does not use this data to build a cross-event or persistent biometric identification database, and does not sell or share biometric data.
- The legal basis is the attendee's explicit consent (Art. 9(2)(a)). Attendees can use galleries without the face feature.
If you are an attendee and want biometric processing related to you deleted, contact the organizer or [email protected].
2.4 Usage and device data
For both organizers and attendees, we collect information about how the Services are used:
- Pages and screens visited within the platform, features used, and actions taken
- Browser type, device type, operating system, language, and timezone
- IP address (used for security, fraud prevention, and access logging)
- Approximate location derived from IP and request metadata (e.g., country/region)
- Product and UI preferences stored in browser storage
2.5 AI features
Affair offers AI-assisted features (for example, help drafting event content). When you use them, your prompts and the relevant event context are processed by our AI inference provider (Google Gemini) to generate a response. We design these features to send only the context needed for the task. AI inference is API-only; the provider does not use your content to train its models.
3. How we use your information
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing and operating the Services | Performance of contract (Art. 6(1)(b)) |
| Processing ticket payments and organizer payouts | Performance of contract |
| Processing subscription billing | Performance of contract |
| Sending service and transactional email (receipts, tickets, event updates) | Performance of contract |
| Face-liveness verification in event galleries | Explicit consent (Art. 9(2)(a)) |
| Improving the Services and developing features | Legitimate interest (Art. 6(1)(f)) |
| Detecting and preventing fraud, abuse, and chargebacks | Legitimate interest |
| Responding to support requests | Performance of contract |
| Product analytics and measurement | Consent or legitimate interest, per your cookie choices |
| Marketing email to organizers | Consent (Art. 6(1)(a)) |
| Complying with legal, tax, and accounting obligations | Legal obligation (Art. 6(1)(c)) |
You can opt out of marketing email at any time via the unsubscribe link or by contacting us. Where Affair acts as a processor for an organizer, the organizer's lawful basis governs that processing.
4. Cookies and tracking
The Affair web app and marketing site use a combination of strictly necessary cookies and browser storage for authentication and session management (via our identity provider), security, and remembering preferences. We also use product analytics and measurement (Google Analytics for Firebase) and our CDN/security provider (Cloudflare) sets cookies for performance and abuse protection. Embedded maps load Google Maps.
Non-essential analytics and measurement run according to your consent choices. See our Cookie Policy for the full breakdown and your controls.
5. Data sharing and sub-processors
We do not sell your personal information. We do not share it with advertisers.
We share data only with the following categories of service providers, under data processing agreements that require them to protect it:
Sub-processor list
| Sub-processor / provider | Purpose | Typical location |
|---|---|---|
| Hetzner | Primary platform infrastructure and databases (event, ticketing, audience, analytics, and object storage) | EU |
| Cloudflare | CDN, DDoS protection, TLS, and request-level security | Global (EU-preferred) |
| Clerk | Authentication and identity management | EU / US |
| Auth0 (Okta) | Legacy authentication during migration (being retired) | EU / US |
| Stripe | Ticket payment processing, organizer payouts, and subscription billing | EU / US |
| Amazon Web Services — S3 | Media and object storage (event photos, uploads) | EU (Ireland, eu-west-1) |
| Amazon Web Services — Rekognition | Face-liveness verification for opt-in gallery photo matching | EU (Ireland, eu-west-1) |
| Amazon Web Services — SES | Transactional and event email delivery (tickets, receipts, notifications) | EU (Ireland, eu-west-1) |
| Google — Gemini | AI inference for AI-assisted features | EU / US, depending on configuration |
| Google Maps | Map display and venue/location lookup on event pages | Global |
| Firebase / Google Analytics (Google) | Push notifications and product analytics/measurement | Global |
We may update this list. Material changes will be communicated by email or in-app notification.
We may also disclose information where required by law, to enforce our agreements, to protect the rights and safety of users or the public, or in connection with a merger, acquisition, or sale of assets (with notice where required).
6. International data transfers
Our primary platform processing and storage occur within the European Union on Hetzner infrastructure. Object storage, transactional email, and face-liveness processing run on AWS in the EU (Ireland, eu-west-1).
Some authentication, payment, AI inference, and analytics processing may take place outside the EU or involve providers with global operations. Where data is transferred outside the EU, we rely on:
- EU Standard Contractual Clauses (SCCs) — the 2021 Controller-to-Processor and Processor-to-Sub-processor modules approved by the European Commission
- Supplementary technical measures — encryption in transit (TLS) and at rest, access controls, and pseudonymization where applicable
- Data processing agreements restricting processing to documented instructions
- For AI inference: API-only access with no model training on your content
7. Data retention
| Data type | Retention approach |
|---|---|
| Organizer account data | For the life of the account, then deleted or anonymized under our offboarding process, except where law requires longer retention |
| Event, ticket, and order data | For the life of the organizer's account or as configured by the organizer, subject to tax/accounting retention for financial records |
| Payment and payout records | As required by applicable accounting and tax law |
| Attendee contact and audience data | Retained while the organizer maintains it; deleted on the organizer's instruction or account closure, subject to a short operational grace period |
| Event media (photos/videos) | Retained until removed by the organizer or attendee or until account closure |
| Face-liveness data | Processed transiently for verification and matching; not retained as a persistent biometric template |
| Support tickets and communications | As long as reasonably necessary to support the relationship and maintain business records |
| Server and security logs | Per our operational and security logging practices, then rotated or deleted |
When an account is deleted, we begin our closure and deletion workflow. Some data may persist briefly while queued deletions, backups, or legal retention obligations complete.
8. Data security
We implement technical and organizational measures intended to protect your data, including:
- Encryption in transit (TLS) and at rest
- Access controls and authentication safeguards
- Logging, monitoring, and operational alerting
- Role-based restrictions for internal access
- Incident handling procedures, including notification where required by law
No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.
9. Your rights
Under the GDPR and Finnish data protection law you have the rights to access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interest, and to withdraw consent at any time where processing is based on consent.
To exercise your rights, contact [email protected]. If your request concerns data an organizer collected through their event, we may need to refer you to that organizer as the controller, or act on their instructions.
We will respond within one month. For complex requests we may extend by up to two further months and will tell you within the first month.
If you believe we are processing your data unlawfully, you may lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) or your local supervisory authority.
10. US state privacy rights
If you are a resident of California, Colorado, Connecticut, Virginia, or another US state with comprehensive privacy legislation, you have the right to know what personal information we collect and how we use it, to request deletion, to opt out of the sale of personal information (we do not sell personal information), and to non-discrimination for exercising these rights. Contact [email protected].
11. Children's privacy
The Services are not directed to individuals under 18, and we do not knowingly collect their personal information. Organizers running events open to minors are responsible for any additional consents required. If you believe a child has provided us personal information, contact [email protected] and we will delete it promptly.
12. Changes to this policy
We may update this Privacy Policy to reflect changes in our practices or applicable law. We will notify you of material changes by email or in-app notification at least 30 days before they take effect. The "Last updated" date above indicates the latest revision.
13. Contact
Cybentis Oy (doing business as Affair) Business ID: 3593125-1 PL 157, 00101, Helsinki, Finland
- Privacy: [email protected]
- General support: [email protected]