Privacy policy

Eventlaya is the platform. We are responsible for your Eventlaya account (your sign-in details and profile) and for how the platform itself works.

Event organizers decide what they collect. When you register for an event, the organizer chooses the questions on the registration form and uses your answers to run their event. The organizer is responsible for that information and for how they use it. We store and process it on their behalf, and we only use it to provide the service to them and to you. The same applies to organizers who run their own branded (“white-label”) site on Eventlaya, such as an event on their own domain.

Vendors and venue owners are responsible for what they do with the inquiries and booking requests you send them.

If you have a question about how an organizer uses your registration, ask them first; their contact details are on the event page. You can always contact us too, and we will help.

We only collect what the service needs. What that is depends on how you use Eventlaya.

Everyone, including visitors without an account

• Technical information that any website or app receives: your IP address, browser or device type and the pages or features you request. Our servers and our network provider (Cloudflare) keep this in logs to deliver the service, stop abuse and fix problems. Some features also use your IP address to limit repeated attempts (for example, password resets and voting).
• Usage statistics on eventlaya.com: which pages are visited and a few actions, through Google Analytics, without your name, email or phone number. See Analytics, where you can also turn it off.
• Information stored on your device to make the site and app work, described under Cookies and local storage.

People who register for events (attendees)

• Your name, email address and mobile number (the mobile number is optional unless the organizer requires it), and the names of any guests you get passes for.
• Answers to the organizer’s questions. Organizers can add their own questions to the registration form, so this can include other details they ask for. Only give what you are comfortable sharing with that organizer.
• Your tickets: ticket type, price, promo code, order reference, the QR code on your pass and its status.
• Check-in records: when your pass was scanned in or out, at which gate, and which staff member’s account scanned it.
• Votes in event polls. We don’t store your phone number or email with a vote. Each vote carries a one-way scrambled code (a hash) made from your ticket, your contact, a random ID kept on your device or, for open polls without that ID, your IP address, so nobody can vote twice. In polls where you vote with your ticket, the vote is also linked to that ticket inside our system so it is counted once and cancelled tickets are excluded. Organizers see the results and an anonymous voter code, not your name.
• Reviews you write (a star rating and optional text). Reviews are public and show your first name and the first letter of your last name, never your email.

Account holders (everyone who signs up)

• Account details: name, email address, phone number (optional for most accounts), city, organization or business name, your account type (attendee, organizer, gate staff, vendor) and an optional profile photo.
• Your password, stored only as a secure one-way hash. We cannot see it.
• Email verification: whether you confirmed your email. The 6-digit codes we send are stored only as hashes and expire.
• Your agreement to these policies: the date and the version you agreed to.

If you sign in with Google or Facebook

We receive your name, email address, whether the provider has verified that email, and the provider’s ID for your account. We use them to sign you in and to create or match your Eventlaya account. We do not receive your Google or Facebook password, your contacts, your posts or your friends list, and we never post anything on your behalf.

Organizers

• Your events (title, dates, venue, pictures, schedule, ticket types, prices, promo codes, the organizer contact details you choose to show), your registration forms, polls, gates and event tasks.
• Details of the team members you add (name, email, phone number) and which gate they are assigned to.
• Team chat: messages and photos sent in your organization’s chats, and who has read them.
• Plans and billing: your plan, billing period and the payments our team records for you (amount, date, method such as eSewa, Khalti, Fonepay or bank transfer, and a reference number). We do not receive or store card numbers or your bank or wallet login.
• White-label sites: your brand name, logo, colours, support email, footer text and domain, and the technical records used to verify the domain and set up its security certificate.

Gate staff and team members

• The account your organizer created for you (name, email, phone number) and your gate assignment.
• The scans you make (time, gate, result, and basic device information sent by the scanner) and tasks assigned to you.
• Team chat messages and photos you send, and read receipts.

Vendors and venue owners

• Your listings: business or venue name, description, photos, prices, address, contact person and phone number. Listings are public.
• Your availability calendar, and the booking requests and inquiries you receive and your replies to them.

People who contact a vendor or venue

Your name, email, phone number, the event type, date, guest count, budget and the message you write, plus the time slot if you request a booking.

Push notifications

If you allow notifications in the app, we store a notification token for your device (from Firebase Cloud Messaging) and the device type, so we can send you alerts.

• To create and run your account and sign you in, including with Google or Facebook.
• To register you for events, issue passes with QR codes, send your passes by email and check you in at the gate.
• To let organizers manage their events, attendees, gate staff, tasks, polls and team chat.
• To pass your inquiry or booking request to the vendor or venue you contacted, and to send you their reply.
• To send service messages: email verification codes, password resets, passes, booking updates and push notifications you have allowed.
• To show public content you chose to publish, such as reviews and listings.
• To manage plans and record payments.
• To keep Eventlaya secure: preventing fraud, spam, duplicate votes and misuse, and investigating reports.
• To fix problems and improve the service, including usage statistics for eventlaya.com (see Analytics).
• To meet legal obligations, such as keeping billing records.

We do not sell your personal information, we do not show ads, and we do not use your information to build advertising profiles. We do not send marketing emails today. If we ever do, you will be able to opt out at any time.

We use your information because:

• You asked us to. Creating an account, registering for an event, sending an inquiry or posting a review are things you choose to do, and we need your information to do them.
• You agreed. When you sign up, you agree to our Terms of service and this policy. Some things are optional and need your separate permission, such as push notifications, the camera and an organizer’s optional questions. You can withdraw your permission at any time (see Your rights and choices).
• We need to keep the service safe and working, for example logs and abuse prevention, and to understand how the website is used (analytics, which you can turn off).
• The law requires it, for example keeping billing records.

• The organizer of an event you register for sees your registration details, your answers, your tickets and your check-in times. Their gate staff see your name and pass details when they scan your pass.
• The vendor or venue you contact sees your inquiry or booking request and the contact details in it.
• Your team: in team chat, members of a conversation see your name, photo, messages and whether you have read them.
• The public: event pages, listings, reviews (first name and last initial) and owner replies are public.
• Service providers who run parts of Eventlaya for us, only for that purpose:
  • DigitalOcean: our servers, database and uploaded files (data centre in Bangalore, India).
  • Cloudflare: network, security and HTTPS for our websites and white-label domains (and, if we turn it on, cookieless visit counts with Cloudflare Web Analytics).
  • Google Analytics: usage statistics for eventlaya.com, as described under Analytics.
  • Google Firebase Cloud Messaging: delivering push notifications to the app.
  • Google and Facebook (Meta): only if you choose to sign in with them.
  • Our email delivery provider: sending verification codes, passes and notifications.
• Authorities, when Nepali law requires it or to protect people’s safety, and only as much as required.
• A new owner, if Eventlaya is ever merged or sold. This policy would continue to protect your information, and we would tell you first.

We do not share your information with anyone else without your permission.

Our servers, database and uploaded files are hosted by DigitalOcean in Bangalore, India. That means your information leaves Nepal when you use Eventlaya. Cloudflare, Google (Firebase and Analytics) and our email provider may process some of it in other countries as part of delivering their service. We choose providers that protect data with industry-standard security.

• Your account is kept until you delete it. See Delete your account for exactly what is removed.
• Event registrations, tickets and check-in records belong to the organizer’s event records. They stay with the event, even if you delete your Eventlaya account, for as long as the organizer keeps their account, so organizers can keep their attendance and payment records. Events that have registrations can be cancelled but not deleted. If you want your details removed from a past event, ask the organizer or write to us.
• Inquiries and booking requests stay with the vendor or venue you sent them to.
• Reviews stay until you delete them or your account.
• Team chat messages stay in the conversation until the sender deletes them (deleted messages lose their text) or the organization’s chat is removed.
• Billing records are kept as long as the law requires.
• Notification tokens are kept while you have an account and removed when you delete it.
• Server logs are kept only for a limited time for security and troubleshooting.
• Deleted information may remain in backup copies for a limited time before it is overwritten.

• All traffic to our websites, our API and the app is encrypted with HTTPS.
• Passwords and email codes are stored only as one-way hashes. Vote identifiers are hashed too.
• Access is limited by role: organizers only see their own events and attendees, vendors only see their own inquiries, and team chat is limited to members of the conversation.
• Photos you upload (profile pictures, listing photos, chat photos) are stored at long, random web addresses that can’t be guessed. Anyone who has the exact address can open the photo, so please don’t upload sensitive documents.

No system is perfectly secure. If we learn of a breach that affects your personal information, we will tell you and the relevant authorities as the law requires. Keep your password private and use “Keep me signed in” only on your own devices.

You need to be at least 16 years old to create an Eventlaya account on your own. Younger people can register for events or use an account only with the permission and supervision of a parent or guardian, who is responsible for that use. We set this age because events often involve sharing contact details with organizers and other people.

We do not knowingly collect information from children under 16 without a parent’s or guardian’s permission. If you believe a child has given us information without permission, contact us at [email protected] and we will delete it.

You can:

• See your information: your profile, tickets, inquiries and reviews are in your account (in the app or at eventlaya.com/app). For a copy of everything we hold about you, email us.
• Correct it: edit your profile in the app or on the website. For details an organizer holds about your registration, ask the organizer or us.
• Delete it: delete your account yourself in the app or on the website, or ask us by email. See Delete your account.
• Withdraw your consent: turn off notifications or camera access in your phone settings, remove a review, or delete your account. Withdrawing consent doesn’t affect what we did before.
• Object or complain: tell us if you think we have used your information wrongly. You can also complain to the relevant authority in Nepal.

To use any of these rights, write to [email protected] from the email address on your account. We may ask you to confirm your identity. We will reply within 30 days. If your request is about an organizer’s event data, we will pass it to the organizer and help them answer it.

The app asks for permission before sending push notifications. We use them for things that need your attention: team chat messages, booking requests and replies, gate alerts and messages from your organizer to their gate staff.

To turn them off: on Android, open Settings → Apps → Eventlaya → Notifications, or long-press a notification and choose to turn it off. You can also uninstall the app.

We send emails only for the service: verification codes, password resets, passes, and booking updates. Emails for an event may show the organizer’s branding.

• Camera: used to scan QR codes on passes at the gate (organizers and gate staff) and to take a photo when you choose to (profile picture, chat). The camera image used for scanning is processed on your phone and is not uploaded.
• Photos: when you choose a picture, Android’s photo picker shares only that picture with the app. We upload only the photos you choose to send.

The app doesn’t access your contacts, location, microphone or files.

On eventlaya.com we use Google Analytics to learn how many people visit, which pages they find useful, where they come from and where sign-up, registration and checkout get stuck, so we can improve them. It is not used on the white-label sites organizers run on their own domains, and the mobile app has no analytics.

What Google Analytics receives

• The pages you open, with private parts of the address removed first: pass links, password-reset and verification links, payment details, email addresses, phone numbers and codes never leave your browser. Pages inside your account (the dashboard and admin screens) are not measured unless we decide to, and then with the same clean-up.
• Where you came from (the previous website or a campaign link), your approximate location (city and country), language, and device, browser and screen type.
• A few actions, without saying who you are: that an account was created or someone signed in (and whether with email, Google or Facebook), that a registration was completed (the event, number of tickets and amount), that an online payment went through (the order reference, amount and ticket types), that a vote or a vote pack purchase was made (which poll or contest, not who voted or for whom), that an inquiry was sent to a venue or vendor, that a page was shared, and the words used in searches (with emails and numbers removed).

We never send your name, email address, phone number, the answers you give on registration forms, the code on your pass or payment details to Google Analytics.

Cookies, IP address and how long it is kept

• Google Analytics sets two first-party cookies, _ga and _ga_<ID>, holding a random ID for your browser so that repeat visits can be counted. They expire after up to 2 years.
• Google Analytics uses your IP address only to work out an approximate location, and does not log or store it. We have turned off Google signals, ad personalization and advertising cookies: this data is not used for advertising.
• We keep Google Analytics data for 14 months; after that Google deletes it. Reports only show totals.
• Google may process this data in other countries, including the United States, under its own privacy terms.

Your choice

You can turn analytics off for this browser here at any time. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, we don’t load Google Analytics at all. You can also use Google’s opt-out browser add-on or a content blocker.

We don’t use advertising cookies, and we don’t track you across other websites. On eventlaya.com, Google Analytics sets the _ga cookies described under Analytics, unless you turn it off. The website also stores a few things in your browser (local storage) so it works:

• Your sign-in session (kept until you sign out if you choose “Keep me signed in”, otherwise until you close the browser).
• Passes you registered for, so you can open them again on this device.
• A registration you haven’t finished yet, until you close the tab.
• Polls you have voted in, and a random ID for this device used for one-vote-per-device polls.
• Small preferences, such as the event you last selected, whether the sidebar is collapsed and whether you turned analytics off.

The app stores similar things on your phone: your sign-in session, saved passes, your selected event and gate, and scans waiting to be sent when the phone is offline.

If you use “Continue with Google” or “Continue with Facebook” on the website, their sign-in buttons load from Google or Facebook and they may set their own cookies under their own privacy policies. You can clear local storage in your browser settings at any time; you will be signed out and saved passes will be removed from that browser (they stay in your account and email).

Eventlaya is run from Nepal. We handle personal information in line with Nepal’s Individual Privacy Act, 2075 (2018) and the Electronic Transactions Act, 2063 (2008). In plain words: we collect information for clear purposes, use it only for those purposes, keep it safe, don’t share it without a good reason and let you see, correct and delete it.

If you live outside Nepal, your own country’s laws may give you extra rights. Contact us and we will do our best to help.

If we change this policy, we will update the date at the top. If the change is important, we will tell you in the app, on the website or by email before it takes effect, and ask you to agree again where the law requires it.

For privacy questions, requests and complaints, write to [email protected]. You can also use our contact page.

Eventlaya, Eastern Nepal.