Privacy Policy
EventOS is operated by TrailBlaze Limited, a New Zealand company. In this policy "EventOS", "we", "us" and "our" mean TrailBlaze Limited. "You" means anyone who uses the EventOS platform.
This policy explains what personal information we collect, why we collect it, who we share it with, and what rights you have. It is written to comply with the New Zealand Privacy Act 2020.
1. Who is responsible for your data
EventOS plays two roles depending on the data.
Account holders and organisation data. When you create a EventOS account and set up an organisation, we are the data controller for your account information, billing details, and how you use the platform.
Volunteer data. When an organisation uses EventOS to roster volunteers, the organisation is the data controller for that volunteer data. EventOS is the processor: we store and process the data on the organisation's behalf under their instructions. If you are a volunteer, your primary relationship is with the organising club or company.
2. What we collect
From account holders
- Name, email address, password (stored hashed, never in plain text)
- Organisation name, slug, currency, timezone, and branding choices
- Logo image you upload to your organisation
- Photos you upload to events
- Billing information once paid plans launch (handled by Stripe, see section 5)
- Diagnostic logs of your activity on the platform
From volunteers
- Name, email address, and optional phone number
- Notes you enter when signing up to a shift
- The shifts you sign up to, withdraw from, or are moved between
- Email open and delivery status (from our email provider)
From website visitors
- IP address, browser type, and pages viewed (for security and basic analytics)
- Cookies strictly necessary for the site to function (session and authentication only)
We do not run third-party advertising or behavioural tracking cookies. We do not sell your data. We do not use your data to train AI models.
3. Why we collect it
| Purpose | Lawful basis |
|---|---|
| Run the EventOS service and your account | Performance of contract |
| Send transactional emails (confirmations, reminders) | Performance of contract |
| Send service updates and important notices | Legitimate interest |
| Bill you and process payments | Performance of contract |
| Detect abuse, fraud, and security incidents | Legitimate interest |
| Comply with NZ law | Legal obligation |
4. Who we share it with
We share data only with the sub-processors we need to run EventOS. The current list is at our sub-processors page. We do not share your data with anyone else except where legally required or with your explicit consent.
5. Payments
When paid plans launch, billing is handled by Stripe. We never see or store your full card number. Stripe sends us a customer ID and the subscription status. Stripe's privacy policy applies to the card details you give them.
6. How long we keep your data
- Active accounts. While the account is active, plus 30 days after deletion to recover from accidental deletes.
- Volunteer signups.While the parent organisation's account is active. Organisations can delete individual signups at any time.
- Billing records. Seven years, as required by NZ tax law.
- Backups. Up to 35 days, then permanently deleted.
- Diagnostic logs. 90 days.
7. Where your data is stored
EventOS data sits in Supabase's Sydney region (ap-southeast-2). Email delivery routes through Resend (US). Payment data, when paid plans launch, is held by Stripe. We do not transfer EventOS data to any other region.
8. Your rights
Under the NZ Privacy Act 2020 you have the right to:
- Access your personal information. Email us and we will provide a copy within 20 working days.
- Correct information that is wrong. You can edit most of it in your account settings.
- Deleteyour account and personal information. Use the "Delete account" option in your account settings.
- Export your data. Coordinators can download volunteer data as CSV. Individual users can request a JSON export.
- Complain to us or to the Office of the Privacy Commissioner.
To exercise any of these rights, email privacy@eventos.nz.
9. Security
For details on our security controls see our Security page. If you suspect a breach, email security@eventos.nz.
10. Children
EventOS is not designed for children under 13. We do not knowingly collect data from children under 13. Where an event involves participants under 18, the organising club collects only the data necessary and is responsible for parental consent. EventOS itself does not handle participant entries.
11. Marketing
The only emails we send are transactional (confirmations, reminders, receipts) and important service updates. If we ever add a marketing newsletter it will be opt-in.
12. Cookies
We use only strictly-necessary cookies: a session cookie for authentication and a CSRF token. We do not use analytics or advertising cookies, so we do not need a cookie banner.
13. Changes to this policy
Material changes are notified by email to account holders at least 14 days before they take effect.
14. Contact
Email: privacy@eventos.nz
Postal: TrailBlaze Limited (NZBN 9429051893668), 23 Aileen Place, Riccarton, Christchurch 8041, New Zealand
You can also complain to the Office of the Privacy Commissioner at privacy.org.nz or 0800 803 909.