PRIVACY & CHOICES · Updated 31 October 2026

Privacy notice

This notice explains how BarHopper uses personal information when you browse venues, request passes, run events or promote venues. It is a notice, not a request to agree to all processing. Optional cookie consent is separate from service terms and checkout acceptance.

Who is responsible

BarHopper LLC operates BarHopper and is responsible for platform account, security, support and service administration data. Contact the platform team through our privacy request form. Venue owners and event organizers determine their own guest-list, admission, waiver and event purposes; their own privacy notices may also apply. Ask the relevant organizer about information they upload.

Information and purposes

• Accounts and access: identity, verified email and assigned roles to authenticate you and control workspace access.
• Passes and transactions: venue, time slot, order and test-payment references, referral/discount codes, entry status and redemption records to fulfill requests and prevent reuse or fraud. Payment cards are entered on Stripe’s service.
• Organizers and creators: application details, guest contact lists, invitations, document acceptance records, referral commissions and payout profiles. ACH account information is encrypted and masked on read.
• Support and privacy requests: contact details and messages to answer and investigate requests.
• Technical data: network and security logs, request limits and browser/session information to operate and protect the service. Short-link records contain a destination, sender/venue/event attribution, click totals and last-click time; these are not proof of attendance.
• Location: browser location only when you request nearby venues and grant permission. You can search manually instead.
• Preferences: saved venues on your device when you opt in.

Legal bases where GDPR applies

We use information necessary to provide a service you request or take steps at your request before a contract; to comply with applicable legal obligations; and for legitimate interests in security, fraud prevention, support and service administration, subject to your rights. Optional device preferences rely on consent. A venue or organizer is responsible for its own lawful basis for uploaded guest data and event documents. An invitation is not permission to send unrelated marketing.

Recipients and international processing

Service providers include Cloudflare (hosting and storage), Clerk (authentication), Stripe (checkout), and Resend (server email). Authorized venues, organizers and creators receive information necessary for their assigned services; creators can see their promotion results. Google sign-in, Maps and social services apply their own notices when used. Weather services receive ZIP/date queries.

BarHopper operates from the United States and providers may process data internationally. Where EU/UK transfer requirements apply, the appropriate transfer mechanism and contractual safeguards must be established with the relevant providers. Contact us for current details; this notice does not claim that every provider contract or transfer assessment has been verified.

Retention

Retention depends on the purpose: active account and service records, event fulfillment, financial recordkeeping where applicable, security investigations, disputes and legal requirements. Data should not be retained longer than necessary for those purposes. A complete automated retention/deletion schedule is not yet implemented. We review erasure and restriction requests individually, including legal exceptions and provider/back-up constraints. Browser-storage periods are listed in the cookie policy.

Your privacy choices

Do Not Sell or Share My Personal Information · Request account deletion. BarHopper does not sell personal information or share it for cross-context behavioral advertising. You can record a browser opt-out or submit an account-wide request.

Your rights

Where applicable, you may request access and a copy, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You can withdraw optional storage consent in Cookie settings. Use the privacy request form; we may need proportionate identity verification before disclosing or changing records. Do not submit passwords, QR credentials, card numbers or identity documents through this form.

GDPR requests are generally due a response within one month, with permitted extensions for complex or numerous requests and notice of the extension. You may complain to your local data protection authority. These rights are subject to applicable law and exceptions; this notice does not waive them.

Security, age and changes

We use access checks, encrypted transport, protected server credentials and application encryption for ACH details. No service can guarantee absolute security. Age declarations for event documents are not identity verification; venues remain responsible for admission and lawful age checks. We update this notice when practices change and ask again before using optional storage for new purposes.

Current service status: payments are in test mode. This notice does not represent certification of GDPR compliance. Provider contracts, transfer safeguards, retention operations and controller contact details require ongoing review.