Privacy Policy

1. Information We Collect

We may collect and process the following types of personal information:

• Account Information: Name, email address, password.
• Event Preferences: Interests and preferred event types.
• Location Data: If you enable location services, we collect location information to show nearby events.
• Payment Information: Collected and processed securely by Stripe (we do not store card details).
• Device Information: IP address, device type, operating system, and usage data.
• Analytics Data: Data collected via tools like Google Analytics to help us understand how you use the Platform.
• Stallholder Subscriber Data: If you opt in to a stallholder's contact form on a Pro page, we record your name, email, an optional message, the consent state (granted/declined), and the date and time you submitted. This is shared only with the stallholder you opted in to, never with the wider platform or other organisers.
• Follow Activity: When you tap Follow on a stall, the stallholder sees an aggregate Follower count only — never your name, email, or account identity.
• Telemetry: Aggregate, non-identifying events (page views, button taps, feature usage) used to improve the Platform. We do not associate telemetry with your name or email; identifiers are pseudonymised.

1a. Follow vs Subscribe — what stallholders see

Popup Pal is built around a closed-loop privacy model: stallholders only see the data fans actively choose to give them. There are two ways a fan can connect with a stall, and they share very different amounts of data.

• Follow: A free, anonymous signal. The stallholder sees the total Follower count and can send messages during a Show — but never sees your name, email, or any identifying detail. Following is private to you.
• Subscribe: An explicit opt-in via the contact form on a Pro page. You provide your name and email, and tick a consent box. The stallholder sees your name, email, your message (if any), and the consent timestamp. They can email you between Shows. You can unsubscribe at any time.

We never share your email with a stallholder unless you submitted it via the contact form with consent ticked. Following alone is not enough.

1b. In-show messaging

When you Follow a stall at a Show, you consent to receive short messages from that stallholder while the Show is live. These are delivered as a push notification (if you have the Popup Pal app installed and notifications enabled) or an email fallback (otherwise).

• Messages are limited to 200 characters and capped at six per stall per Show day.
• Across all stalls you Follow, we cap delivery at ten messages per Show day to prevent overwhelm.
• Messages are only sent during the Show's opening hours; the composer is locked outside those hours.
• You can unfollow a stall at any time to stop receiving its messages.
• You can disable push notifications in your device settings; we will still attempt the email fallback unless you also unfollow.
• Stallholders never see your contact details when sending in-show messages — delivery is handled entirely by Popup Pal.

2. How We Use Your Information

We use your personal information to:

• Provide, operate, and improve the Popup Pal Platform.
• Process event ticket purchases and payments.
• Personalise your experience (e.g., recommend local events).
• Send you important communications (e.g., event updates, notifications).
• Send promotional communications (you can opt out at any time).
• Monitor and analyse usage patterns to improve our service.

3. Push Notifications

We may send you push notifications about events and offers. You can manage your notification preferences in your device settings.

4. Sharing Your Information

We do not sell your personal information. We may share it with:

• Event Organisers: Basic contact details if necessary for ticketed events.
• Stallholders: Only the data you actively gave them — Subscriber details if you submitted their contact form with consent ticked. Following a stall does not share your contact details. Stallholders never receive a list of Followers.
• Service Providers: Payment processors (Stripe), analytics providers (Google), and IT support services.
• Authorities: If required by law or to protect our legal rights.

For attendee privacy specifics — what organisers see when you buy a ticket, how attendee lists are scoped, and what happens after the event — see our attendee privacy guide.

4a. Organiser marketing emails — data flow

When you buy a ticket through Popup Pal, the organiser of that show may email you about their own future shows. This is a soft opt-in under UK PECR — they can only email you about similar events of their own, and you can opt out at any time. Here is exactly how that data flows:

• What organisers see: name and email on the orders for their own shows, ticket type and date bought, refund status, and aggregate fields we compute (shows attended with that organiser, lifetime spend with that organiser).
• What stays private: organisers never see your activity with other organisers, your account details, your payment information, or your device identifiers.
• How emails reach you: marketing emails are sent on the organiser's behalf via Popup Pal infrastructure. The From field shows the organiser's name; replies go directly to the organiser's primary contact email.
• Unsubscribing: every marketing email includes a one-click unsubscribe link. Clicking it records an entry in our OrganiserUnsubscribe register keyed by your email address and the organiser's business id. From that point on the organiser cannot reach you by marketing email through Popup Pal. Unsubscribing from one organiser does not affect any other.
• Transactional emails: order confirmations, ticket delivery, schedule changes, refund updates, and post-event recaps for shows you bought are not marketing. They continue regardless of your unsubscribe status because they relate to a contract you already entered into.
• Retention: the unsubscribe register is retained for as long as we operate the email channel for that organiser. The transparency leg of PECR requires it.

5. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Understand how you interact with Popup Pal.
• Improve functionality and personalise content.
• Deliver targeted advertisements through platforms like Google and Meta.

You can control cookie settings through your browser or device preferences.

6. Data Security

We implement security measures to protect your personal information. However, no system is completely secure, and we cannot guarantee absolute security.

7. Data Retention

We retain your personal information for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements.

8. Your Rights (GDPR)

If you are in the UK or EU, you have the right to:

• Access the personal information we hold about you.
• Request correction of incorrect or incomplete data.
• Request deletion of your data.
• Object to processing or request data portability.
• Withdraw consent at any time (e.g., unsubscribe from marketing).

To exercise your rights, email us at legal@popuppal.co.uk. We respond within 30 days.

8a. Deletion process — what happens when you ask us to delete your data

When you request deletion (in-app via Settings → Account → Delete account, or by emailing us):

• Your account record (name, email, password) is deleted within 30 days.
• Your Followers, Subscribers, and message history attached to your account are removed from active systems.
• Stallholders who hold your Subscriber record (because you gave it to them via a contact form) are notified to delete their copy. You can also email any stallholder directly to request deletion from their list.
• Anonymised, aggregate data (e.g., total Show attendance, telemetry counters) cannot be linked back to you and is retained for analytics.
• Records we are legally required to retain (e.g., transaction records for tax purposes) are kept for the minimum period required by law and then deleted.
• Deleted accounts are not recoverable. You can re-register with the same email afterwards as a new account.

9. Third-Party Services

Our Platform may contain links to third-party services. Your use of these services is governed by their respective privacy policies, not ours.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Users will be notified of any material changes via email or in-app notification. Continued use of the Platform after updates constitutes acceptance of the new Privacy Policy.

11. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at legal@popuppal.co.uk