Privacy Policy

1. Introduction

Trankets ("we," "our," or "us"), operated by Yconsoft Technologies, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and safeguard information in connection with your use of the Trankets platform - a creator commerce service covering event management, digital product sales, newsletter and contact management, wallet and payouts, and API access (collectively, the "Service").

This Policy applies to all users of the Service, including Organizers, Sellers, Creators, Buyers, Attendees, newsletter subscribers, and visitors. By accessing or using the Service, you consent to the practices described in this Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account Registration: Name, email address, password (hashed and never stored in plain text), and optionally a profile picture.
• Google OAuth: If you sign in via Google, we receive your name, email address, and Google profile identifier. We do not receive or store your Google password.
• Event Information: Event names, descriptions, dates, venues, ticket types, pricing, capacity limits, event FAQs, category labels, and any custom event content you create.
• Attendee and Registration Data: Information collected through your event registration forms - which may include names, email addresses, phone numbers, dietary preferences, t-shirt sizes, or any other custom fields you configure. You, as the Organizer, are the data controller for attendee data.
• Digital Product Information: Product names, descriptions, pricing and accepted currencies, download limits, link expiry settings, cover images, product files, and any buyer intake form fields you configure.
• Digital Product Files: The actual files you upload for sale (e.g., PDFs, videos, audio, ZIP archives). These are encrypted and stored with our cloud storage and infrastructure provider.
• Buyer Purchase Data: When a buyer purchases your product or ticket, we collect their name, email address, and any responses to your configured buyer intake form fields. This data is linked to the purchase record and made available to you as the Seller or Organizer.
• Newsletter and Contact Data: Contact names, email addresses, phone numbers, group membership, import metadata, and subscription/unsubscription history for your newsletter contact lists.
• Wallet and Bank Details: Bank account name, account number, and bank institution name provided for payout processing. We do not store complete card numbers. Payment processing is handled by Flutterwave.
• Support Communications: Records of any correspondence you initiate with us via email or other channels.
• Subscription and Billing: Plan tier, billing cycle, and subscription history (payment card details are stored by Flutterwave, not by us).

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, actions taken (e.g., events created, products listed, newsletters sent, API calls made), and session duration.
• Device and Browser Data: Browser type and version, operating system, device type, screen resolution, referring URL, and IP address.
• Download Activity Logs: When a buyer accesses a download link, we log the access timestamp, download count, and IP address to enforce download limits and detect abuse.
• QR Code Scan Logs: When an attendee QR code is scanned at check-in, we log the scan timestamp and the user who performed the scan, to maintain accurate attendance records.
• Email Engagement: For transactional emails (purchase confirmations, download links, event invitations) and newsletters sent through the Service, we may track delivery status, open rates, and click activity using standard email delivery infrastructure.
• Cookies and Session Tokens: We use cookies and time-limited session credentials to maintain authenticated sessions, remember preferences (e.g., view mode), and improve platform performance. We do not use cross-site advertising trackers.
• API Access Logs: API key usage, endpoint calls, request payloads (excluding sensitive credentials), response codes, and timestamps for security and rate-limit enforcement purposes.

2.3 Information Received from Third Parties

• Flutterwave: Payment status, transaction references, buyer payment method type (card, bank transfer, mobile money), and amounts, following a buyer's completed payment.
• Google OAuth: Name, email address, and account identifier from Google, only when you choose to authenticate via Google.

2.4 Ambassador and Affiliate Program Information

If you apply to or take part in our Ambassador or Affiliate Programs, we collect and process:

• Application details you submit - your name, email address, phone number, social media handles and links, information about your audience or community, your reasons for applying, and your selected earning model;
• reCAPTCHA and related anti-abuse signals used to protect the application form from spam;
• Records of the referrals attributed to you, your Program activity and submissions, verified results, and the rewards and payouts we calculate and make to you.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Delivery

• Creating and managing your account
• Publishing your events and digital product listings
• Processing ticket and digital product purchases
• Generating and delivering download links to buyers
• Managing attendee check-in via QR code scanning
• Crediting wallet balances and processing payouts to your bank account
• Sending purchase confirmation and download delivery emails to buyers on your behalf
• Sending event invitations, reminders, and newsletters to your contacts on your behalf
• Enforcing download limits and link expiry on purchased digital content
• To operate our Ambassador and Affiliate Programs - reviewing applications, tracking referrals and activity, verifying results, calculating and paying rewards, communicating with you about the Program, and detecting and preventing fraud or abuse.

3.2 Platform Operations

• Monitoring and improving Service performance, reliability, and security
• Authenticating users and maintaining session integrity
• Enforcing plan-level usage limits
• Providing analytics and reporting to Organizers and Sellers
• Detecting, investigating, and preventing fraudulent transactions, account abuse, and policy violations

3.3 Communications to You

• Sending transactional messages (account registration, password reset, subscription confirmations)
• Sending platform notifications about your account, payouts, and purchases
• Providing customer support responses
• Sending product updates, policy change notices, and security alerts

3.4 Legal and Compliance

• Complying with applicable laws, regulations, and legal processes
• Enforcing our Terms of Service
• Responding to lawful requests from regulatory or law enforcement authorities
• Maintaining financial and transaction records as required under applicable law

4. Legal Basis for Processing (Where Applicable)

Where data protection law requires a legal basis for processing, we rely on the following:

• Contract performance: Processing necessary to provide the Service under our Terms of Service (e.g., processing payments, delivering downloads, managing events).
• Legitimate interests: Anti-fraud monitoring, platform security, analytics to improve the Service, and communicating material updates.
• Consent: Where you have opted in to specific marketing communications or optional data collection.
• Legal obligation: Retaining financial transaction records and complying with regulatory requirements.

5. Information Sharing and Disclosure

We do not sell your personal information. We share information only in the following circumstances:

• With Sellers and Organizers: When you purchase a ticket or digital product, the Seller or Organizer receives your name, email address, and any responses to their custom buyer intake form fields needed to fulfil the purchase.
• Flutterwave: Your payment information is transmitted to Flutterwave for transaction processing. Flutterwave's Privacy Policy governs their handling of that data.
• Cloud storage and email delivery providers: We use our cloud storage and infrastructure provider to store uploaded product files, and our email delivery provider to deliver transactional and campaign emails. These providers process data under our instructions and applicable data processing agreements.
• Google (OAuth): If you authenticate via Google, Google processes your login credentials per their own Privacy Policy. We only receive the profile data described in Section 2.1.
• Legal and Regulatory Authorities: We may disclose information if required by law, court order, or binding governmental request, or where disclosure is necessary to protect the rights, property, or safety of Trankets, its users, or the public.
• Business Transfers: In the event of a merger, acquisition, reorganisation, or sale of all or part of our business assets, user information may be transferred to the acquiring entity, subject to equivalent privacy protections.
• With Your Consent: We may share your information with other parties with your explicit prior consent.

We require all third-party service providers to maintain appropriate security measures and use your personal data only for the specific purposes we have authorised.

6. Data Roles - Organizers and Sellers as Data Controllers

When you use Trankets to collect data from your attendees, buyers, or newsletter subscribers (e.g., through event registration forms, digital product buyer intake forms, or contact lists), you act as an independent data controller in relation to that personal data. You are responsible for:

• Having a lawful basis for collecting and using that data
• Providing your own privacy notice to your attendees, buyers, and subscribers
• Handling data subject requests (access, deletion, correction) relating to your contacts' data
• Complying with applicable data protection laws in your jurisdiction

Trankets acts as a data processor in relation to attendee, buyer, and contact data you manage through the Service, processing it only on your instructions and in accordance with this Policy and our Terms of Service.

6.1 Platform Data Administration

Notwithstanding the processor relationship described above, Trankets - in its capacity as data controller of platform-level records, system data, and operational information - reserves and retains the right to review, correct, update, restrict, de-identify, pseudonymise, archive, or permanently delete any account, record, content, or data held within the Service where such action is warranted for: (a) operational accuracy, system integrity, or platform maintenance; (b) compliance with applicable law, regulatory directive, or binding legal obligation; (c) risk management, fraud mitigation, or enforcement of our Terms of Service; (d) data minimisation and retention scheduling under applicable data protection law; or (e) the administration of inactive, abandoned, or fraudulently established accounts. This right may be exercised unilaterally and, where circumstances reasonably demand, without prior notice to the affected User.

7. Data Security

We implement appropriate technical and organisational security measures proportionate to the sensitivity of the data we process. These include:

• Encryption of all data in transit using industry-standard transport layer security protocols
• Encryption of uploaded files at rest using industry-standard algorithms applied through our cloud storage infrastructure
• All passwords stored exclusively as one-way cryptographic hashes; plaintext credentials are never retained in any system or log
• Time-limited, uniquely generated single-use access credentials for digital content delivery
• Industry-standard authentication and session controls, with sessions ended on logout or expiry
• Role-based access controls limiting internal staff access to personal data on a need-to-know basis
• Regular security reviews, dependency audits, and infrastructure hardening procedures
• Logging and monitoring of sensitive operations

No method of electronic transmission or storage is 100% secure. While we take commercially reasonable steps to protect your information, we cannot guarantee absolute security. In the event of a data breach that poses a high risk to your rights, we will notify affected users without undue delay and in accordance with applicable law.

7A. Service Analytics and Platform Development

Trankets processes de-identified, pseudonymised, or aggregated data derived from Service usage for internal analytical, developmental, and operational purposes. Such processing may encompass, without limitation: longitudinal analysis of service utilisation patterns; feature adoption and engagement modelling; infrastructure capacity planning; heuristic and algorithmic processing for anomaly detection, fraud prevention, and content integrity; content performance analytics; and the optimisation of recommendation, discovery, notification, and workflow systems.

Data processed for these purposes is derived through statistical and computational methods designed to prevent re-identification of individual users. Aggregated and de-identified analytical outputs may be retained by Trankets indefinitely and used without restriction for the advancement of the Service and Trankets’ legitimate business interests. Trankets carries out this form of processing as data controller on the basis of its legitimate interests in operating, securing, and improving the Service. Where applicable law gives you a right to object to processing carried out on the basis of legitimate interests, you may exercise it as described in the section on your rights and choices below.

7B. Google User Data

This section describes how Trankets handles data obtained through Google APIs. It applies only if you choose to sign in with Google or to connect your Google Calendar. Neither is required to use Trankets, and connecting one does not connect the other.

7B.1 What We Access

• Sign in with Google (openid, userinfo.email, userinfo.profile): your name, email address, profile picture and Google account identifier. We use these to create or sign you in to your Trankets account and to recognise you on return visits.
• Google Calendar (calendar.events): permission to create and manage calendar entries on your own calendar. We use it for two things only: placing a confirmed booking or online event on your calendar, and generating the Google Meet link attached to that entry.

7B.2 How We Use It, and What We Do Not Do

Calendar access is used solely to create, update and remove the calendar entries for bookings and events that you or your buyers create on Trankets. We write entries that belong to you, on your own primary calendar.

• We do not read, index, analyse or store the contents of your existing calendar.
• We do not use Google user data for advertising, and we do not sell it.
• We do not transfer Google user data to third parties, except as necessary to provide the feature you asked for, to comply with applicable law, or as part of a merger or acquisition of which you are notified in advance.
• We do not use Google user data to train generalised artificial intelligence or machine learning models.
• Humans do not read your Google user data, except with your explicit consent for a support request you raise, where required by law, or for security investigations such as abuse or fraud.
• Buyers and attendees are not added to the calendar entry for an event, so a guest list is never exposed through it.

7B.3 Limited Use

Trankets’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7B.4 Storage, Retention and Revoking Access

Access and refresh tokens issued by Google are encrypted at rest and are used only to perform the actions described above on your behalf. You can disconnect Google at any time from Settings, under Connections, which deletes the stored tokens. You can also revoke access directly from your Google Account permissions page. Revoking access stops any further calendar entries being created or updated; entries already on your calendar remain yours and are unaffected.

8. Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this Policy, unless a longer retention period is required by law. Specifically:

• Account data: Retained for the lifetime of your active account, plus a further 90 days following account closure to allow for reinstatement or dispute resolution, after which it is deleted or anonymised.
• Transaction and financial records: Retained for a minimum of 7 years as required by applicable financial recordkeeping regulations.
• Download logs and purchase records: Retained for 2 years following the purchase to support audit, dispute resolution, and compliance purposes.
• Uploaded product files: Retained for as long as your account is active and the product is live. Files are deleted from our storage within 30 days of product deletion or account closure.
• Email communication logs: Retained for 12 months for deliverability troubleshooting and anti-spam compliance.
• Newsletter contact lists: Retained until you delete the contacts or close your account. Unsubscribed contacts are retained in suppression lists to prevent future accidental contact.
• API logs: Retained for 90 days for security and rate-limit enforcement, then purged.

You may request deletion of your account and associated personal data at any time. Upon confirmation, we will delete or anonymise your personal data from our active systems, subject to any legally mandated retention obligations.

9. Your Rights and Choices

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention obligations and ongoing dispute processes.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Portability: Request your data in a structured, machine-readable format. Attendee and contact data can be exported as CSV from within your dashboard.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time (this will not affect the lawfulness of prior processing).
• Unsubscribe: Opt out of marketing or newsletter communications at any time using the unsubscribe link in any email.

To exercise any of these rights, please contact us at hello+trankets@yconsoft.com. We will respond within 30 days. We may need to verify your identity before processing a request.

If you are in Nigeria, these rights are provided under the Nigeria Data Protection Act 2023, and you have the right to lodge a complaint with the Nigeria Data Protection Commission. If you are in a region with its own data-protection authority, you may lodge a complaint with your local supervisory authority. You may contact our data protection contact at privacy@trankets.com for any request or complaint before escalating.

10. Cookies and Tracking Technologies

We use the following types of cookies and similar technologies:

• Session cookies: Required to keep you logged in during your active session. These expire when you close your browser or log out.
• Persistent preference cookies: Store UI preferences (e.g., dashboard view settings, dark mode). These persist across sessions.
• Security cookies: Protect the integrity of authenticated sessions and the requests made within them.

We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking technologies. You can control cookies through your browser settings; however, disabling essential cookies will prevent you from using authenticated areas of the Service.

11. Third-Party Services and Links

The Service integrates with and relies upon the following third-party providers, each of which operates under its own privacy policy:

• Flutterwave (flutterwave.com) - payment processing
• Our cloud storage and infrastructure provider - storage of uploaded product files
• Our email delivery provider - transactional and campaign email delivery
• Google (google.com) - optional sign-in and, where you connect it, Google Calendar (see Section 7B)

A current list of our sub-processors is available on request.

The Service may contain links to third-party websites. This Privacy Policy does not apply to those external sites; we encourage you to review their privacy notices before providing them with any personal information.

12. Children's Privacy

The Service is not directed to or intended for use by children under 16 years of age. We do not knowingly collect personal data from anyone under 16. If you are a parent or guardian and believe your child has provided personal data to us, please contact us at hello+trankets@yconsoft.com and we will take prompt steps to delete that information from our systems.

13. International Data Transfers

Trankets operates globally. Some of our third-party service providers (including our cloud infrastructure provider) process data in data centres located in various countries. By using the Service, you acknowledge that your data may be transferred to and processed in countries with data protection standards that may differ from those in your home jurisdiction.

Where we transfer personal data internationally, we ensure appropriate safeguards are in place - including the use of service providers that maintain internationally recognised security certifications (e.g., ISO 27001, SOC 2) and contractual data processing protections.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, product features, or applicable law. For material changes, we will notify you by posting the revised Policy on this page with an updated "Last updated" date, and by sending a notification to your registered email address at least 14 days before the changes take effect. We encourage you to review this Policy periodically.

15. Contact Us

For questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact:

• Email: hello+trankets@yconsoft.com
• Company: Yconsoft Technologies
• Response target: We aim to respond to all privacy-related enquiries within 30 days.