Privacy Policy

Covered is a trading name of OTL Media Limited, a company registered in England and Wales (company no. 17366760) ("Covered", "we", "us"). This policy explains how we collect, use and protect personal information when you use our website, our apps, or a Covered booking widget on an organiser's website, whether you're booking events or running them.

We are the controller of your personal information under UK data protection law, except where this policy says otherwise. You can contact us about anything in this policy at hello@coveredplatform.com.

Events on Covered are run by event organisers ("organisers"). When you book an event, we share your booking details with that organiser so they can run the event and let you in. From then on, the organiser is also a controller of that information and is responsible for how they use it, under their own privacy policy.

When an organiser uses Covered to send email campaigns to their own contacts, we handle that information on the organiser's behalf, as their processor.

When you book

• Your name, email address, phone number, postcode and date of birth.
• What you booked: the event, tickets, add-ons, number of guests, arrival time, any discount code, and any special requests you add.
• Payment details. These are collected and processed by Stripe. We receive a record of the payment, such as the amount and its status, but never your full card number.
• Check-in records, showing when your ticket was scanned at the door.

When you create an account or use our app

• Your sign-in details, and the information Apple, Google or Facebook share if you sign in with them.
• The organisers you follow.
• A device token so we can send you push notifications, if you allow them, and a device identifier if you add a ticket to Apple Wallet, so we can keep the pass up to date.

Other things you do on Covered

• Group bookings you start or join, and waitlists you join.
• Messages you send us or an organiser, and your marketing preferences.

Collected automatically

• Your IP address, browser and device type, the pages you visit, and the link or campaign that brought you to Covered.
• A random visitor ID stored in a cookie, which lets us count visits and bookings without knowing who you are. See our Cookie Policy.

If you run events on Covered

• Your name, email address and role, plus the details of your business and the team members you invite.
• Payout and identity details you give Stripe when you connect your account. Stripe collects these directly, and we receive only what we need, such as whether your account can take payments.
• The events, images and email content you create, and any contacts you import.

UK data protection law requires a lawful basis for each use of your information. Ours are:

• To provide the service you asked for (contract): taking and confirming bookings, sending tickets and booking updates, running your account, group bookings and waitlists, processing payments and refunds, and checking you in at the door.
• Legal obligations: keeping financial records, and responding to lawful requests from authorities.
• Our legitimate interests: keeping Covered secure and preventing fraud, bots and abuse; providing customer support; measuring how Covered is used and improving it; giving organisers reports on how their events and links perform; and sending one reminder if you leave a booking unfinished. We only rely on legitimate interests where they aren't outweighed by your rights.
• Your consent: marketing emails, push notifications, marketing cookies, and the advertising measurement described in section 7. You can withdraw consent at any time.

We don't make decisions about you based only on automated processing that have legal or similarly significant effects.

We ask for your date of birth so organisers can check you meet an event's age limit, and so they can understand the age range of their guests.

If you add a special request, such as an allergy or an accessibility need, it may include information about your health. We only use it to pass it to the organiser so they can look after you at the event, and we rely on your explicit consent in choosing to tell us. Only add what the organiser needs to know. You can ask the organiser or us to remove it at any time.

• Organisers only email you marketing if you agree, for example by ticking "Keep me updated about future events and offers" at checkout, or by following them. Your choice applies to that organiser only.
• Every marketing email has an unsubscribe link. You can unsubscribe from one organiser, or from marketing from every organiser on Covered at once. Unsubscribing also stops that organiser's push notifications.
• Push notifications are only sent if you allow them on your phone. You can turn them off in the app or your phone's settings.
• Booking emails, such as confirmations and changes to your event, are not marketing and are always sent.

Some organisers advertise their events on Facebook and Instagram and use the Meta Pixel to measure those ads. If you've allowed marketing cookies and the organiser has turned this on, we tell Meta when you view or book that organiser's events. Along with this, we send your email address and phone number in a scrambled (hashed) form, plus your IP address, browser details and Meta's own cookie IDs, so Meta can match the booking to an ad you saw.

If you haven't allowed marketing cookies, none of this is sent to Meta. You can change your choice at any time from Cookie settings in the footer. Meta's use of this information is covered by Meta's Privacy Policy.

• Organisers of the events you book, follow or join a waitlist for, so they can run their events and, if you agree, market to you.
• Other people in a group booking. They see your first name and whether you've booked. Nothing else.
• Service providers who help us run Covered, under contracts that only let them use your information to provide their service to us:
  • Stripe: payments and payouts
  • Supabase: database, file storage and sign-in
  • Vercel: website hosting
  • Resend: booking emails
  • Amazon Web Services: organisers' marketing emails
  • Google Firebase: push notifications
  • Apple: Apple Wallet pass updates
  • Cloudflare: bot protection on sign-in forms
• Meta, only as described in section 7.
• Others where required: the police, regulators or courts where the law requires it; our professional advisers; or a buyer if our business is sold, who would have to respect this policy.

We don't sell your personal information.

Some of our service providers are based in, or access data from, the United States and other countries outside the UK. Where that happens, we make sure your information is protected, using the UK government's adequacy regulations (including the UK–US data bridge) or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

If you choose Continue with Facebook, Facebook shares your name, email address and a link to your profile picture with us, along with an ID for your Facebook account that is specific to Covered. We don't ask Facebook for your friends, posts, birthday or anything else.

• Your email address becomes your Covered account email.
• Your name is used to fill in your details the first time. You can change it, and Covered keeps its own copy.
• The profile picture link is stored with your account and may be shown as your profile picture in future.

We don't share this information with organisers, and we don't use it for advertising. An account created with Facebook always signs in with Facebook and has no password. Deleting your Covered account deletes this information.

If you choose Continue with Apple, Apple shares an email address with us, along with an ID for your Apple Account that is specific to Covered. The first time, it can also share your name. We don't ask Apple for anything else.

• If you choose Hide My Email, Apple gives us a private relay address that forwards to your real inbox, and that becomes your Covered account email. Your tickets and updates still reach you.
• Your name, if Apple shares it, is used to fill in your details the first time. You can change it.

We don't share this information with organisers, and we don't use it for advertising. An account created with Apple always signs in with Apple and has no password. Deleting your Covered account deletes this information.

If you choose Continue with Google, Google shares your name, email address and a link to your profile picture with us, along with an ID for your Google Account. We only ask Google for your basic profile and email address — never your contacts, calendar, files or anything else.

• Your email address becomes your Covered account email.
• Your name is used to fill in your details the first time. You can change it, and Covered keeps its own copy.

We don't share this information with organisers, and we don't use it for advertising. An account created with Google always signs in with Google and has no password. Deleting your Covered account deletes this information.

You can delete your Covered account, and the personal information linked to it, at any time:

• If you book events: sign in, open Account, then Settings, and choose Delete account.
• If you run events: sign in to the Organiser Portal, open the account menu and select your name to go to your account page, then choose Delete Account.
• If you signed in with Facebook, this also removes the information Facebook shared with us. You can remove Covered from your Facebook account under Settings > Apps and Websites.
• If you signed in with Apple, this also removes the information Apple shared with us. You can stop using Sign in with Apple for Covered in your Apple Account settings, under Sign in with Apple.
• If you signed in with Google, this also removes the information Google shared with us. You can remove Covered's access in your Google Account, under Security > Your connections to third-party apps & services.

Past bookings stay on the organiser's records without your account attached, as they're needed for accounting. If you can't sign in, email hello@coveredplatform.com from the address on your account and we'll delete it for you.

• Your account: until you delete it.
• Booking and payment records: 6 years after the event, because we need them for tax and accounting.
• Marketing preferences: for as long as you're a contact. If you unsubscribe, we keep a record of that so we don't email you again.
• Visit and measurement data: up to 2 years, then deleted or anonymised.
• Unfinished bookings and waitlist entries: deleted or anonymised within 12 months.

We use encryption in transit, access controls that keep each organiser's data separate from every other organiser's, and limit staff access to what they need. No system is perfectly secure, but if a breach affects your information, we'll tell you and the Information Commissioner's Office (ICO) where the law requires it.

Under UK data protection law, you have the right to:

• get a copy of the personal information we hold about you;
• have inaccurate information corrected;
• have your information deleted;
• restrict or object to how we use it, including objecting to marketing at any time;
• receive information you gave us in a portable format;
• withdraw your consent, where we rely on it.

To use any of these rights, email hello@coveredplatform.com. We'll reply within one month. For information an organiser holds about you, you can also contact them directly. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office, although we'd appreciate the chance to put things right first.

Accounts and bookings must be made by someone aged 18 or over. Children can go to events that welcome them, such as family events, when an adult books for them. We only collect the booking adult's details, not the children's. If you believe a child has given us their own information, contact us and we'll delete it.

We use cookies to keep you signed in, run bookings, measure visits and, with your consent, support organisers' advertising. See our Cookie Policy for the full list.

We'll update this policy when we change how we use your information. The date at the top shows when it last changed. If a change is significant, we'll let you know by email or in the app.

If you have any questions about this Privacy Policy or how we handle your information, please contact us at hello@coveredplatform.com.