Privacy Notice
Version: 2026-10. Effective from: 2026-10-27.
1. Who is responsible for your data?
The controller is Kovács Milán Barnabás, sole trader (Groxo). Registered seat: 1204 Budapest, Berzsenyi Dániel utca 3., Hungary. Registration no.: 62257785. Tax no.: 92020948-1-43. Email: hello@groxo.app.
We have not appointed a data protection officer, because the law does not require one. Contact us at the address above for any privacy matter.
This notice covers the groxo.app website and app (the "Platform"). Events are published by organisers (clubs, associations, businesses), who are the sellers of the tickets. Organisers handle the attendee data they receive from us as independent controllers, under their own privacy notices.
2. What data we process, why, and on what legal basis
| Processing | Data | Legal basis | Kept for |
|---|---|---|---|
| Account and profile | email address, password (stored only as a secure hash), nickname, display name, profile photo, bio, social media links, city, favourite sports, language, display settings | performance of a contract (GDPR Art. 6(1)(b)) | until you delete your account |
| Sign-in and security | IP address, browser and device data, sign-in times, the signals checked by our bot filter (Cloudflare Turnstile); for the administrator, two-factor authentication data | performance of a contract; legitimate interest in protecting accounts and the Platform (Art. 6(1)(f)) | our providers' short log retention periods |
| Ticket and season pass purchases | display name or nickname, email address, booking reference, ticket type, quantity, price, payment status and Stripe reference | performance of a contract; for Groxo's own accounting records, legal obligation (Art. 6(1)(c)) | see section 6 |
| Free registrations | display name or nickname, email address, booking reference, ticket type | performance of a contract | see section 6 |
| Purchases without an account (as a guest) | email address; that you accepted the Terms of Service, and which version; a fingerprint of the secret code in your ticket link (the code itself is not stored); for a free ticket, the request awaiting confirmation (email address, event, ticket type, time); otherwise the data listed for ticket purchases, without a name | performance of a contract (Art. 6(1)(b)) | with the purchase record, see section 6; unconfirmed free-ticket requests are deleted after 7 days |
| Entry check-in | time of scan, the staff account that scanned; the email address of check-in staff invited by an organiser | performance of a contract; legitimate interest in preventing ticket misuse | with the ticket record; staff invitations deleted 30 days after the event |
| Organiser verification | legal name, seller name shown to buyers, image of an identity document | legitimate interest in preventing fraud and protecting buyers | the document is deleted when the verification decision is made; the names until the account is deleted |
| Organiser billing details | billing name, address, tax number, billing email | performance of a contract; accounting obligations | until the account is deleted; issued invoices 8 years (Hungarian Accounting Act, s. 169) |
| Payouts (Stripe Connect) | email address, Stripe account ID; identity checks are done by Stripe as an independent controller | performance of a contract | until the account is deleted |
| Subscriptions (Pro, sponsor package, boost) | Stripe customer and subscription IDs, plan status | performance of a contract | until the account is deleted; on deletion we cancel subscriptions and delete the Stripe customer |
| Event alert emails | email address, organisers you follow, city, favourite sports; the time, source and wording version of each consent and withdrawal; a send log | consent (Art. 6(1)(a)); Hungarian Advertising Act, s. 6 | until you withdraw; the consent record until the account is deleted; the send log 12 months |
| Service messages | email address, booking details, QR code (it contains only the booking reference), in-app notifications | performance of a contract | emails: our sending provider's log period; notifications: 12 months |
| Social features | follows, favourites, reactions to posts; organisers' posts and uploaded media | performance of a contract | until the account is deleted |
| Sponsor exposure measurement | for signed-in visitors, user ID, event, sponsor and the day of the impression or click; for signed-out visitors, no personal data at all | legitimate interest: organisers' sponsor reports | 13 months, then aggregate counts only |
| Feedback and support | email address, user ID, message content | legitimate interest in answering you and improving the Platform | 24 months |
| Legal acceptances | version and time of the Terms of Service and Organiser Terms you accepted | legitimate interest in proving acceptance | until the account is deleted |
| Hosting and server logs | IP address, request details | legitimate interest in secure operation | our providers' log retention periods |
Page views and shares are counted without any identifier or personal data. For Pro organisers' event insights, we send only aggregate statistics with no personal data to Anthropic's AI service.
An email address and a password are required for an account; without them we cannot create one. All other profile details are optional. You can also buy or claim tickets without an account; for that, only your email address is needed.
Purchases without an account. If you buy or claim a ticket as a guest, without an account, we use your email address to send you your ticket and its link, to tell you if the event is cancelled or moved, to inform you about refunds, and so that the organiser can send you your receipt. We do not store the secret code in your ticket link, only a fingerprint of it that we check the link against. For a free ticket we first send a confirmation link to that address; the ticket is created only once you confirm, and an unconfirmed request is deleted after 7 days. If you later sign up with the same email address and confirm it, the tickets you got as a guest move into your account automatically.
We make no automated decisions with legal or similarly significant effects. For event alerts, the system automatically matches new events to the organisers you follow, your city and your favourite sports; you can switch this off in Settings at any time.
The balancing tests behind our legitimate-interest processing are available on request.
3. Who can see your data?
Other users. An organiser's profile publicly shows the display name, nickname, profile photo, bio, social media links, sports, verification status, follower count and seller name. A fan's profile shows other users the display name, nickname, profile photo, bio, favourite sports, fan level and date joined. Nobody else sees your email address or your city. Reactions to posts are public.
Organisers. When you buy a ticket or register, the event's organiser receives your name, email address, booking reference, number of tickets, amount paid and check-in status. An organiser can also see who follows them and who has saved their events as favourites.
Check-in staff. Staff invited by an organiser see only the nickname and ticket details of the ticket they scan. They cannot access attendee lists.
Away teams and co-organisers receive no attendee data.
Our processors handle data on our behalf and on our instructions:
| Provider | Task | What it receives | Where |
|---|---|---|---|
| Supabase | database, sign-in, file storage | all Platform data | EU (Ireland); US parent company |
| Netlify | hosting, server functions | request logs, IP address | USA |
| Resend | sending emails | email address, message content | USA |
| Cloudflare | bot filtering (Turnstile), rate limiting | IP address, browser signals | USA |
| the hello@groxo.app mailbox | the emails you send us | USA |
Independent controllers: Stripe Payments Europe, Limited (Ireland), for payments and organiser identity checks; event organisers; and authorities where the law requires us to disclose data.
For transfers to the United States we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the Commission's Standard Contractual Clauses. Copies are available on request.
4. Cookies and data stored in your browser
We use no tracking, advertising or analytics cookies. We store only what is strictly necessary for the service to work, so we do not ask for consent to it.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| NEXT_LOCALE | cookie | remembers your chosen language | 1 year |
| sb-…-auth-token | local storage | keeps you signed in | until you sign out |
| groxo_alerts_optin_dismissed | local storage | remembers that you declined the alert offer | until you clear it |
| groxo_recovery_verified | session storage | password reset | at most 15 minutes, until the tab closes |
On the sign-up, sign-in and guest purchase forms, the Cloudflare Turnstile bot filter processes the data it needs to work. Fonts and the ticket scanner are loaded from our own servers.
5. What happens when you delete your account?
You can delete your account in Settings at any time. We immediately delete your profile, uploads, follows, favourites, notifications and consent record. We cancel your subscriptions and delete your Stripe customer record.
Purchase data stays, without the link to your name, for the period in section 6, because the organiser and we may need it for refunds or disputes. It can still be linked to you through the Stripe reference, so we treat it as pseudonymised, not anonymous.
Events that have sold tickets stay listed, without the link to your account. An organiser cannot delete their account while they have upcoming events with sold tickets, cancelled events with unrefunded buyers, or valid sold season passes. A Stripe payout account stays with Stripe; you can close it with Stripe directly.
Deleted data disappears from our backups within 7 days.
6. How long we keep purchase records
We keep ticket and season pass purchases, registrations and check-ins for 5 years after the event, the limitation period for civil claims under the Hungarian Civil Code (s. 6:22). Where a record is Groxo's own accounting document, we keep it for the 8 years the Accounting Act requires (s. 169). Unsubscribe links are valid for up to 1 year and are then deleted.
7. Your rights
You can exercise these rights by emailing hello@groxo.app. We respond free of charge within one month; in justified cases this can be extended by two further months, and we will tell you if so. Please write from the email address on your account so we can identify you.
- Access: you can ask what data we hold about you and receive a copy.
- Rectification: you can correct your profile yourself in Settings.
- Erasure: you can delete your account in Settings; data we must keep by law is kept as described in section 6.
- Restriction: you can ask us not to use your data while a dispute is open.
- Portability: on request, we send the data you provided in a machine-readable format (JSON or CSV).
- Objection: you can object to processing based on legitimate interest; we then continue only if we have compelling legitimate grounds.
- Withdrawing consent: you can switch event alerts off in Settings or with the unsubscribe link in any alert. Withdrawal does not affect the lawfulness of earlier processing.
Complaints: you can complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH; 1055 Budapest, Falk Miksa utca 9-11.; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; ugyfelszolgalat@naih.hu; naih.hu), or to the data protection authority of the EU country where you live or work. You can also go to court, including the regional court of your place of residence. Please write to us first; we may be able to resolve it quickly.
8. Security
Data travels over encrypted connections and is protected by database-level access rules. Identity documents are held in private storage and only until the verification decision. Administrator access requires two-factor authentication, and deleting an account or changing payment settings requires a fresh sign-in.
If a personal data breach poses a risk, we notify the NAIH within 72 hours. If it poses a high risk to you, we also inform you without undue delay.
9. Children
You must be at least 16 to register as a fan and at least 18 to register as an organiser. If we learn that someone under 16 has registered, we delete the account.
10. Changes
The version and effective date are shown at the top. We announce material changes by email or in the app before they take effect. Earlier versions are available on request.