Privacy Policy

Last updated: April 17, 2026

The short version

We collect the minimum data needed to send you a personalized weekly events email. We don't sell your data, we don't run ads, and we don't share your information with third parties for marketing. Your data stays between you, us, and the service providers we need to run evntally.

Who we are

evntally is operated in Canada. When we say “we,” “us,” or “evntally,” we mean the team behind evntally.com. This policy applies to all users of evntally.com and our email digest service.

What we collect

Information you give us

  • Email address (to send your digest and manage your account)
  • City and neighbourhood preferences (to personalize your events)
  • Category preferences — music, comedy, food, etc. (to match events to your taste)
  • Event ratings and saves (to improve your recommendations over time)
  • Password or authentication credentials (stored securely, never in plain text)

Information collected automatically

  • Email open and click tracking (to measure which events resonate with you)
  • Approximate location via browser geolocation (only when you use the “near you” feature, and only with your permission)
  • Basic usage data — pages visited, features used (to improve the product)
  • Device type and browser (for compatibility and debugging)

Payment information

We use Stripe to process payments. Your credit card number, expiry, and CVC are sent directly to Stripe and never touch our servers. We receive only a token, your card's last four digits, and the card brand. See Stripe's privacy policy.

How we use your data

  • Send you your personalized weekly events email
  • Improve event recommendations based on your ratings and preferences
  • Send event reminders you've opted into
  • Process your subscription payment
  • Send essential account emails (welcome, password reset, billing updates)
  • Fix bugs and improve the product

We do not use your data to serve ads, build advertising profiles, or sell to data brokers.

Who we share data with

We share data only with service providers that help us run evntally. We do not sell or rent your personal information.

  • Stripe — payment processing
  • Resend — email delivery
  • Neon — database hosting (encrypted at rest)
  • Vercel — application hosting

Each provider processes data under their own privacy policy and only as needed to provide their service to us. We do not share your event preferences, ratings, or browsing behavior with any third party.

Email communications (CASL compliance)

We comply with Canada's Anti-Spam Legislation (CASL). You expressly consent to receive our weekly events digest when you sign up and pay for a membership. You can unsubscribe from non-essential emails at any time using the unsubscribe link in every email. Essential account emails (billing, security, service changes) will continue as long as your account is active.

Data retention

  • Account data is kept for as long as your account is active
  • If you cancel, we retain your data for 30 days in case you resubscribe, then delete it
  • Payment records are retained as required by tax and financial regulations
  • You can request full deletion at any time by emailing us

Your rights (PIPEDA)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

  • Access the personal information we hold about you
  • Correct any inaccurate information
  • Request deletion of your data
  • Withdraw consent for non-essential data processing
  • File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, email us at hello@atlasatlantic.co. We will respond within 30 days.

Cookies

We use essential cookies only — for authentication and keeping you logged in. We do not use advertising cookies, tracking pixels from ad networks, or third-party analytics cookies. No cookie consent banner is needed because we only use strictly necessary cookies.

Security

We use HTTPS everywhere, encrypt data at rest, hash passwords with modern algorithms, and limit access to production data. Payments are handled entirely by Stripe (PCI DSS Level 1 certified). If we discover a data breach affecting your information, we will notify you and the relevant authorities as required by law.

Children

evntally is not directed at anyone under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. If we make material changes, we'll notify you by email before they take effect. The “last updated” date at the top reflects the most recent revision.

Contact

Questions about this policy? Email hello@atlasatlantic.co.