Privacy Policy

Last updated: October 9, 2026

The short version

We collect the minimum data needed to send you a personalized weekly events email. We don't sell your data, we don't run ads, and we don't share your information with third parties for marketing. Your data stays between you, us, and the service providers we need to run evntally.

Who we are

evntally is operated in Canada. When we say “we,” “us,” or “evntally,” we mean the team behind evntally.com. This policy applies to evntally.com, the Thursday email, and the Evntally plugin in ChatGPT.

What we collect

Information you give us

Email address (to send your digest and manage your account)
City and neighbourhood preferences (to personalize your events)
Category preferences — music, comedy, food, etc. (to match events to your taste)
Event ratings and saves (to improve your recommendations over time)
Password or authentication credentials (stored securely, never in plain text)

Information collected automatically

Email open and click tracking (to measure which events resonate with you)
Approximate location via browser geolocation: on the homepage we ask your browser for your location so we can show events near you. You can refuse, and we won't ask again on that browser for 30 days. If you allow it, the coordinates are used once, in memory on your device, to pick the nearest city we cover; they are never stored or sent to our servers.
Your approximate city from your network connection, to show a sample of events near you on the homepage. We use the nearest city we cover and do not store your location; you can change the city at any time.
Basic usage data — pages visited, features used (to improve the product)
Device type and browser (for compatibility and debugging)

Payment information

We use Stripe to process payments. Your credit card number, expiry, and CVC are sent directly to Stripe and never touch our servers. We receive only a token, your card's last four digits, and the card brand. See Stripe's privacy policy.

How we use your data

Send you your personalized weekly events email
Improve event recommendations based on your ratings and preferences
Send event reminders you've opted into
Process your subscription payment
Send essential account emails (welcome, password reset, billing updates)
Fix bugs and improve the product

We do not use your data to serve ads, build advertising profiles, or sell to data brokers.

Who we share data with

We share data only with service providers that help us run evntally. We do not sell or rent your personal information.

Stripe — payment processing
Resend — email delivery
Neon — database hosting (encrypted at rest)
Vercel — application hosting

Each provider processes data under their own privacy policy and only as needed to provide their service to us. We do not share your event preferences, ratings, or browsing behavior with any third party.

Email communications (CASL compliance)

We comply with Canada's Anti-Spam Legislation (CASL). You expressly consent to receive our weekly events digest when you sign up and pay for a membership. You can unsubscribe from non-essential emails at any time using the unsubscribe link in every email. Essential account emails (billing, security, service changes) will continue as long as your account is active.

Data retention

Account data is kept for as long as your account is active
If you cancel, we retain your data for 30 days in case you resubscribe, then delete it
Payment records are retained as required by tax and financial regulations
Analytics data is kept only while it is useful — typically a few months — then deleted
You can request full deletion at any time by emailing us

Your rights (PIPEDA)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to:

Access the personal information we hold about you
Correct any inaccurate information
Request deletion of your data
Withdraw consent for non-essential data processing
File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, email us at hello@atlasatlantic.co. We will respond within 30 days.

ChatGPT

If you use Evntally inside ChatGPT, that plugin only searches the public event catalog. It does not sign you in, create an account, collect your email address, or start a membership.

ChatGPT may send us:

The city, date, category, and search words needed to answer your question
A coarse location hint — city, region, and country — when you do not name a city
An anonymized subject identifier that ChatGPT provides so we can limit abuse

We use those only to find events and to apply that limit. We do not read coordinates even if ChatGPT attaches them. We do not store your chat, the search, the location hint, or the subject identifier in our database. The subject identifier may stay in server memory for up to one minute and is then discarded. We do not use it to identify you or build a profile.

The plugin returns public event details: title, time, venue, neighborhood, city, price, a short description, and a link to the event page. Searches run on our existing hosts, Vercel and Neon. We do not send ChatGPT queries to an advertising network.

Analytics

We measure how the site is used with our own analytics, running on our own servers. We don't use advertising pixels, and we don't hand your browsing behaviour to another company to analyse.

Broadly, that means we record things like:

Which pages get visited, where visitors arrived from, and roughly which country they are in
A handful of product actions — things like viewing an event, saving one, or clicking through to tickets, registration, or a calendar

We keep this as non-identifying as we reasonably can. We don't store your IP address, and we don't retain the details tacked onto a web address beyond the page itself and any campaign tags that tell us which link brought you here. None of it is tied to you personally unless you have given us your details elsewhere, such as by signing up.

To tell one visit from another without identifying anyone, we derive a device signature — a one-way signature based on general characteristics of your browser. It can't be reversed to reveal anything about you or your device, and it is rotated regularly so the same browser isn't traceable over time. We also keep a session identifier in your browser's session storage, which is not a cookie and disappears when you close the tab.

We keep analytics data only as long as it is useful — typically a few months — and then delete it. We use it to understand which events and features people find useful, not to build advertising profiles or to track you across other websites.

Cookies

We use first-party cookies only: one keeps you logged in, and the homepage measurement cookie described below counts visitors. We do not use advertising cookies, tracking pixels from ad networks, or third-party analytics cookies, and nothing is shared with other companies.

Our homepage also sets a first-party cookie that remembers which version of the page you were shown and gives your browser a random ID, so we can count visitors once and see which version works better (and, if you later create an account, which version you saw) — it is never shared with anyone and never used for advertising.

Security

We use HTTPS everywhere, encrypt data at rest, hash passwords with modern algorithms, and limit access to production data. Payments are handled entirely by Stripe (PCI DSS Level 1 certified). If we discover a data breach affecting your information, we will notify you and the relevant authorities as required by law.

Children

evntally is not directed at anyone under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. If we make material changes, we'll notify you by email before they take effect. The “last updated” date at the top reflects the most recent revision.

Contact

Questions about this policy? Email hello@atlasatlantic.co.