Privacy Policy

1. Introduction

This Privacy Policy describes how Fanz Software Inc. (“Fanz”, “we” or “our”) collects, uses, stores, protects and, where applicable, shares the personal data of users who access the fanz.com.ar platform, its subdomains, applications and associated services (collectively, the “Platform”).

By using the Platform, you accept the data processing practices described in this document. We recommend reading this Policy together with our Terms and Conditions.

2. Data Controller

Fanz Software Inc.<br/>Contact email: soporte@fanz.com.ar<br/>Website: fanz.com.ar

For ticket Buyer data, the Organizer of the event acts as data controller and Fanz acts as data processor, processing the data in accordance with the Organizer's instructions and these terms.

3. Personal Data We Collect

We collect the following categories of data depending on the type of user:

3.1. Data provided directly by the user

• Registration data: full name, email address, encrypted password, country and city of residence.
• Organizer data: business name or trade name, CUIT/RFC/NIT or other tax identifier, bank details for payment settlement, business address and contact information.
• Purchase data: cardholder name, payment card information (processed directly by the payment gateway; Fanz does not store full card data), billing details and purchase history.
• Communications: content of support messages, requests or inquiries you send us.

3.2. Data collected automatically

• Technical data: IP address, browser type and version, operating system, device type, screen resolution and Internet service provider.
• Browsing data: pages visited, time spent, navigation flow, links clicked, referring URL and interaction patterns.
• Geolocation data: approximate location (city level) derived from the IP address.
• Cookies and similar technologies: session identifiers, language preferences and authentication tokens (see Section 7).

4. Purposes of Processing

We use personal data for the following purposes:

• Service provision: create and manage accounts, process ticket sales, issue electronic tickets, manage access lists and settle payments to Organizers.
• Authentication and security: verify the identity of users, prevent fraud, detect suspicious activity and protect the integrity of the Platform.
• Transactional communications: send purchase confirmations, event updates, service changes and security notifications.
• Marketing (with consent): send promotional communications, event recommendations and personalized offers. The user may revoke this consent at any time.
• Analytics and product improvement: analyze usage patterns, measure the performance of the Platform, run A/B tests and develop new features.
• Legal compliance: respond to requests from competent authorities, comply with tax and accounting obligations, and exercise or defend legal rights.

5. Legal Basis for Processing

Data processing is based on one or more of the following legal bases:

• Performance of the contract: when processing is necessary to provide the contracted services (registration, ticket processing, payment settlement).
• Consent: for sending commercial communications and the use of non-essential cookies.
• Legitimate interest: for fraud prevention, improvement of the Platform and security of the infrastructure.
• Legal obligation: to comply with tax, accounting or authority requirements.

6. Sharing Data with Third Parties

Fanz does not sell personal data. We may share information with the following categories of third parties:

• Event Organizers: the Buyer data necessary for the management of the event (name, email, details of the purchased ticket).
• Payment processors: gateways such as Mercado Pago, Stripe or other providers necessary to process transactions securely.
• Infrastructure providers: hosting, cloud storage, CDN and monitoring services that operate under data processing agreements.
• Analytics tools: Google Analytics and similar tools to measure site performance (with anonymized or pseudonymized data when possible).
• Competent authorities: when required by law, court order or applicable regulation.

7. Cookies and Tracking Technologies

The Platform uses cookies and similar technologies classified as:

• Essential cookies: necessary for basic operation (authentication, security, language preferences). They do not require consent.
• Analytics cookies: help us understand how users interact with the Platform (most visited pages, conversion flows, loading times).
• Marketing cookies: used to measure the effectiveness of advertising campaigns and personalize the content shown.

You can manage your cookie preferences from your browser settings. Disabling non-essential cookies does not affect the basic functionality of the Platform, but may limit some personalization features.

8. International Data Transfers

Personal data may be processed on servers located in the United States or other countries where our infrastructure providers operate. When international transfers are made, we guarantee an adequate level of protection through:

• Standard contractual clauses approved by competent data protection authorities.
• Internationally recognized privacy certifications (such as the EU-US Data Privacy Framework, when applicable).
• Data processing agreements with each provider that accesses personal information.

9. Information Security

We implement technical and organizational security measures proportionate to the level of risk, including:

• AES-256 encryption for data at rest and TLS 1.3 for data in transit.
• Role-based access controls with multi-factor authentication for authorized personnel.
• Continuous infrastructure monitoring and automated threat detection.
• Regular security audits and penetration testing.
• Documented procedure for responding to security incidents.

In the event of a security breach affecting personal data, we will notify affected users and competent authorities within the timeframes established by applicable law.

10. Data Retention

Personal data is kept for the time necessary to fulfill the purposes described in this Policy:

• Account data: as long as the account remains active and up to twelve (12) months after its cancellation, unless a longer legal retention obligation applies.
• Transactional data: for the period required by applicable tax and accounting regulations (generally between 5 and 10 years depending on the jurisdiction).
• Analytics data: in anonymized or aggregated format, with no time limit.
• Marketing data: until the user revokes consent.

Once the retention periods have elapsed, the data is securely deleted or irreversibly anonymized.

11. User Rights

In accordance with applicable law, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or outdated data.
• Erasure: request the deletion of your data (“right to be forgotten”).
• Restriction: restrict processing in certain circumstances.
• Objection: object to processing based on legitimate interest or for marketing purposes.
• Portability: receive your data in a structured, commonly used format.
• Withdrawal of consent: withdraw your consent at any time, without affecting the lawfulness of prior processing.

12. How to Exercise Your Rights

To exercise any of the rights mentioned, send an email to soporte@fanz.com.ar with the subject “Data Protection”, indicating:

• Your full name and email address associated with your account.
• The right you wish to exercise.
• Any additional information that facilitates the handling of your request.

We will respond to your request free of charge within a maximum of thirty (30) calendar days. If the request is complex or requires additional verification, the period may be extended by another thirty (30) days, with prior notice.

13. Protection of Minors' Data

The Platform is not directed to minors under 16 years of age. We do not knowingly collect personal data of minors of that age. If we detect that we have collected information from a minor without the consent of their legal representative, we will proceed to delete it immediately. Parents or guardians may contact us at soporte@fanz.com.ar to request the deletion of a minor's data.

14. Google User Data (Gmail Integration)

Fanz offers an optional feature that allows event organizers to connect their support Gmail inbox to the Fanz AI assistant, using Google's OAuth consent flow. When an organizer connects Gmail, Fanz accesses only the following data, exclusively to provide this feature:

• Reading incoming emails (gmail.readonly): the assistant reads new incoming customer emails in the connected inbox in order to generate reply suggestions.
• Sending replies (gmail.send): the assistant sends replies on the organizer's behalf, threaded into the original email conversation.
• Account identification (userinfo.email): we read the email address of the connected account to display which inbox is connected and to prevent the same inbox from being linked to more than one account.

Google user data is used solely to provide and improve this user-facing feature. It is never used for advertising or marketing purposes, never sold, and never used to determine creditworthiness. The general "Marketing" and "Analytics and product improvement" purposes described in Section 4 of this Policy do not apply to Google user data. OAuth tokens are stored encrypted (AES-256) and organizers can disconnect Gmail at any time, which deactivates the integration and stops all access.

Human access to Google user data is limited to the organizer (the inbox owner) reviewing their own conversations in their dashboard, and to cases strictly required for security purposes or legal compliance.

AI/ML processing and Limited Use. To generate reply suggestions, the text of incoming emails is processed by third-party AI providers through their commercial APIs: Anthropic (Claude), for response generation, and OpenAI (text embeddings), for retrieving relevant knowledge-base content. Under the commercial API terms of both providers, this data is not used to train or improve their models. Fanz does not use Google user data — raw, aggregated or derived — to create, train or improve any machine learning or artificial intelligence models, whether foundational or otherwise.

Fanz's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

15. Changes to this Policy

We reserve the right to update this Privacy Policy to reflect changes in our data practices or in applicable law. Material changes will be notified at least fifteen (15) days in advance via email or visible notice on the Platform. The date of the last update is indicated at the beginning of this document.

16. Contact

For any inquiry, request or claim related to the processing of your personal data, you may contact us at:

Fanz Software Inc.<br/>Email: soporte@fanz.com.ar<br/>Website: fanz.com.ar

You also have the right to lodge a complaint with the competent data protection authority in your jurisdiction if you believe your rights have not been duly addressed.