Privacy Policy

HoldThat EventOS ("EventOS", "we", "us") is event operations software operated by HoldThat Systems in Albany, New York, United States. This policy covers our website and the EventOS workspace.

Account information. Name, email address, organization name, role, and login credentials managed by our authentication provider.

Event data you enter. Events, registrations, vendor applications, sponsor records, volunteer shifts, contacts, announcements, tasks, notes, uploaded documents, and related files. This may include personal information about third parties (for example vendors, sponsors, volunteers, and attendees) that you or your participants submit.

Payment information. Subscription and event payments are processed by Stripe. We never receive or store full card numbers.

Usage and device information. Pages viewed, actions taken, approximate location derived from IP address, browser type, and device type, collected through analytics tools and server logs.

Communications. Messages you send to support, form submissions, and email engagement data such as delivery and open events.

• Provide, operate, secure, and improve the EventOS platform.
• Authenticate users and control access to organization workspaces.
• Send transactional email such as confirmations, invitations, and alerts.
• Process payments and manage subscriptions.
• Respond to support requests and communicate about the service.
• Understand product usage and improve features and performance.
• Detect, prevent, and investigate fraud, abuse, and security incidents.
• Meet legal, tax, and accounting obligations.

We do not sell personal information, and we do not use the event data you enter to train third-party AI models.

Where applicable law requires a legal basis, we rely on: performance of a contract (to provide the service you requested), legitimate interests (to secure and improve the product), consent (for optional analytics and marketing email), and legal obligation.

We share information only with providers that help us run EventOS, including:

• Cloud hosting, database, authentication, and file storage infrastructure.
• Stripe for payment processing.
• Email delivery providers for transactional and notification email.
• Analytics providers (Google Analytics, Microsoft Clarity, and advertising pixels).

We may also disclose information when required by law, to enforce our terms, to protect rights and safety, or in connection with a merger, acquisition, or sale of assets.

When an organization uses EventOS, that organization controls the event data in its workspace and is responsible for how it collects and uses participant information, including providing any notices or consents its participants require. We process that data on the organization's behalf.

We keep account and event data for as long as your workspace is active and for a reasonable period afterward to satisfy legal, tax, backup, and dispute-resolution needs. You can export your data at any time, and you can request deletion of your workspace by emailing us.

Access to workspace data is restricted by authentication and row-level database policies, traffic is encrypted in transit, and privileged operations run server-side. No system is perfectly secure, so we cannot guarantee absolute security.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. California residents may request disclosure or deletion and may opt out of any sharing for cross-context behavioral advertising. To exercise any right, email events@holdthat.systems. We will not discriminate against you for exercising these rights.

Every marketing email includes an unsubscribe link. Transactional email is required to use the service.

EventOS is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided data, contact us and we will delete it.

We operate in the United States. If you access EventOS from outside the U.S., your information will be transferred to and processed in the U.S. under appropriate safeguards.

We may update this policy as the product evolves. Material changes will be reflected in the "Last updated" date above and, when appropriate, announced in the product or by email.