Privacy Policy

WAVE is operated by Arvon Group Ltd(“WAVE”, “we”, “us”), a company registered in the United Kingdom. This policy explains what personal data we collect through the WAVE app and website, why we collect it, and the rights you have over it.

1. Data we collect

• Account data — email address, username, and password (stored securely hashed by our authentication provider; we never see or store your plaintext password).
• Profile data — anything you choose to add, such as a display name, avatar, bio, or favourite genres and cities.
• Transaction data — event tickets purchased, order history, and amounts paid. Card and payment details are collected and processed directly by our payment processor and are never stored on WAVE’s own servers.
• Usage data — events viewed, venues followed, and general interaction with the app, used to improve recommendations and fix bugs.
• Device data — device type, operating system, and app version, collected automatically for crash reporting and compatibility.
• Contact form data — if you message us or apply to partner with WAVE, we store the name, email, and message you submit.

2. Why we collect it

We process your data on the following legal bases under UK/EU data protection law:

• Contract — to create your account, sell you tickets, and let you use the app.
• Legitimate interest — to keep the platform secure, prevent fraud, and improve the product.
• Consent — for optional communications like event recommendations or marketing email, which you can withdraw at any time.
• Legal obligation — to keep transaction records required for tax and accounting purposes.

3. Who we share it with

We do not sell your personal data. We share it only with:

• Supabase — our database and authentication infrastructure provider.
• Our payment processor — to process ticket purchases securely.
• Event organisers and venues — limited order details (name, ticket type) so they can validate entry at the door.
• Law enforcement or regulators, where we are legally required to.

4. How long we keep it

We keep account data for as long as your account is active. Transaction records are kept for at least the period required by UK/EU tax law after which they are deleted or anonymised. You can request earlier deletion of your account data at any time, subject to our legal retention obligations.

5. Your rights

Under UK GDPR and the EU GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent for marketing communications at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at the email below.

6. Children

WAVE is not directed at children. You must be at least 16 years old to create an account, and event access may carry a separate, higher age requirement set by the venue or organiser.

7. Security

We use industry-standard encryption in transit and at rest, and row-level access controls so that your data is only ever readable by you and, where operationally necessary, the organiser of an event you’ve bought a ticket to.

8. Changes to this policy

We may update this policy as WAVE evolves. Material changes will be announced in the app. Continued use of WAVE after a change takes effect constitutes acceptance of the update.

9. Contact

Questions about this policy or your data can be sent to privacy@wave.app.