Privacy Policy

WAVE is operated by Arvon Group Ltd(“WAVE”, “we”, “us”), a company registered in the United Kingdom. This policy explains what personal data we collect through the WAVE app and website, why we collect it, and the rights you have over it.

1. Data we collect

• Account data — email address, username, and password (stored securely hashed by our authentication provider; we never see or store your plaintext password).
• Profile data — anything you choose to add, such as a display name, avatar, bio, or favourite genres and cities.
• Transaction data— event tickets purchased, order history, and amounts paid. Card and payment details are collected and processed directly by our payment processor and are never stored on WAVE’s own servers.
• Usage data — events viewed, venues followed, and general interaction with the app, used to improve recommendations and fix bugs.
• Location data— with your permission, your device’s coarse or precise location, used only to suggest the nearest city or venue. You can decline this permission and pick your city manually instead; declining does not restrict any other feature.
• Camera data — the app requests camera access solely to scan ticket QR codes at the door (for organisers and door staff) and, if you enable it, to set a profile photo. We do not access your camera roll or camera stream for any other purpose, and scanned images are not stored.
• Push notification data — a device push token, used to send you ticket and event notifications. You can disable notifications in your device settings at any time.
• Music taste data (optional) — if you choose to connect Spotify, we store a snapshot of your top artists to personalise event recommendations. This is entirely optional, off by default, and you can disconnect it at any time from your profile, which deletes the stored data.
• Contact form data — if you message us or apply to partner with WAVE, we store the name, email, and message you submit.

We do not currently use crash-reporting, analytics, or advertising SDKs of any kind. Basic device type, operating system, and app version are visible to us only as part of ordinary authentication and API request logs (retained briefly for security and abuse prevention), not through any dedicated tracking tool. If this changes, we will update this policy first.

2. Why we collect it

We process your data on the following legal bases under UK/EU data protection law:

• Contract — to create your account, sell you tickets, and let you use the app.
• Legitimate interest — to keep the platform secure, prevent fraud, and improve the product.
• Consent — for optional communications like event recommendations or marketing email, which you can withdraw at any time.
• Legal obligation — to keep transaction records required for tax and accounting purposes.

3. Who we share it with

We do not sell your personal data. We share it only with:

• Supabase — our database and authentication infrastructure provider.
• Our payment processor — to process ticket purchases securely.
• Event organisers and venues — limited order details (name, ticket type) so they can validate entry at the door.
• Law enforcement or regulators, where we are legally required to.

4. How long we keep it

We keep account data for as long as your account is active. Transaction records are kept for at least the period required by UK/EU tax law after which they are deleted or anonymised. You can request earlier deletion of your account data at any time, subject to our legal retention obligations.

5. Your rights

Under UK GDPR and the EU GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent for marketing communications at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at the email below. You can also delete your account and personal data yourself at any time, in the app under Profile → Account → Delete Account, or on the web at wave.arvon.cc/delete-account — no need to email us first.

6. Children

WAVE is not directed at children. You must be at least 16 years old to create an account, and event access may carry a separate, higher age requirement set by the venue or organiser.

7. Security

We use industry-standard encryption in transit and at rest, and row-level access controls so that your data is only ever readable by you and, where operationally necessary, the organiser of an event you’ve bought a ticket to.

8. Changes to this policy

We may update this policy as WAVE evolves. Material changes will be announced in the app. Continued use of WAVE after a change takes effect constitutes acceptance of the update.

9. Contact

Questions about this policy or your data can be sent to hello@arvongroup.co.uk.