This policy explains what personal data we process when you use the www.aibilet.io platform, why we process it, how long we keep it and what rights you have. It applies to buyers, event attendees, organizers and their team members, and visitors to the Platform. The terms used, such as "personal data", "controller" and "processor", have the meaning given to them in Regulation (EU) 2016/679 (the "GDPR").
1. Who we are
1.1. The www.aibilet.io platform (the "Platform") is operated by MAI PE SCURT S.R.L., tax identification number (CUI) 53150998, Trade Register number J2025099026009, registered office at Str. Pitar Moș nr. 27, et. 5, ap. 17, Sector 1, București ("we" or "us").
1.2. For any question about your personal data or to exercise your rights, you can write to us at [email protected].
2. Our roles
2.1. Controller. We are the controller of the data processed in connection with:
- your account and authentication;
- the security of the Platform and fraud prevention;
- compliance with our legal obligations;
- marketing communications, only with your consent;
- the AI support chat.
2.2. Processor on behalf of the organizer. Tickets are sold by the event organizer (the "Organizer"), not by us. For the order and attendance data of their event (for example, name, email, phone, tickets and entry scans), the Organizer is the controller. We process this data on the Organizer's behalf, as processor, under Annex 1 to the Terms and Conditions for Organizers.
2.3. For the data described in point 2.2, you exercise your rights with the Organizer. The Organizer's contact details are shown at checkout and on the electronic order receipt. If you send such a request to us, we forward it to the Organizer and help them respond to you.
2.4. Payments are processed by Stripe. For payment data, Stripe is an independent controller and processes it under its own privacy policy.
3. What data we process
3.1. We process the following categories of data:
- Account: email address, name and phone number. If you sign in with Google, we receive from Google the name and email address of your account.
- Orders and tickets: the event, the tickets and seats chosen, the names of attendees on personal tickets, the amounts paid, the status of payments and refunds, and the electronic order receipt.
- Entry scans: ticket validations at the event entrance, with date and time.
- Technical data: IP address, country estimated from the IP address, device and browser type, and access and security logs.
- Preferences: the language you choose and your cookie choices.
- Conversations: messages in the support chat, the assistant's replies and the messages you send us by email.
- Organizer data: seller details (for example, legal name or name, tax identification number, address, contact email and phone) and team member data (name, email address and role in the organization).
3.2. Card data is processed only by Stripe. It does not reach us.
3.3. We receive most data directly from you. We receive some data from third parties: from the Organizer, for example when they send you an invitation or record an on-site sale; from Stripe, for example the payment status; from Google, if you sign in with your Google account.
4. Purposes and legal bases
4.1. We process data for the following purposes:
| Purpose | Legal basis | Categories of data |
|---|---|---|
| Creating and managing the account, authentication | performance of a contract (Article 6(1)(b) GDPR) | account, preferences |
| Services for Organizers: the organization, the team and the seller details, including showing them to buyers | performance of a contract (point (b)); legal obligation to inform buyers about the seller (point (c)) | organizer data |
| Selling tickets, issuing and validating them and communications about the order, on behalf of the Organizer | the basis determined by the Organizer, as controller, usually performance of a contract (point (b)) | account, orders and tickets, entry scans |
| Security of the Platform, prevention of fraud and abuse | legitimate interest in protecting the Platform, users and Organizers (point (f)) | technical data, account, orders and tickets |
| Compliance with legal obligations, for example accounting and tax obligations, and responding to requests from authorities | legal obligation (point (c)) | account, orders and tickets, organizer data |
| The AI support chat | legitimate interest in providing support (point (f)); performance of a contract (point (b)), when the question concerns your account or orders | conversations, account, orders and tickets, technical data |
| Email support and handling complaints | performance of a contract (point (b)); legitimate interest in responding to requests (point (f)) | conversations, account, orders and tickets |
| Analysing the use of the Platform, through analytics cookies | consent (point (a)) | technical data, preferences |
| Measurement pixels added by Organizers to the event page | consent (point (a)) | technical data, orders and tickets (order value and currency) |
| Marketing communications | consent (point (a)) | account (name and email address) |
| Establishing, exercising or defending legal claims | legitimate interest (point (f)) | data relevant to the case |
4.2. Where the basis is legitimate interest, you can object to the processing, as described in section 8. Where the basis is consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
4.3. The support chat uses an artificial intelligence model (Google Gemini). Its replies are generated automatically and may contain errors. They are not decisions about your orders or your rights. For important requests, such as refunds, write to the Organizer or to [email protected]. Please do not send sensitive data in the chat, such as health data or card details.
5. How long we keep data
5.1. We keep data only for as long as it is needed for the purposes in section 4:
- Account: for as long as the account exists, plus at most 30 days after it is deleted.
- Orders and electronic order receipts: for the period required by accounting and tax legislation for supporting documents.
- Security logs: at most 12 months.
- Chat conversations: at most 12 months.
- Marketing data: until you withdraw your consent.
- Cookies: the durations set out in the Cookie Policy.
5.2. We keep the data we process on behalf of the Organizer in line with the Organizer's instructions and Annex 1 to the Terms and Conditions for Organizers.
5.3. We may keep data for longer only where the law requires it or where it is needed to establish, exercise or defend legal claims. At the end of the retention period, data is deleted or anonymized. Data in backups is deleted when the normal backup cycle expires.
6. Who we share data with
6.1. We share data only to the extent necessary, with:
- the event Organizer: the data on the order, the tickets and attendance at their event (point 2.2);
- the providers that help us operate the Platform, listed in point 6.2;
- the providers of the pixels added by Organizers, only with your consent: Meta, TikTok or Google, as described in the Cookie Policy;
- public authorities, for example courts, criminal investigation bodies or tax authorities, only at their lawful request or where the law requires us to.
6.2. The providers that help us operate the Platform process data on our behalf, under a contract, except where the table states that they are independent controllers:
| Provider | Activity |
|---|---|
| Supabase | database, with the data hosted in the EU |
| Vercel | hosting of the Platform |
| Stripe | payments; for payment data, Stripe is an independent controller |
| Resend | sending emails |
| Gemini, for the support chat | |
| sign-in with a Google account, if you choose it; for this, Google is an independent controller | |
| Microsoft | Clarity, for analysing the use of the Platform; loaded only with your consent to analytics cookies |
6.3. We do not sell your personal data.
7. Transfers outside the EEA
7.1. Some providers may process data outside the European Economic Area (EEA).
7.2. We transfer data outside the EEA only on the basis of an adequacy decision of the European Commission (Article 45 GDPR) or of the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR).
7.3. You can ask for information about the safeguards used for a transfer, including a copy of them, at [email protected].
8. Your rights
8.1. Under the conditions set out in the GDPR, you have the following rights:
- access: to find out whether we process data about you and to receive a copy of it;
- rectification: to have inaccurate data corrected and incomplete data completed;
- erasure: to have your data erased, for example when it is no longer needed;
- restriction: to have the processing restricted, for example while we check the accuracy of the data;
- portability: to receive the data you have provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller;
- objection: to object to processing based on legitimate interest and, at any time, to processing for direct marketing;
- withdrawal of consent: at any time, without affecting the lawfulness of processing carried out before it.
8.2. Requests are sent to [email protected]. We respond without undue delay and within one month of receiving the request. For complex or numerous requests, this period may be extended by two further months, in which case we will inform you. We may ask for additional information to confirm your identity.
8.3. For the data we process on behalf of the Organizer, you exercise your rights with the Organizer, as described in point 2.3.
8.4. If you have a concern, you can write to us at any time. You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), at dataprotection.ro, or with the supervisory authority of the Member State where you live or work.
9. Security
9.1. We apply appropriate technical and organizational measures to protect data, for example:
- encryption of data in transit;
- access control based on roles and organization membership;
- limiting staff access to what is necessary;
- backups.
9.2. No system is completely secure. If a personal data breach occurs, we notify ANSPDCP and inform you, under the conditions set out in the GDPR. For data processed on behalf of the Organizer, we notify the Organizer, in line with Annex 1 to the Terms and Conditions for Organizers.
9.3. Keep your account access details confidential, including the sign-in codes you receive by email.
10. Children
10.1. The Platform is not intended for people under 16 without the consent of their parents or legal representative.
10.2. The data of children attending events, for example the name on a personal ticket, is provided by the parent or adult placing the order.
10.3. If you become aware that a child under 16 has provided us with data without such consent, write to us at [email protected] and we will delete it.
11. Cookies
11.1. We use cookies and similar technologies. Essential and preference cookies work without consent. Analytics and marketing cookies, including the pixels added by Organizers, are used only with your consent.
11.2. The details are in the Cookie Policy.
12. Changes
12.1. We may update this policy, for example when the law or the Platform's features change. The new version is published on this page, with its effective date. We inform you of significant changes through the Platform or by email.
12.2. This policy is available in Romanian, English and Russian. If the versions differ, the Romanian version prevails.
Last updated: 2026-10-03 · version 2026-10-03