Privacy Policy

1. Who We Are

Roundpit.com ("Roundpit," "we," "us," or "our") operates a hyperlocal events discovery platform serving Syracuse, New York. Our registered contact address is:

Email: contact@roundpit.com
Website: https://roundpit.com

For questions about this policy or your data, contact us at the address above.

2. What Data We Collect

2.1 Account and Profile Data

When you sign up as a venue partner or platform user, we collect:

• Full name and organization name
• Email address
• Account settings: subscription tier, approval status, account type
• Optional: password (hashed — we store a flag that one exists, never the password itself)
• Your relationship to locations on the platform (e.g., owner, collaborator) and associated permissions

2.2 Venue and Event Content

When you manage a location listing or submit events, we collect and store:

• Venue name, address, neighborhood, hours, phone, email, website
• Cover images, logos, and gallery photos
• Brand settings (color, name)
• Event titles, descriptions, dates, times, ticket URLs, and cover images
• Social media links and tags

2.3 Behavioral and Engagement Data

For every visitor — whether logged in or not — we collect behavioral signals to power our platform analytics and, in the future, aggregated audience insights for local advertisers:

• Page views: which location pages, event pages, category pages, and organizer pages are viewed
• Engagement actions: RSVPs, location follows, share clicks, ticket link clicks, and search queries
• Context slugs: we record which location, event, organizer, or category a given action relates to

This data is collected via our own first-party analytics system and stored in our database. It is not linked to your identity unless you take an action that requires an email address (like an RSVP or follow).

2.4 Google Analytics and Google Search Console

We use Google Analytics to collect anonymous, aggregated data about how visitors interact with Roundpit.com — pages visited, session duration, general geographic region (city/region level), device type, and traffic source. Google Analytics uses cookies and similar technologies. This data is processed by Google in accordance with their Privacy Policy. You can opt out at any time via the Google Analytics Opt-out Browser Add-on.

We use Google Search Console to monitor how Roundpit.com appears in Google Search — including which search queries surface our pages, crawl coverage, and indexing status. Search Console does not place cookies or collect personal data from site visitors; it processes data Google already holds as part of its search infrastructure.

2.5 RSVP and Follow Data

When you RSVP to an event or follow a location, we collect:

• Your email address (required)
• Your name (optional)
• The event or location you acted on

We use this to send you relevant notifications (e.g., new events at a location you follow). Every email includes a one-click unsubscribe link backed by an HMAC-signed token — no account required to opt out.

2.6 Waitlist Signups

If you join a feature waitlist, we collect your email address and the feature you expressed interest in.

2.7 Automatically Collected Technical Data

Our infrastructure (Vercel) automatically collects standard server log data including:

• IP address
• Browser type and version
• Referring URL
• Request timestamps and paths

This data is used for security, fraud prevention, and platform stability. It is not used for advertising targeting.

2.8 Cookies and Sessions

We use strictly necessary cookies to maintain authentication sessions via Supabase. We also use Google Analytics cookies (see section 2.4) to understand site usage. We do not use advertising cookies or third-party tracking pixels.

3. How We Use Your Data

3.1 To Operate the Platform

• Create and manage your account and venue listing
• Display event and location information to the public
• Enable RSVPs, follows, and engagement features
• Send transactional emails: account confirmation, approval notifications, invite links, follower notifications, and password setup
• Apply subscription tier features and access controls

3.2 Platform Analytics (Dashboard)

Venue owners with a Pro or higher subscription see aggregated analytics for their own listings — page views, RSVPs, follows, shares, ticket clicks — derived from the behavioral data described in 2.3. This data is scoped to their location only.

3.3 Future: Aggregated Audience Insights for Local Advertisers

Roundpit's business model includes a future advertising revenue stream based on selling aggregated, de-identified audience insights to local advertisers (e.g., "300 unique visitors attended open mic events in Armory Square last month"). This is not active yet. When it launches:

• Only aggregated, anonymized data will be shared — never individual-level records
• Data will be aggregated across a minimum cohort size to prevent re-identification
• We will update this policy and notify registered users before activating
• We will never sell your personal information (name, email, account details) to advertisers

3.4 Spam and Abuse Prevention

Event submissions and account signups are gated by human review. We use server-side checks to detect patterns consistent with automated abuse.

4. How We Share Your Data

We do not sell, rent, or trade personal information. We share data only with the following processors to operate our services:

• Supabase (Supabase Inc.) — database, authentication, and file storage. All data is stored on Supabase-managed infrastructure. Supabase Privacy Policy
• Vercel (Vercel Inc.) — application hosting and edge delivery. Server logs including IP addresses are processed by Vercel. Vercel Privacy Policy
• Resend (Resend Inc.) — transactional email delivery. Your email address is passed to Resend solely to deliver emails you triggered or subscribed to. Resend Privacy Policy
• Google LLC — Google Analytics (aggregated visitor analytics) and Google Search Console (search indexing and performance data). Data processed by Google is subject to Google's Privacy Policy and, where applicable, Google's EU data processing terms.

We may disclose information if required by law, legal process, or to protect the rights and safety of Roundpit, our users, or the public.

5. Data Retention

• Account data: retained while your account is active and for a reasonable period after deletion to satisfy legal obligations
• Event and venue content: retained as long as the listing is active; removed upon verified deletion request
• Behavioral analytics: retained indefinitely in aggregate; raw event rows may be pruned over time
• RSVPs and follows: retained until you unsubscribe or request deletion
• Email opt-out records: retained permanently to honor your preference — deleting your account does not remove your opt-out
• Server logs: subject to Vercel's retention policy (typically 30 days)

6. Your Rights and Choices

Email Communications

Every email we send includes a working unsubscribe link. You can also opt out of marketing emails from your account settings. Transactional emails (account status, security) are not optional while your account is active.

Account Deletion

To request deletion of your account and personal data, email contact@roundpit.com. We will process your request within 30 days. Note that content you created (venue listings, events) may continue to appear in de-identified or archived form per our Terms of Service.

Access and Correction

You can update your profile information directly from your dashboard. To request a copy of your data or to correct information you cannot edit yourself, contact contact@roundpit.com.

California Residents (CCPA)

California residents have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not currently sell personal information. To exercise CCPA rights, contact contact@roundpit.com.

7. Children's Privacy

Roundpit is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has submitted data, contact us immediately and we will delete it.

8. Data Security

We implement industry-standard security measures including:

• Row-level security (RLS) on all database tables — the browser client can only access data it is authorized for
• Service-role admin client used exclusively server-side, never bundled to the browser
• HMAC-signed tokens for unsubscribe links to prevent forgery
• Passwords hashed by Supabase Auth — we never store plaintext credentials
• HTTPS everywhere via Vercel's TLS infrastructure

No transmission method is 100% secure. In the event of a breach affecting your personal data, we will notify you as required by applicable law.

9. Third-Party Links

Roundpit pages link to external venues, ticketing platforms, and social media. Once you leave Roundpit.com, this policy no longer applies. We are not responsible for the privacy practices of third-party sites.

10. Changes to This Policy

We will update this policy as our data practices evolve — particularly when the aggregated advertiser insights feature goes live. We will post the updated policy here and update the "Last updated" date. For material changes, we will notify registered users by email with reasonable advance notice.

11. Contact

Questions, requests, or concerns:

Roundpit.com
Email: contact@roundpit.com
Website: https://roundpit.com