Privacy Policy

Account Information:

• Name (individual or business name)
• Email address
• Phone number
• Password (encrypted)
• Account type (Event Host, Stallholder, Food Vendor)

Profile Information:

• Business description and trading name
• Company number (if applicable)
• Profile images, logos, and product photos
• Location/address information and postcode (used for distance-based matching)
• Website and social media links
• Cuisine types (for food vendors)
• Craft categories and subcategories (for stallholders)
• Event history and experience level

Availability & Calendar Data:

• Weekly availability patterns (which days you are available)
• Date overrides (specific dates marked as unavailable)
• Booked event dates

Event Information:

• Event names, descriptions, and dates
• Event locations, venues, and facilities
• Participant and invitation lists
• Event requirements, pricing, and policies
• Stallholder rules and additional terms
• Cancellation and refund policy selections

Contract & Signature Data:

• Digitally signed contracts (including your name, address, and company details)
• Digital signatures captured via on-screen signature pad
• Contract reference numbers and signing timestamps
• Contract status and payment deadlines

Financial Information:

• Stripe Connect account details (for event hosts receiving payments)
• Payment card information (processed and stored by Stripe; we do not store card details)
• Transaction and booking payment history
• Stall pricing information
• Premium subscription and wallet balance (days remaining)
• Referral code redemptions and promo code redemptions
• Payment collection details for self-managed events (event hosts): if you choose to record how vendors should pay you — for example bank account name, sort code and account number, or a PayPal address — StallSync stores these details and shows them only to vendors with a booking on that event. Unlike card payments (which Stripe handles), these details are stored by StallSync. You can update or remove them at any time

Identity Verification Data (Event Hosts):

Hosts who choose to verify their identity for self-managed payment events undergo verification through Stripe Identity. During this process:

• Stripe may collect and process a government-issued identity document and, if applicable, a selfie for biometric comparison. This data is processed by Stripe under Stripe's own privacy policy; StallSync does not receive, store, or have access to the identity document or biometric data
• StallSync stores only: (a) verification status (verified or not verified); and (b) a Stripe-issued reference ID for the verification report
• Verification status is permanent and displayed to vendors as an “ID-verified host” badge on self-managed event invitations

Documentation & Event Passport Data:

• Insurance certificates
• Food hygiene certificates
• Business licenses
• Health and safety documentation
• Gas safety certificates
• Other compliance documents
• Signed document declarations and compliance attestations (vendors): the statement text as it stood when you signed, your digital signature, the signing timestamp, and your IP address and browser details — the same audit-trail pattern used for contract signing
• Guidance acknowledgements (a record that you confirmed reading relevant compliance guidance, with the date)
• Passport share links you create: the link label, expiry, and whether you have revoked it

Network & Connection Data:

• Your vendor network (hosts) or host network (vendors)
• Connection requests sent and received
• CSV-imported email addresses (for host vendor imports)

Engagement & Achievement Data:

• Achievement milestones earned and reward activation status
• Invitation response times (used for the “fast responder” badge)
• Referral activity and referral codes
• Premium time wallet balance and reward history

Communications & Feedback:

• Direct messages between hosts and vendors
• Event Q&A questions and answers
• Post-event feedback (ratings, footfall estimates, written comments)
• Post-event discussion forum contributions

Host-Imported Contact Data:

• If you receive a StallSync invitation from a host you know, your email address was provided to us by that host on the basis that you have an existing working relationship. We hold that email address solely to deliver the invitation; if you do not join within 30 days we permanently delete it. You can decline future invitations and have your details suppressed at any time using the link in the invitation email.
• Event hosts who upload vendor contact lists attest at the point of upload that they have an existing working relationship with each person on the list.

Usage Data:

• Pages visited
• Features used
• Click patterns
• Search queries
• Time spent on pages

Device Information:

• IP address
• Browser type and version
• Operating system
• Device type (mobile, desktop)
• Language preferences
• Time zone

Passport Share-Link Visit Data:

When someone opens an Event Passport share link, we record the time of the visit and basic device information (browser user agent). This log exists so the vendor who owns the passport can see when and how often their shared passport has been accessed — it is their reassurance that their data remains under their control. Visitors who open a share link may not be StallSync users; if that is you, this is the only data we collect about you, it is visible only to the vendor whose passport you viewed, and it is not used for any other purpose.

Event Hosts can see:

• Stallholder business names and descriptions
• Contact information (after booking)
• Insurance and compliance status
• Availability
• Reviews and ratings

Stallholders can see:

• Event details and requirements
• Event host contact information
• Other participants (after booking)
• Venue information
• Host payment collection details — bank transfer details or PayPal address, where the host has recorded them for a self-managed event (visible only after booking on that event)