Privacy Policy

1. Information We Collect

Vento collects information in various ways as you interact with our platform. The types of information we collect include:

Account Information: Name, email address, phone number, password, and profile details when you create an account. For partners, we also collect company information and role details.
Event & Guest Data: Event details (name, date, location, type), guest information (names, phone numbers, email addresses), RSVP status, and attendance records.
Location Data: GPS coordinates and venue information associated with events. You control location permissions through your device settings.
Device & Technical Data: Device type, operating system, IP address, browser information, and app usage analytics via Firebase.
Payment Information: Payment method details, transaction history, and billing information processed through MyFatoorah.
QR Code Scanning Data: Records of QR code generations, scans, attendance tracking, and scan locations.
Social Login Data: If you use social login (Google, Apple, Facebook), we receive your email and basic profile information from those providers.

2. How We Use Your Information

We use the information we collect for the following purposes:

Account management and authentication
Event creation, management, and organization
Sending invitations to guests via WhatsApp
Generating and managing QR codes for attendance tracking
Facilitating partner collaboration and guest allocation
Processing payments and managing subscriptions via MyFatoorah
Sending push notifications through Firebase Cloud Messaging
Providing customer support and responding to inquiries
Improving and personalizing the Vento platform
Analytics, research, and service optimization
Compliance with legal and regulatory obligations

3. Sharing Your Information

We do not sell your personal information. However, we may share information in the following circumstances:

Event Partners: When you add partners to your events, they can see guest lists, RSVP data, and event details you share with them.
Payment Providers: MyFatoorah processes payment information. We share transaction details necessary for payment processing.
Communication Providers: WhatsApp receives phone numbers and event details needed to send invitations.
Analytics Services: Firebase collects usage data, crash reports, and app performance metrics.
Legal Compliance: We may disclose information when required by law, court order, or government request.
Service Providers: Third-party services that help us operate Vento (hosting, customer support, analytics) under strict confidentiality agreements.

4. WhatsApp Invitations

Vento uses WhatsApp to send event invitations to your guests. Here's what you should know:

Guest phone numbers are transmitted to WhatsApp to deliver invitations
Invitations include event details, date, time, location, and QR codes
Interactive RSVP buttons may be included in messages
WhatsApp has its own privacy policy covering the transmission and storage of messages
Guests can opt out by adjusting their contact preferences with you

5. Payment Information Security

Payment information is securely processed through MyFatoorah, a PCI DSS compliant payment gateway. We:

Do not store full credit card numbers on our servers
Use MyFatoorah's tokenization for secure card storage
Transmit all payments over encrypted HTTPS/TLS connections
Support SAR (Saudi Riyal) currency for transactions
Comply with international payment security standards

6. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations:

Active account data is retained while your account is active
Event history is retained for organizers and partners for record-keeping
Guest records and RSVP data are retained for event management purposes
QR scan logs are retained for audit trail and attendance verification (minimum 1 year)
Financial records are retained for 7 years to comply with tax and legal requirements
Payment receipts and transaction history are retained per local regulations
After account deletion, some data may be retained in anonymized or aggregated form

7. Security Measures

We implement comprehensive security measures to protect your personal information:

All data transmitted over the internet uses HTTPS/TLS encryption
Passwords are hashed using industry-standard Bcrypt encryption
API authentication uses Laravel Sanctum with secure tokens
Role-based access controls limit data visibility to authorized users
Regular security audits and penetration testing
Secure backup procedures with encryption at rest

8. Your Privacy Rights

You have the right to control your personal information:

Access: Request a copy of all personal information we hold about you
Correction: Update or correct inaccurate information in your account
Deletion: Request deletion of your account and associated personal data
Portability: Download your data in a machine-readable format
Notification Preferences: Control email, push notification, and WhatsApp communication settings
Location Permissions: Manage GPS location sharing through your device settings

9. Children's Privacy

Vento is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. Event organizers must be at least 18 years old. Event partners added to accounts must also be at least 18 years old.

10. International Data Transfers

Vento is primarily based in the Kingdom of Saudi Arabia. If you access Vento from outside Saudi Arabia, your information may be transferred to, stored in, and processed in Saudi Arabia. We implement appropriate safeguards for any international data transfers.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technology, or legal requirements. We will notify users of significant changes via email or through in-app notifications. Continued use of Vento after changes constitutes acceptance of the updated policy.