Privacy Policy

When you create an account and use Arcus, we collect:

Account & Identity:

• Email address and password for account creation

• Full name and display name

• Instagram handle (used as your username)

Contact Information:

• Phone number

• The first part of your postcode (e.g. "SE15"), as your general area

Demographics:

• Date of birth (used to confirm you are over 18 and to show organisers anonymised age ranges)

• Gender

Interests & Preferences:

• Training and activity preferences

• Marketing email preferences

Social & Activity Data:

• Friend/follow connections

• Event RSVPs, ticket purchases, and attendance history

• Check-in timestamps

• Referral relationships

Payment Data (for paid events):

• Transaction records (amount, date, ticket tier, payment status)

• Stripe payment reference IDs

• We do NOT store your card number, CVV, or full payment credentials — these are handled entirely by Stripe

Technical Data:

• Last active timestamps

We use your information to:

• Create and manage your account

• Enable event discovery, RSVPs, ticket purchases, and check-ins

• Connect you with other members and communities

• Improve app functionality and user experience

• Send important updates about events and features

• Maintain security and prevent fraud

When you RSVP to or purchase a ticket for an event:

• Your name and Instagram handle (your username) may be shared with the brand hosting the event

• For paid events, your email address and your ticket and payment status are also shared with the brand (your payment is processed through the brand's own Stripe account)

• This allows hosts to manage guest lists, check-in attendees, and handle event communications

Aggregated analytics:

• We provide hosts with aggregated, anonymised audience insights: age ranges, gender distribution, the most common areas attendees come from (by postcode district), and the most common interests

• These insights are shown only as totals and percentages — they never include your name, date of birth, full postcode, or any detail that identifies you individually

• We collect this demographic information on the basis of our legitimate interest in helping organisers understand their audience and improve future events; you can decline or update it in your profile settings

• This helps brands understand their audience and improve future events

When you RSVP to an event, a host may ask whether you would like to receive their marketing. This box is always unticked by default and is never required to RSVP — your RSVP succeeds whether or not you tick it.

If you tick the box:

• We share your name and email address with that brand so they can send you their own marketing and promotional emails

• That brand becomes the data controller for those messages — they decide what to send and run their own mailing list

• Arcus acts only as a facilitator (a processor) that captures your consent on the brand's behalf; we record exactly what you agreed to, when, and the privacy policy you were shown

• You can unsubscribe at any time using the 'unsubscribe' link in any email the brand sends you

If you don't tick the box:

• We do not share your contact details with that brand for marketing

• The brand cannot email you, and nothing happens to your RSVP

Arcus marketing (separate):

• Arcus marketing is a separate consent from any brand's — we never bundle the two together, because Arcus and the brand are two distinct data controllers

• If you opted in to Arcus marketing (at sign-up or in your settings), we'll send you occasional emails about Arcus events and updates

• You can turn Arcus marketing off at any time from your profile settings

How to withdraw each consent:

• Brand marketing: click the 'unsubscribe' link in any email from that brand — the brand is the controller and is required to honour your withdrawal and not re-add you

• Arcus marketing: switch off marketing emails in your profile settings

• Not ticking a host's box at your next RSVP means we won't share your details with that brand again — each event's consent is captured fresh and separately

Event Photography:

• Photographs, video and audio may be captured at events booked through Arcus

• These materials may be used for marketing and promotional purposes — on websites, apps, and social media — by Arcus, by the event organiser, and by any partner brands named on the event listing

• Wide, crowd and atmosphere shots are taken on the basis of the legitimate interests of Arcus and the organiser in promoting events; you will be notified by signage at the venue

• Where a recognisable individual is to be used in paid advertising, the organiser will seek separate consent

Opting Out:

• If you would prefer not to be featured, speak to a member of staff or a photographer at the event

• To request that an image is not used, or removed after the event, email support@arcusworld.xyz

• For images posted by an event organiser or brand on their own channels, please contact them directly

We use Supabase for:

• Database hosting and management

• User authentication and authorization

• File storage for event and brand imagery

• Real-time features and notifications

Supabase operates in compliance with GDPR and industry security standards. Your data is encrypted in transit and at rest.

We use Stripe for:

• Payment processing for paid event tickets

• Stripe Payments UK Limited is authorised by the Financial Conduct Authority

• Your card details are handled entirely by Stripe and never touch Arcus servers

• Payments go directly to the event organiser's Stripe account — Arcus does not hold your funds

• For more information, see Stripe's privacy policy at stripe.com/privacy

We also use:

• Resend — to send transactional emails (e.g. RSVP and booking confirmations); it receives your email address and the relevant event or order details

• Vercel — website hosting, analytics and performance monitoring

• Sentry — error and performance monitoring, including session replay on our website to help us diagnose issues

• Apple — if you choose "Sign in with Apple," Apple processes your name and email to authenticate you

We retain your information while your account is active. When you delete your account:

• Your profile and personal data are permanently removed

• Your RSVPs and guest-list entries are removed; payment records are kept for tax purposes with your personal details removed (see below)

• Some data may be retained for legal compliance (30 days)

Payment records:

• Transaction records (amounts, dates, payment references) are retained for 6 years after the transaction date, as required by HMRC for tax and accounting purposes

• This applies even if you delete your account

You can delete your account anytime from Settings.

You have the right to:

• Access your personal data

• Update or correct your information

• Delete your account and data

• Request a copy of your data (contact support@arcusworld.xyz)

• Opt out of marketing communications

Exercise these rights through your account settings or contact us.

We implement industry-standard security measures:

• Encryption in transit (TLS) and at rest

• Secure authentication with JWT tokens

• Ongoing security reviews and updates

• Access controls and monitoring

While we take security seriously, no system is completely secure. Please protect your account credentials.

Arcus is intended for users aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe we have collected data from a minor, please contact us immediately.

We may update this privacy policy periodically. We will notify you of significant changes through the app or email. Continued use after changes constitutes acceptance of the updated policy.

Last updated: June 2026