Privacy Policy

1. Scope and Roles

This policy applies when TruEXP determines how and why personal information is processed. TruEXP may process personal information in different roles. For many experiences, TruEXP provides technology to an independent organizer, host, venue, brand, community, or client and may process information on that partner’s behalf under a separate agreement. In other situations, TruEXP or an affiliate may organize, host, co-produce, sponsor, or operate an experience and determine the purposes and means of processing. The applicable event page, notice at collection, or supplemental privacy notice will identify the relevant organizer and, where practical, the parties’ roles. A partner may provide its own privacy notice and may be responsible for some privacy requests.

This policy does not govern third-party websites, wallets, social platforms, identity providers, or applications that operate under their own privacy policies.

2. Information We Collect

2.1 Account and Contact Information

• Name, username, display name, profile image, email address, phone number, mailing address, date of birth or age range where needed, and communication preferences. • TruEXP account identifiers, provisional identifiers, Auth0 subject identifiers, login provider, account status, recovery and security settings. • Business contact details, organization, role, authority, billing contacts, and account permissions.

2.2 Third-Party Identity and Connected-Service Information

• Identifiers and account status received from services you use to authenticate or connect, such as Auth0, Glyph, Privy, Apple, Google, X, Spotify, Instagram, and other supported providers. • Linked-account indicators, authorized profile fields, public handles, profile images, content, permissions, or metadata made available through the connection you approve. • Authentication events, token or session metadata, issuer, timestamps, scopes, and connection status. TruEXP does not receive your third-party password from standard OAuth or social-login connections.

2.3 Wallet, Blockchain, and Digital-Asset Information

• Public wallet addresses, wallet type, network or chain, smart-contract address, token ID, collection, quantity, ownership or eligibility status, delegation status, and verification timestamp. • Glyph or other provider account identifiers, wallet relationships, verification results, and event-specific status showing whether an account, wallet, or asset is available, reserved, used, consumed, previously claimed, or associated with a TruEXP account. • Wallet signatures or challenge results used to verify control, where applicable. We do not request or collect private keys or seed phrases. • Public blockchain data, which may remain publicly available and immutable independently of TRUEXP.

2.4 Event, RSVP, Ticket, Stub, and Participation Information

• Eligibility outcome, reservation, RSVP, waitlist, guest, capacity, claim, ticket, check-in, attendance, scan, redemption, and digital-stub records. • Selected digital asset, profile image, artwork, or personalization used to customize a ticket or stub. • Event communications, invitations, referrals, rewards, offers, feedback, survey responses, support interactions, and participation history. • Venue or organizer-provided attendance, access, purchase, membership, or other experience information where integrated.

2.5 Transactions and Commercial Information

• Products, services, tickets, merchandise, memberships, subscriptions, rewards, offers, purchases, redemptions, refunds, and transaction history. • Payment-related information processed by payment providers. TruEXP may receive transaction status, billing name, last four digits, card brand, or related records but generally does not store full payment-card numbers.

2.6 User Content and Community Information

• Posts, comments, messages, photos, videos, reviews, profile content, event content, reactions, invitations, community memberships, and other content you submit. • Reports, moderation actions, safety records, and communications with support.

2.7 Device, Usage, and Technical Information

• IP address, device and browser type, operating system, app version, language, time zone, identifiers, crash logs, performance data, referral source, pages and screens viewed, clicks, session duration, and feature interactions. • Cookies, SDKs, pixels, local storage, and similar technologies. • Approximate location inferred from IP address and precise location only when requested, disclosed, and permitted by you. • Push-notification tokens, delivery status, and notification interactions.

2.8 Security, Fraud, and Continuation Information

• Nonce, state, challenge, continuation, invitation, recovery, or one-time token records; token hashes; expiration and redemption status; device or session association; and audit logs. • Signals used to detect duplicate claims, account conflicts, fraud, abuse, unauthorized access, manipulated credentials, or policy violations.

2.9 Inferences and Analytics

• Segments, preferences, engagement indicators, likely interests, relationship or participation trends, and other inferences derived from interactions with the Services. • Aggregated or de-identified statistics concerning events, audiences, products, communications, and platform performance. • Where required, we will provide additional notice or choices before using personal information for materially different or sensitive automated decision-making.

2.10 Sensitive Personal Information

Depending on the feature and jurisdiction, certain information may be considered sensitive, such as precise location, account credentials, government ID, racial or ethnic origin reflected in voluntarily provided content, or other legally defined categories. We seek to collect sensitive information only when reasonably necessary, with appropriate notice and safeguards.

3. Sources of Information

• Directly from you. • Automatically from your device and use of the Services. • From Auth0 and login providers you select. • From Glyph, Privy, wallets, blockchain networks, RPC providers, delegation services, and digital-asset verification providers. • From organizers, venues, brands, communities, ticketing, point-of-sale, customer-relationship, messaging, membership, and other business partners. • From connected services such as Spotify, Instagram, X, Apple, Google, or other services you authorize. • From public sources, including public blockchain records and public social profiles. • From service providers, analytics, security, fraud-prevention, and support vendors. • From other users, such as invitations, referrals, tags, reports, or guest registrations.

4. How We Use Personal Information

4.1 Provide and Operate the Services

• Create, authenticate, secure, maintain, and recover accounts. • Create provisional TruEXP identities and connect them to authenticated accounts. • Verify eligibility, wallet control, asset ownership, membership, identity, and prior-use status. • Manage reservations, RSVPs, waitlists, claims, tickets, digital stubs, check-in, attendance, access, and event communications. • Personalize profiles, tickets, stubs, content, recommendations, and connected experiences. • Provide business dashboards, administration, analytics, integrations, support, and service communications.

4.2 Security, Integrity, and Fraud Prevention

• Prevent duplicate claims, unauthorized transfers, account takeover, bot activity, fraud, abuse, and security incidents. • Maintain event-specific consumed-asset or prior-use records. • Investigate disputes, recover accounts, enforce terms and event rules, and protect users, partners, TRUEXP, and the public.

4.3 Analytics, Improvement, and Research

• Measure feature use, event participation, communications, retention, performance, and reliability. • Debug, test, monitor, develop, and improve products, including early-access features. • Create aggregated or de-identified analytics and benchmarks. • Understand audience and relationship trends and help authorized partners evaluate and improve experiences.

4.4 Communications

• Send security, account, RSVP, ticket, event, support, policy, and service notices. • Send marketing or promotional communications where permitted and according to your choices. • Administer surveys, feedback, promotions, rewards, and invitations.

4.5 Legal and Business Purposes

• Comply with law, legal process, tax, accounting, insurance, audit, and regulatory requirements. • Establish, exercise, or defend legal claims. • Evaluate or complete a merger, financing, acquisition, restructuring, bankruptcy, or sale. • Enforce agreements and protect rights, safety, and property.

5. How We Disclose Personal Information

5.1 Service Providers and Contractors

We disclose information to vendors that provide authentication, hosting, databases, analytics, communications, push notifications, customer support, security, fraud prevention, blockchain data, wallet verification, app distribution, payment processing, and professional services. Examples may include Auth0/Okta, Apple/TestFlight, Glyph/Privy, OneSignal, cloud providers, analytics providers, and support tools.

5.2 Event Organizers, Venues, Brands, and Business Partners

We may disclose information reasonably necessary to administer an event or relationship, such as identity, contact information, eligibility status, reservation or ticket status, selected profile or asset, check-in, attendance, engagement, support, transaction, and fraud-prevention information. Partners may use information according to their own notices and agreements.

5.3 Connected Services and User-Directed Disclosures

When you connect or interact with a third-party service, we disclose information according to your instructions and the permissions shown in the connection flow.

5.4 Legal, Safety, and Security

We may disclose information to comply with law or legal process; respond to lawful requests; protect rights, safety, property, and security; investigate fraud or abuse; or enforce agreements.

5.5 Corporate Transactions

Information may be transferred as part of an actual or proposed merger, financing, acquisition, restructuring, bankruptcy, sale, or transfer of assets, subject to applicable law.

5.6 Aggregated and De-identified Information

We may use and disclose aggregated or de-identified information that cannot reasonably be linked to an individual. We will not attempt to reidentify information that we maintain as de-identified, except as permitted to test de-identification processes.

6. Sale, Sharing, and Targeted Advertising

TruEXP does not sell personal information for money. Some laws define “sale,” “sharing,” or “targeted advertising” broadly to include certain disclosures for cross-context behavioral advertising or analytics.

We do not sell or share personal information for cross-context behavioral advertising and do not process personal information for targeted advertising.

We process recognized opt-out preference signals, including Global Privacy Control, where required and technically applicable.

7. Cookies, SDKs, and Similar Technologies

We use essential, functional, analytics, security, and, if enabled, advertising technologies. These technologies support authentication, preferences, fraud prevention, performance, analytics, communications, and marketing measurement.

Choices may include browser settings, device permissions, cookie controls, account preferences, unsubscribe links, and legally required opt-out mechanisms. Disabling essential technologies may prevent parts of the Services from working.

8. Legal Bases for Processing Outside the United States

Where applicable, we process personal information based on contract performance, legitimate interests, legal obligations, vital interests, and consent. Legitimate interests may include providing and improving the Services, securing accounts, preventing fraud, supporting events, and understanding product use. You may withdraw consent where processing is based on consent, without affecting prior lawful processing.

9. Data Retention

We retain personal information only as long as reasonably necessary and proportionate for the purposes described, including account operation, event administration, user expectations, security, fraud prevention, dispute resolution, legal obligations, and business records.

We may retain information longer when necessary for legal claims, investigations, fraud prevention, safety, or legal obligations, and may retain de-identified information without limitation.

10. Security

We use administrative, technical, and organizational safeguards designed to protect personal information, such as access controls, encryption in transit and where appropriate at rest, logging, monitoring, vendor review, authentication controls, incident response, and data minimization.

No system is completely secure. You are responsible for protecting your credentials, devices, wallets, and recovery methods and for reviewing wallet prompts before signing.

11. Your Choices

• Update account and profile information through available settings. • Manage marketing, email, SMS, and push-notification preferences. • Disconnect optional integrations where supported. • Control device permissions, cookies, and browser settings. • Request access, correction, deletion, portability, restriction, or objection where applicable. • Opt out of sale, sharing, targeted advertising, or certain profiling where applicable. • Appeal a denied privacy request where applicable.

We may need to verify your identity before fulfilling a request. We may deny or limit requests where permitted, including when we cannot verify identity, the request would affect another person’s rights, or an exception applies.

12. U.S. State Privacy Rights

Residents of California and other U.S. states may have rights to know or access personal information, correct inaccuracies, delete information, obtain portability, opt out of sale, sharing, targeted advertising, or certain profiling, limit certain uses of sensitive personal information, and receive equal service.

Submit requests through your account settings or privacy@truexp.com. Authorized agents may submit requests where permitted. We will respond within applicable timeframes and provide an appeal method where required.

13. California Privacy Disclosures

For California residents, the categories below describe personal information collected during the preceding 12 months and reasonably expected to be collected. The exact categories depend on the Services used.

We do not knowingly sell or share personal information of consumers under 16 without the legally required authorization.

14. Notice at Collection

At or before collection, TruEXP may provide a shorter Notice at Collection identifying the categories collected, purposes, retention approach, and sale/sharing status, with a link to this policy. Integration-specific or just-in-time notices may be shown before Glyph verification, wallet connection, precise location, contacts, photos, Spotify, Instagram, or other optional data access.

15. Children and Minors

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 without legally required parental consent. Events or features may impose a higher age requirement. If you believe a child provided information improperly, contact privacy@truexp.com.

16. International Transfers

Information may be processed in the United States and other countries where TruEXP or its providers operate. Where required, we use appropriate safeguards such as contractual protections, adequacy decisions, or other approved transfer mechanisms.

17. Third-Party Services

Third-party services collect and use information under their own privacy policies. Depending on features used, these may include Auth0/Okta, Apple/TestFlight, Glyph/Privy, Google, X, Spotify, Instagram, OneSignal, wallet providers, blockchain networks, analytics providers, and organizers. Review their notices before connecting.

18. Changes to This Policy

We may update this policy to reflect changes in law, technology, vendors, features, or practices. We will post the revised policy, update the effective date, and provide additional notice of material changes where required.

19. Contact Us

TruEXP

Privacy email: privacy@truexp.com

Legal email: legal@truexp.com