Who owns the data?
For everything collected in your Site (tickets, attendees, invites, referrals, messages, analytics), you are the data controller. BASH is your processor and acts only on your instructions.
What BASH does as processor
We host your Site, collect data you configure, secure it, and provide export and deletion tools. We do not sell or share your audience with other organisers.
Exports & deletion
You can export attendees, orders, invites and engagement (CSV/API). You can delete a single person, an event, or all data when you leave. Retention controls are available.
Cookies & consent
Your Site: you decide analytics/marketing cookies and the consent text. We supply the banner, per-purpose toggles and an exportable consent log.
BASH platform: we set strictly-necessary cookies for security, sessions and basic service analytics under BASH’s privacy notice.
Tip: Add BASH as your processor in your privacy notice and keep your consent categories clear and minimal.
Optional: saved profiles
If a guest opts to save a profile to reuse details across organisers, BASH is controller for that account data. Their relation to you remains under your control.
Contact
Questions on your event data: your organisation’s privacy contact.
Platform/account privacy: privacy@bash.social.