Skip to main content

HASHPASS Privacy Policy

Last updated: 25 September 2026
Controller: HASHPASS TECHNOLOGIES OÜ (Registry Code 17603547)
Registered office: Narva mnt 5, Tallinn, Estonia
Privacy contact: privacy@hashpass.tech

This Privacy Policy explains how HASHPASS TECHNOLOGIES OÜ ("HASHPASS", "we", "us", or "our") processes personal data when you use HASHPASS websites, applications, event pages, passes, credentials, Event Passport, organizer tools, and related services (together, the "Services").

Where the EU General Data Protection Regulation ("GDPR") applies, this notice is intended to provide the information required when personal data is collected. It should be read with the Terms of Service.

1. Roles and scope​

The controller for the processing described in this Policy is HASHPASS TECHNOLOGIES OÜ. For event-specific processing, an event organizer may be a separate controller and may provide its own privacy notice. In some business-to-business deployments, HASHPASS processes personal data for an organizer under a data-processing agreement. The applicable event page, agreement, or organizer notice identifies the relevant role where it differs.

This Policy does not govern independent third-party services, including organizers, venues, payment providers, ticketing providers, wallet providers, identity providers, social networks, and blockchain networks. Their terms and privacy notices apply to their own processing.

2. Personal data we collect​

Depending on how you use the Services, we may collect:

  • Account and authentication data: name, email address, phone number when used for SMS authentication, account identifiers, one-time-code and authentication records, and identifiers supplied by an identity provider.
  • Profile and optional content: profile information, an optional profile picture, and content you submit or import, such as event tickets, QR codes, confirmations, PDFs, invoices, images, URLs, and messages.
  • Wallet and blockchain data: public wallet addresses, transaction or credential references, and other information that is publicly available on a blockchain. We do not request, collect, or have access to private keys or seed phrases.
  • Event and credential data: registrations, passes, credentials, attendance and check-in records, event interactions, benefits, and related event information.
  • Invitation and access-review data: a campaign code submitted to request Business access, the associated campaign and event, request and review status, and the timestamps and account identifiers needed to prevent abuse and operate the review workflow. A printed invitation-link visit may record the code, time, device category, and bot classification. It does not record an IP address, cookie, referrer, or raw user-agent for this visit ledger.
  • Messages: sender and recipient identifiers and timestamps needed to deliver in-app messages. Content sent through supported end-to-end encrypted meeting chat is encrypted on your device so that HASHPASS cannot read that message content.
  • Technical and usage data: device, browser, operating-system, log, feature-use, and security information, and information generated through your interactions with the Services.

You may choose not to provide certain data. However, account, authentication, or event credential data may be necessary to provide the associated feature.

3. Why we use personal data​

We process personal data to:

  • provide, secure, maintain, and personalize the Services;
  • create and authenticate accounts and deliver passes, credentials, event registrations, check-in, and support;
  • validate invitation campaigns, prevent shared-link abuse, and allow a designated reviewer to approve or decline a requested Business entitlement;
  • communicate transactional, security, service, and legally required notices;
  • detect, investigate, and prevent fraud, abuse, security incidents, and misuse of credentials or APIs;
  • comply with legal, regulatory, accounting, tax, and record-keeping obligations; and
  • improve the reliability, performance, and accessibility of the Services, including through aggregated or appropriately anonymized analytics where permitted by law.

Where the GDPR applies, our legal bases are the performance of a contract or steps requested before entering one; our legitimate interests in operating, securing, and improving the Services; compliance with legal obligations; and your consent where required, such as for optional analytics or marketing. You may withdraw consent at any time without affecting processing that occurred before withdrawal.

4. Recipients and service providers​

We do not sell personal information. We disclose data only as needed for the purposes above, including to:

  • event organizers for events for which you register or hold a credential;
  • designated Business-access reviewers, only for the request information necessary to decide a submitted invitation request;
  • service providers acting on our behalf, including Supabase for authentication and database hosting, Brevo for transactional email, and AWS S3 and CloudFront for event and profile-image hosting and delivery;
  • professional advisers, authorities, or other parties where required by law, to protect rights or safety, or in connection with a corporate transaction; and
  • integrations that you choose to connect, subject to their own terms and privacy notices.

We require service providers that process data for us to handle it under appropriate contractual and security obligations.

5. International transfers​

Our providers and integrations may process data outside the European Economic Area. Where a transfer is subject to GDPR transfer rules, we use an adequacy decision, contractual safeguards, or another transfer mechanism recognized by applicable law. Google Analytics, if enabled with your consent, is provided by Google LLC; Google describes its applicable transfer safeguards in its Privacy Policy.

6. Retention​

We keep personal data only for as long as necessary for the purposes described in this Policy, including to maintain your account, provide the Services, resolve disputes, enforce agreements, and meet legal, tax, accounting, or fraud-prevention obligations. Routine backups may retain limited data for a limited period before deletion. We cannot erase information stored on a public or immutable blockchain that is outside our control.

Google Analytics data is retained for 14 months and then automatically deleted. See Cookies and analytics.

Invitation-link visit records and Business-access review records are retained only as needed to operate the invitation, prevent fraud or repeated misuse, maintain an audit trail, resolve disputes, and meet applicable legal obligations.

7. Security​

We use organizational and technical measures designed to protect personal data, including HTTPS/TLS encryption in transit and access controls appropriate to the Services. Supported event meeting chat uses end-to-end encryption based on X25519 key exchange, HKDF-SHA256, and XChaCha20-Poly1305. No internet transmission or storage system is completely secure; we therefore cannot guarantee absolute security.

We will notify affected parties and authorities about personal-data breaches where required by law or contract.

8. Your choices and rights​

Subject to applicable law, you may request access to, correction of, deletion of, restriction of, or portability of your personal data, or object to processing. You can delete your HASHPASS account from the app. Deletion is subject to the retention and immutable-blockchain limits described above.

To exercise a right or ask a privacy question, email privacy@hashpass.tech. We may ask for information necessary to verify your identity before responding. If the GDPR applies, you may also lodge a complaint with your local supervisory authority; in Estonia, this is the Estonian Data Protection Inspectorate.

9. Children​

The Services may be used by minors only where lawful and with any required parental or guardian authorization. Organizers may impose additional age-verification or attendance requirements.

10. Cookies and analytics​

We use essential cookies and similar technologies to provide authentication, security, and preferences. Disabling essential cookies may prevent you from signing in.

With consent where required, we use Google Analytics 4 to understand website usage, including pages visited, time on page, browser and device information, approximate city/country location, referral source, and interactions. We configure Google Analytics with IP anonymization. You can withdraw analytics consent through the applicable cookie controls or use Google's Analytics Opt-out Browser Add-on.

11. Changes to this Policy​

We may update this Policy to reflect changes to the Services, law, or our data practices. We will publish the updated version here and revise the "Last updated" date. Where required, we will provide additional notice or obtain consent.

12. Contact​

For privacy questions or requests, contact:

HASHPASS TECHNOLOGIES OÜ
Registry Code 17603547
Narva mnt 5, Tallinn, Estonia
privacy@hashpass.tech
contact@hashpass.tech