Privacy Policy
Effective October 23, 2026
What we collect, why we collect it, who sees it and how long we keep it. We do not sell personal data, and we never will.
When enabled, Dalytics measures visits and selected actions on our public discovery pages without analytics cookies. We exclude account, checkout, payment and ticket pages, and do not send form contents, search terms or referring URLs. We honor your browser’s Do Not Track and Global Privacy Control signals. This measurement does not affect your ability to use KHEvents.
1. What we collect
tl;drYour details, your orders, your payment proof, and your device.
Account details (name and email), order and ticket records, and support correspondence. Payments are live: for KHQR payments through Bakong we receive payment-confirmation metadata, never your bank credentials; when card or ABA payments are offered through ABA PayWay, we receive the payment status, amount and transaction reference from ABA Bank, never your card number or bank credentials; for manual bank transfer we collect the receipt image you upload and the details you submit with it — the amount you say you transferred, the transaction reference, the bank name and the payer name — to verify the payment. On the web you may also give a phone number at checkout; the mobile app does not ask for one. The mobile app registers your device's push notification token, through Apple, Google or Expo's push service, to deliver ticket and event notifications, and sends us crash and performance diagnostics if something goes wrong. We also collect device and usage data. If you organize events, we also collect business and payout details required by law.
2. Why we collect it
tl;drTo issue tickets, admit you, get organizers paid, and stop fraud.
We process data to provide the service (issuing tickets, check-in, payouts), to comply with legal and tax obligations, to prevent fraud and abuse, to provide support, and — only with your consent — to send you marketing.
3. What organizers see
tl;drYour name, email and ticket type — plus your payment proof if you pay by bank transfer.
When you buy a ticket, the organizer receives your name, email, ticket type, check-in status, and your phone number if you gave one at checkout, so they can run their door and contact you about the event. If you pay by manual bank transfer, the organizer's owners and admins who review that payment also see the receipt image, the amount you declared, the transaction reference, the bank name and the payer name you submitted, to verify it; they never receive your bank login or card details. Organizers are independent controllers of that data and bound by our organizer terms.
4. Who else we share with
tl;drOur infrastructure and service providers, and authorities when required.
Cloud hosting and email delivery providers under data-processing agreements; Cloudflare, which renders your ticket PDFs; Expo's push notification service, which delivers app notifications to your device; Sentry, which receives crash and performance diagnostics from the mobile app so we can fix problems — your email and phone number are masked before anything is sent, and reports are linked only to your account id, never your name or contact details; Dalytics, which counts visits to our public pages such as event listings and help articles — it sets no cookies, receives the page address with any search terms or codes removed, which kind of link was clicked and, as with any web request, your IP address, but never your account or anything you type, and receives nothing at all if your browser sends Do Not Track or Global Privacy Control; payment processing via Bakong and participating banks for KHQR payments and manual bank transfers; ABA Bank's PayWay service, when card or ABA payments are offered, which processes those payments and receives the order amount and a transaction reference from us; Anthropic, our AI provider, as a processor in two cases only — when an organizer imports an event programme, speaker list or FAQ from a document, the content of that document (text, PDF or image) is sent to Anthropic to be read into the event, and, only where receipt checks are switched on, the image of a bank-transfer receipt you upload is sent to Anthropic to read the amount, date, transaction references, bank, and the receiving account's name and number; Anthropic processes this content under its commercial terms, which do not allow it to train its models on it; and law enforcement or regulators where we are legally required. We do not sell personal data or share it for third-party advertising.
5. How long we keep it
tl;drAccount data until you delete your account; financial records seven years.
Account and profile data is retained while your account is open. Deleting your account in the app is permanent and immediate: your account, profile and registered devices are deleted straight away and cannot be recovered. Order, transaction and tax records are kept for seven years as required by Cambodian law, because we must be able to account for money that moved through the platform. Bank-transfer receipt images, and the amount, transaction reference, bank name and payer name submitted with them, are kept with the order as part of its payment record. If receipt checks are switched on, what was read from your receipt is kept with it as a hint for the organizer's reviewer — the amount, date, references, bank and payee name, and only the last four digits of the receiving account number, never the full number. A receipt check never approves or rejects a payment: a person reviewing the order always decides. When you delete your account we remove your name, email address and phone number from those records, delete the receipt images you uploaded and the payer name submitted with them, and keep only the amounts, dates, references and tickets. Support conversations are kept for 24 months. Analytics data is aggregated after 14 months.
6. Your rights
tl;drAccess, correct, export or delete — just ask.
You can access and correct your data and delete your account in your account settings. You can also ask us for a copy of your data and orders, withdraw marketing consent at any time, and request deletion of other records we hold. Deletion requests are honoured except where we must retain records for legal or tax purposes. Email [email protected] and we respond within 30 days.
7. Security
tl;drEncrypted in transit and at rest; random ticket tokens.
Data is encrypted in transit and at rest. Ticket QR codes carry a random, single-purpose token rather than any personal data. Access to production data is restricted, logged and reviewed. We run regular security reviews and will notify you and the authorities of a qualifying breach without undue delay.
8. Children
tl;drNot for under-16s.
KHEvents is not intended for children under 16. If we learn we hold data on a child under 16 without parental consent, we delete it.