Privacy Policy

1. Who We Are (Data Controller)

EVE INC. ("EVE," "we," "us," or "our") is a company incorporated in Ontario, Canada, with its operational headquarters in Phuket, Thailand. We operate the EVE platform: a free, location-based social events and venue discovery service available as a mobile application (iOS and Android) and on the web at evephuket.com.

EVE INC. is the data controller responsible for your personal information.

• Privacy contact / Privacy Officer: [email protected]
• General contact: [email protected]
• Registered entity: EVE INC., Ontario, Canada

Under Quebec's Law 25, the person responsible for the protection of personal information at EVE can be reached at [email protected].

2. Scope

This Privacy Policy applies to all personal information collected through our mobile application, our website (including evephuket.com), and any other interactions you have with EVE, including customer support, social media, and marketing communications. It applies whether you are a regular user, a venue or business owner, or an event organizer using the platform.

3. Information We Collect

3.1 Information You Provide

• Account details: name, email address, phone number, date of birth, and profile photo
• Profile information: bio, interests, and social media links you choose to add
• Business and venue information you submit when claiming or managing a listing
• User-generated content: posts, reviews, comments, ratings, and photos
• Communications and support requests you send to us
• Payment and transaction data when you make purchases through the platform (processed by third-party payment providers; we do not store full card numbers)

3.2 Information Collected Automatically

• Usage data: pages and listings viewed, features used, search queries, and time spent
• Device data: IP address, device identifiers, browser type, and operating system
• Approximate and precise location data, only with your permission, to power location-based discovery (you can turn this off in your device settings at any time)
• Cookies and similar technologies (see our Cookie Policy)

3.3 Information From Third Parties

• Social login providers (Google, Facebook, Apple) when you choose to sign in with them, limited to the basic profile fields you authorize
• Event organizers and venue partners who list with us
• Analytics providers

4. How We Use Your Information

• Provide, maintain, personalize, and improve our services
• Surface relevant events, venues, and content near you
• Facilitate bookings, reservations, and account management
• Communicate with you about your account, events, and platform updates
• Send marketing communications, only with your consent, which you can withdraw at any time
• Detect, prevent, and address fraud, abuse, and security issues
• Comply with legal obligations and enforce our Terms of Use and Community Guidelines

5. Legal Bases and Purposes for Processing

We rely on the following legal bases, which apply under the GDPR, Thailand's PDPA, and equivalent provisions of Canadian law:

• Consent: for marketing communications, optional location tracking, and non-essential cookies
• Performance of a contract: to create your account and deliver the services you request
• Legitimate interests: to keep the platform safe, prevent fraud, and improve our services, balanced against your rights
• Legal obligation: where processing is required to comply with applicable laws

Where we rely on consent, you may withdraw it at any time, and withdrawing it is as easy as giving it. Withdrawal does not affect processing carried out before withdrawal.

6. How We Share Your Information

• Service providers / processors: hosting, authentication, analytics, email delivery, push notifications, and payment processing partners who act on our instructions
• Other users: your public profile, posts, reviews, and photos are visible to other users by design
• Event organizers and venue partners: when you interact with their events or listings
• Legal and regulatory authorities: when required by law, court order, or to protect rights, safety, and the integrity of the platform
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this policy
• Aggregated or de-identified data: which can no longer identify you

Our key processors currently include Google Firebase (authentication, database, storage), Amazon Web Services (media storage), our application hosting providers, and our transactional and marketing email and push-notification providers.

7. International Data Transfers

EVE operates across Canada and Thailand, and uses cloud infrastructure located in other countries. As a result, your personal information may be transferred to, stored in, and processed in countries other than your own, including Canada, the United States (Google Firebase and AWS), and Indonesia (application hosting), among others.

For users in Quebec and elsewhere in Canada, we assess privacy risks before transferring personal information outside the province or country and put appropriate contractual protections in place with our processors.

8. Data Retention

We keep your personal information only as long as necessary for the purposes described in this policy, then delete or de-identify it. Indicative retention periods:

• Account data: for the life of your account, then deleted within 30 days of account deletion (some records may be retained longer where law requires)
• User-generated content: until you delete it or close your account
• Transaction and tax records: as required by applicable tax and accounting law (typically up to 6 to 7 years)
• Fraud, safety, and abuse signals: up to 24 months to protect the platform
• Analytics and log data: typically up to 14 months in identifiable form
• Aggregated or de-identified data: may be retained indefinitely

9. Your Privacy Rights

Depending on where you live (Thailand, Canada, the EU, or elsewhere), you have some or all of the following rights:

• Access: obtain a copy of the personal data we hold about you
• Rectification: correct inaccurate or incomplete data
• Erasure / deletion: request deletion of your personal data
• Portability: receive your data in a structured, commonly used, machine-readable format
• Restriction and objection: limit or object to certain processing
• Withdraw consent: at any time, including for marketing and location tracking
• Complain: lodge a complaint with your data protection authority (in Thailand, the PDPC; in Canada, the Office of the Privacy Commissioner; in Quebec, the Commission d'acces a l'information)

The fastest way to delete your account and data is through our Account & Data Deletion page. For any other request, contact [email protected]. We respond within the timeframes required by applicable law and may need to verify your identity first.

10. Automated Decision-Making and Ranking

EVE does not make decisions that produce legal or similarly significant effects about you based solely on automated processing. We use ranking and recommendation logic to order events, venues, and feed content. These rankings are based primarily on relevance signals such as your selected location and proximity, category and interest relevance, recency and timeliness of the listing, and listing completeness and verification status. Paid placement does not move a listing up in EVE's rankings.

If a decision affecting you is ever made by exclusively automated means, you have the right to be informed, to know the personal information used, and to submit observations for review by a person.

11. Children's Privacy

EVE is not directed at children. You must be at least 18 years old, or the age of majority in your jurisdiction, to create an account. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will delete it promptly. If you believe a child has provided us with personal information, contact [email protected].

12. How We Protect Your Information

We use appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Access controls, authentication, and least-privilege practices
• Scoped credentials for our cloud infrastructure and regular security reviews

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal data breach that poses a real risk of significant harm, we will notify the relevant authorities and affected individuals as required by law, including, where the PDPA applies, notification to the PDPC without undue delay and where feasible within 72 hours.

13. Marketing and Communications

We send commercial messages (email and push notifications) only with your consent, in line with Canada's Anti-Spam Legislation (CASL) and other applicable rules. Every marketing email identifies us as the sender, includes a postal contact, and provides a working unsubscribe link that we honor promptly. You can opt out of marketing at any time without affecting service-related messages (such as security or account notices).

14. Third-Party Links and Services

Our platform may link to third-party websites, venues, and event pages. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated policy here and update the "Last Updated" date, and for material changes we will provide additional notice where required. Your continued use of EVE after changes take effect constitutes acceptance of the updated policy.

16. Contact Us

For any questions, concerns, or requests about this Privacy Policy or your personal information:

• Privacy Officer: [email protected]
• General: [email protected]
• Entity: EVE INC., Ontario, Canada