Off Pixel Ltd · operating Cirqlin
When you sign up for an event or launch through a Cirqlin page, we collect your email address, your phone number (if you choose to give it), and optionally a social media handle. Some pages also ask for your name, date of birth, or an age bracket — only if the promoter has specifically turned that question on for their page, and always optional even then. Your approximate city comes from your internet connection, not from you. We use these details for one purpose: to add you to the list of the promoter or creator you signed up with, so they can send you what you asked for (presale access, launch news, community invites, and — where that channel is used — event messages over WhatsApp). That promoter controls your data; we process it for them and for nothing else. We never sell it, never use it for our own advertising, and never share it beyond the services the promoter has connected. Your contact details are stored encrypted in the EU. To see, export, or delete your data at any time: privacy@cirqlin.com.
Cirqlin (accessible at cirqlin.com, app.cirqlin.com, and crqln.com) is a product of:
Off Pixel Ltd
Company number: 17045733
Registered office: 124-128 City Road, London, England, EC1V 2NX
Contact: privacy@cirqlin.com
Cirqlin provides signup pages, community routing, and first-access tools to event promoters, artists, and creators ("Promoters").
Two roles, stated plainly:
When you sign up on a Cirqlin page (as a fan):
| Data | Required? | Notes |
|---|---|---|
| Email address | Yes | |
| Phone number | No | International format; used for WhatsApp community routing where the Promoter runs one, and for WhatsApp Business Platform event messages where Cirqlin sends those on the Promoter's behalf |
| Social handle (Instagram or TikTok) | No | Only if you choose to add it |
| Name (optional, where the Promoter enables it) | No | Only asked if the Promoter has turned this question on for their page, and always optional even then |
| Date of birth (optional, where the Promoter enables it) | No | An exact date — only asked if the Promoter has turned this question on. Where enabled, it may be used to confirm you meet that event's own minimum-age requirement. |
| Age bracket (optional, where the Promoter enables it) | No | A broad range only (e.g. 18–24), never a date of birth — only asked if the Promoter has turned this question on, and always skippable. If you tell us you're under 18, we can't accept your signup for that event. |
| Approximate location (country, region, city) | Automatic | Derived from your connection at the moment of signup — never requested from you, never precise |
| Signup source and referral code | Automatic | e.g. which link brought you to the page |
| Consent choices | Yes | Whether you ticked the mailing-list box |
| Technical data (IP address, browser type) | Automatic | Used transiently for security, bot protection, and rate limiting; the IP address is not stored with your signup record |
Information provided about you by the Promoter (ticket records). Where a Promoter uploads their ticketing records to analyse their own events, we process on their instructions: your email address, ticket type, ticket price and quantity, and order date, relating to events you bought tickets for. This information comes from the Promoter (typically an export from their ticketing provider), not from you. It is encrypted at rest in the same way as signup data, is used solely to provide that Promoter with analytics and segments about their own audience, and is never combined across different Promoters. The Promoter is responsible for ensuring they may lawfully provide it; your rights in Section 8 apply to this data equally.
Name and date of birth are never required by default — a page only asks for them if the Promoter has specifically enabled that optional question. Where enabled, both are encrypted at rest with the same treatment as your email and phone, and neither is ever used to match or link your identity across different events or Promoters (see Section 3) — only email and phone serve that purpose. We do not collect payment details; ticket purchases happen on the ticket seller's own site, under their terms.
When you create a Promoter account: email address, authentication data, organisation name, and the settings and credentials you add.
Fan data is used solely to deliver the service the Promoter has configured:
What we never do with fan data: sell it; rent it; use it for our own marketing or advertising; combine it across different Promoters; use it to train machine-learning models; or process it for any purpose beyond providing the service.
Automated decision-making: we do not make automated decisions about you that produce legal effects or similarly significantly affect you. Aggregate statistics shown to Promoters (signup counts, locations, referral counts) do not identify you beyond what you submitted.
The Promoter you signed up with — they control the data and can view, export, and manage it.
Our sub-processors (services we use to run Cirqlin):
| Service | Purpose | Location |
|---|---|---|
| Supabase (on AWS) | Database and storage — your contact details are encrypted at rest | Ireland (EU) |
| Vercel | Application hosting and delivery | EU/global edge |
| Cloudflare (Turnstile) | Bot protection on signup forms | Global |
| Resend | Transactional email for Promoter accounts (not used to email fans) | EU |
Services the Promoter may connect (data flows to these only if the Promoter has enabled them, acting on the Promoter's instructions):
| Service | What is shared |
|---|---|
| Mailchimp (Intuit) | Your email, phone, and city, added to the Promoter's audience |
| Bird | Your phone number, added to the Promoter's contact list |
| Meta (WhatsApp Business Platform) | Your phone number and the content of event messages Cirqlin sends on the Promoter's behalf via WhatsApp; delivery receipts and inbound replies on that channel. Numbers used for these sends are operated by Cirqlin for this purpose today — not each Promoter's own WhatsApp number. |
| Meta (Conversions API) | A hashed signup event for advertising measurement |
| TikTok (Events API) | A hashed signup event for advertising measurement |
Each of these operates under its own privacy policy.
Fan contact details (email and phone) are encrypted at rest using symmetric encryption, in a database hosted in Ireland (EU). Where Cirqlin sends WhatsApp Business Platform messages on a Promoter's behalf, recipient phone numbers, message content, delivery receipts, and inbound replies on that channel are likewise encrypted at rest (under a dedicated encryption key, separate from other contact storage). Access is restricted by tenant-isolation controls; every export or unmasking of contact data by a Promoter is logged. Data in transit is protected by TLS. Please note that ordinary email is not a fully secure transmission method; anything you send us by email is at your own risk.
If a personal data breach affects your data, we will notify the responsible Promoter without undue delay so they can meet their obligations to you, and we will notify you and regulators directly where the law requires us to.
Cirqlin pages are not intended for children. We do not knowingly collect data relating to anyone under 16, and Promoters are prohibited from using Cirqlin to do so. If you believe a child's data has been submitted, contact privacy@cirqlin.com and we will delete it.
We retain fan data for as long as the Promoter uses Cirqlin to run their audience, or until the Promoter deletes it or instructs us to. If a Promoter's account is closed, associated fan data is deleted within 30 days. You can request deletion directly at any time (Section 8) — where we act as processor we will notify the Promoter and act on their instruction or, where required by law, act directly.
Under UK and EU data protection law you have the right to access, correct, export, delete, and object to the processing of your personal data, and to withdraw consent.
The public signup pages set no advertising cookies of our own. We use strictly necessary session cookies on the Promoter dashboard (app.cirqlin.com) for login. Cloudflare Turnstile may set a functional cookie for bot protection. Where a Promoter has enabled a Meta or TikTok pixel on their page, those platforms may set cookies under their own policies — the Promoter is responsible for the lawful configuration of these tools.
Data is stored in the UK/EEA. Where a connected service (Section 4) transfers data outside the UK/EEA, those transfers are governed by that provider's safeguards (such as the UK IDTA or EU Standard Contractual Clauses).
We will post updates to this policy here, with the date above. Material changes affecting fan data will be communicated to Promoters, who are responsible for informing their audiences where required.
privacy@cirqlin.com · Off Pixel Ltd, 124-128 City Road, London, England, EC1V 2NX