Privacy Policy

• —This policy applies to personal information we process when you visit scoop.ai, use the assistant with or without an account, submit messages and queries, receive AI-generated results, or otherwise interact with the Service. It does not cover the practices of third-party ticket sellers, model providers, or data sources, each of which has its own policies. When you click through to a third-party seller, that seller's privacy policy governs that transaction.
• —Geographic scope. The Service is intended for and directed to users in the United States and Canada, and is hosted in the United States. We do not target or offer the Service to residents of the European Union, the United Kingdom, or the EEA. If you access the Service from outside the United States or Canada, you do so on your own initiative and are responsible for compliance with your local laws.

We collect the following categories of personal information:

• —Account information (if you create an account). Your name, email address, and a securely hashed password; or, if you sign in with Google, your Google profile information (we request only your basic profile and email). Email verification, where offered, is used as a signal and does not by itself control sign-in.
• —Your conversations. The messages you send the assistant and the responses it returns, together with related conversation history. Conversations you start before signing in are linked to your browser and are connected to your account when you sign in.
• —Approximate location. A city, region, and country estimated from your IP address using a database stored on our own servers. Your IP address is not sent to a geolocation provider, and we do not access precise device location.
• —Device and usage data. A random device identifier stored in your browser; session data including your IP address and browser type; the pages you visit; product interactions (such as clicks and page views, including page URLs), collected through our product-analytics provider; and error reports.
• —Purchases. Ticket checkout is not currently available through Scoop. If we launch checkout, we will collect the information needed to place an order (such as name, email, and order details); payment would be handled by our ticketing partner, not by Scoop, and we will update this policy at that time.
• —Cookies and similar technologies. Identifiers used for sign-in sessions, your device identifier, and analytics, as described in our Cookie Policy. We do not use advertising or cross-site marketing trackers.
• —Payment data. We do not currently charge users for the Service, and we do not collect or store payment-card data.

We do not intentionally collect special-category or sensitive personal information, precise device location, biometric data, or date of birth, and we ask that you not submit sensitive information in your messages.

We use personal information to:

• —provide, operate, and maintain the Service, including running the assistant, recommending nearby events, and saving your conversations and preferences;
• —operate the AI features of the Service, as described in Section 4;
• —keep the Service secure, including managing sessions and applying abuse and rate limits;
• —understand how the Service is used and diagnose and fix problems, through our product-analytics provider;
• —send service and transactional communications (for example, sign-in verification, password reset, and email-change messages);
• —use conversation and usage data to evaluate, improve, and develop the Service, including, where permitted, to train or fine-tune models; and
• —comply with legal obligations and enforce our agreements.

We do not currently send marketing or promotional communications. If we introduce them in the future, we will obtain any consent required by law (including opt-in consent where required) and include a way to unsubscribe.

• —When you use the assistant, your messages (along with related conversation history and your approximate city and region) are sent to third-party large-language-model providers to generate responses. This traffic is routed through a single AI gateway that we use to log, secure, and apply safeguards to AI requests. Search terms derived from your messages may also be sent to a third-party web-search provider to find events and tickets. The specific providers we use are identified in our Subprocessor and Third-Party Disclosure List.
• —Whether a provider uses your data to train its own models depends on that provider's terms and the arrangement we have with it.

We use a third-party product-analytics provider, hosted in the United States, to understand how the Service is used and to diagnose errors. It automatically captures product interactions such as clicks and page views (including page URLs) and captures error reports. We also use this provider's session recording feature, which captures a replay of how you interact with the Service — such as pages viewed, clicks, scrolling, and navigation — to help us understand usability and diagnose problems. When you sign in, we share your name and email address with this provider as account properties. Analytics and session recording run whenever you use the Service; we do not currently offer an analytics opt-out or a cookie-consent banner.

To recommend events and surface ticket information, the Service retrieves event, venue, performer, and ticket data (such as prices, availability, schedules, descriptions, and images) from third-party data sources and enrichment providers. This retrieval is generally performed on our servers using event and venue names, and does not involve sending your account information to those sources. The categories and named sources are listed in our Data Source Attribution and Licensing Notice.

• —We retain your account information and conversations for as long as your account exists. Conversations you start without an account remain linked to your browser's device identifier. Server logs are kept for a short period (currently about 30 days).
• —We are developing tools that will let you delete your data and will set defined retention periods; until those are in place, you can ask us to delete your account or provide a copy of your data as described in Section 9. We may retain information where required by law, to resolve disputes, or to enforce our agreements.

We do not sell your personal information. We share it only as described below, and the specific vendors are named in our Subprocessor and Third-Party Disclosure List:

• —Hosting provider (United States) — stores and processes all Service data on our behalf.
• —AI gateway and AI model providers — receive your messages and conversation context to generate responses, as described in Section 4.
• —Web-search provider — receives search terms derived from your messages to find events and tickets.
• —Product-analytics provider (United States) — receives usage events, your device identifier, and, when you are signed in, your name and email, as described in Section 5.
• —Transactional email provider — receives your email address and name to send account and security messages.
• —Ticketing partner — if and when checkout launches, will receive the information needed to fulfill your order (such as name, email, and order details).
• —Maps providers — your browser connects directly to map providers to display maps, and they receive your IP address as with any web resource.
• —Legal and safety — we may disclose information to comply with law, subpoena, or lawful government request; to enforce our Terms; or to protect the rights, safety, and property of Scoop, our users, or the public.
• —Corporate transactions — in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
• —Sale or sharing under U.S. state laws. Because we use product analytics, some U.S. state laws may treat certain analytics as a "sale" or "sharing." We do not use advertising trackers. To the extent a state-law right to opt out applies, contact us as described in Section 9.

• —You can update your name, email, and password at any time in your account settings.
• —Depending on where you live, you may also have rights to access, correct, delete, or receive a copy of your personal information, to opt out of any sale or sharing (we do not sell your information), and, where provided by applicable law (for example, Québec Law 25 or Canadian privacy law), to object to or restrict processing or withdraw consent. We will not discriminate against you for exercising these rights.
• —How to submit a request. Because in-product deletion and export tools are still in development, please email privacy@scoop.ai with your request and the email associated with your account. We will verify your identity using reasonable measures and respond within 30 days (or sooner where required by law). You may use an authorized agent where the law allows.
• —Appeals and complaints. If we decline a request, we will explain why, and, where applicable, you may appeal or lodge a complaint with your state Attorney General, the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec.

• —We use technical and organizational measures designed to protect personal information, including: encryption in transit (TLS) on all public connections and encryption at rest for all data stores using our cloud provider's managed keys; databases on a private network with no public IP addresses; least-privilege access using keyless workload authentication and centralized secrets management; separation of identity data from conversation data; production changes deployed only through reviewed code and human-approved releases; and a single audited gateway for all AI traffic with automated detection safeguards. We design our systems to keep conversation content, email addresses, and raw IP addresses out of our operational logs.
• —No method of transmission or storage is completely secure, and we cannot guarantee absolute security. See our Security and Compliance page for more detail. If a breach affecting your personal information occurs, we will notify you and regulators as required by applicable law (including applicable U.S. state and Canadian breach-notification laws).

Scoop is hosted in the United States, and we and our service providers process personal information in the United States and in other countries where our providers operate. Because the Service is directed to the United States and Canada and is not offered to EU or UK residents, we do not rely on EU or UK cross-border data-transfer mechanisms. The locations where our providers process data are described in our Subprocessor and Third-Party Disclosure List.

The Service is intended for adults 18 and older (see our Terms). We do not knowingly collect personal information from anyone under 18, and in no case from children under 13. If you believe a minor has provided us personal information, contact privacy@scoop.ai and we will delete it.

We may update this policy from time to time. If we make material changes, we will provide notice by reasonable means (posting the updated policy on scoop.ai and/or notifying you through the Service or by email) and update the "Last updated" date. Your continued use of the Service after the effective date means you accept the updated policy.

Questions or privacy requests may be directed to Scoop Tickets, Inc. at 1321 Upland Drive, Suite 1906, Houston, TX 77043, USA, or privacy@scoop.ai.