Privacy Policy

Last updated: 17 July 2026

Experience Creator (Pty) Ltd trading as EventStack ZA (“EventStack”, “we”, “us”) is committed to protecting personal information in accordance with the Protection of Personal Information Act, 2013 (POPIA). This policy explains what we collect, how we use it, who we share it with, and the rights available to you.

Our two roles under POPIA

• As responsible party: for information we collect about our own website visitors, waitlist sign-ups, and the account holders and team members who use the platform.
• As operator: for the information that customer companies load into the platform about their clients, contacts, storefront enquirers and buyers, events and quotes. We process that data on the customer’s instructions; the customer company remains the responsible party for it and is responsible for having a lawful basis to provide it to us.

Information we collect

• Waitlist details: name, company, email address and WhatsApp number you submit, plus the source/UTM of your visit.
• Account & team data: name, email, role and authentication details for users we create, and your company profile (trading name, VAT number, address, logo, banking details for invoicing).
• Customer-entered data: details of your clients and contacts, events, inventory, quotes and invoices that you capture in the platform.
• E-signature data: when a client accepts a quote we record the typed name, drawn signature image, timestamp and the signer’s IP address as evidence of acceptance.
• Storefront enquiries and purchases: when you submit a hire enquiry, sale enquiry or “buy now” purchase on a company’s public storefront, the name, email address, phone number, requested items/dates and any message you provide are stored in that company’s account. That company is the responsible party for this information; we process it as their operator.
• Payment data: deposit, invoice and storefront payments are processed by PayFast. We receive payment confirmations and reference numbers; we do not collect or store card or banking credentials - those are handled by PayFast.
• Subscription billing data: the plan, add-ons, billing period, amounts and PayFast payment references for your EventStack subscription.
• Technical & usage data: log data, device and browser information, and basic analytics used to operate and improve the service.

How we use it

• To provide, secure and support the platform and its features.
• To generate and deliver quotes, invoices and transactional emails (for example, a quote link or a payment receipt).
• To draft quote suggestions using AI assistance where you choose to use that feature.
• To contact waitlist sign-ups about early access and updates.
• To comply with our legal and tax obligations.
• We never sell your personal information.

Who we share it with

We use a small number of trusted sub-processors to run the service. Each only receives the data needed for its function:

• Supabase: database, authentication and file storage.
• Vercel: application hosting and delivery.
• Resend: sending transactional and notification email.
• PayFast: payment processing for deposits and invoices.
• Anthropic: AI assistance for drafting quotes (only the content you submit for a draft is processed).

CrossHire. Where a customer company opts in to the CrossHire network, selected inventory listings and hire-request details are deliberately shared with other companies on the network to enable cross-company hires. Only the data necessary for a listing or request is shared.

Cookies

We use only essential cookies: the session cookies needed to keep you signed in securely. We do not use advertising cookies or third-party tracking cookies. Because these cookies are strictly necessary for the Service to work, they cannot be switched off while using it.

Cross-border processing

Some of our sub-processors store or process data on servers outside South Africa. Where this happens we take reasonable steps, as required by section 72 of POPIA, to ensure the recipient is subject to laws or agreements providing an adequate level of protection.

How long we keep it

We retain personal information for as long as your account is active or as needed to provide the service, and thereafter only as required to meet legal, tax and accounting obligations (for example, retention of tax invoices), after which it is deleted or de-identified.

How we protect it

Data is encrypted in transit, access is tenant-isolated by row-level security so one company cannot access another’s data, and access to production systems is restricted. No system is perfectly secure, but we take reasonable technical and organisational measures to safeguard your information.

Your rights

Subject to POPIA, you may request access to, correction of, or deletion of your personal information, object to processing, and lodge a complaint with the Information Regulator. To exercise these rights, email admin@eventstack.co.za. If your information was entered into the platform by a customer company (as a client or contact), please direct your request to that company, and we will assist them as their operator.

Children

The platform is intended for business use and is not directed at children. We do not knowingly collect personal information from children.

Changes

We may update this policy from time to time. Material changes will be notified to account holders, and the “last updated” date above will change.

Contact

Experience Creator (Pty) Ltd, trading as EventStack ZA, Somerset West, Western Cape, South Africa. Information Officer: admin@eventstack.co.za. You may also contact the Information Regulator (South Africa) at inforegulator.org.za. Our PAIA & POPIA manual explains how to request access to records.