Privacy Policy

Depending on how you use HOTSPOT JA, you may provide us with:

• Account Information: Email address, display name, password hash, phone number, and authentication tokens.
• Profile Information: Default parish location, preferred event categories, bio, and profile avatar photos.
• Event Submissions: Event titles, descriptions, venue coordinates, dates, times, ticket tiers, admission prices, and flyer images.
• Financial Information (Event Promoters Only): Jamaican commercial bank account details (Bank Name, Branch, Account Holder Name, Account Type, and Account Number) collected exclusively from organizers selling tickets to facilitate revenue payout disbursements.
• Government ID and TRN (Host Verification Program): Under Section 9.7 of our Terms of Use, event organizers who voluntarily apply for Verified Promoter status and activate Patron Purchase Protection must submit a valid government-issued photo ID (Jamaican Passport, National/Elector ID, or Driver's Licence) and Taxpayer Registration Number (TRN) or official Companies Office of Jamaica (COJ) business registration document. This information is collected solely to authenticate organizer identity, satisfy Anti-Money Laundering (AML) / Know Your Customer (KYC) standards under Bank of Jamaica guidelines, and protect ticket buyers from fraudulent events. These documents are stored in encrypted private Cloud Storage and restricted database collections, accessible strictly by authorized administrative compliance personnel.
• User Content: Ratings, reviews, venue bookmarks, comments, and calendar additions.
• Communications: Customer support tickets, feedback forms, and correspondence sent to our support channels.

We request access to specific device capabilities solely upon your explicit initiation:

• Precise Location (GPS): With your explicit runtime permission ("Use My Location" or "Near Me"), we collect precise latitude and longitude coordinates. We use this data to display your position on the interactive map radar, calculate real-time driving/walking distances to venues across Jamaica's 14 parishes, discover nearby events, and provide turn-by-turn navigation. You can revoke location permissions at any time in your device settings. Approximate parish-level location may also be inferred from your IP address.
• Camera: Camera access is requested strictly when you initiate visual features:
  • Ticket Scanning at Gates: Event hosts and authorized door staff use the camera to scan attendee ticket QR codes. The camera stream is processed locally in real time on the device to validate admission; video frames and photos are never recorded, saved, or uploaded to our servers.
  • Media Uploads: When capturing photos for event flyers, verification documents, or profile avatars. Only the specific photograph you capture and choose to submit is uploaded.

When you navigate or interact with the Service, our systems automatically log:

• Device & Network Data: Device model, operating system version, unique device identifiers, IP address, mobile network provider, browser type, and language.
• App Activity & Interaction: Pages and events viewed, search queries, referral sources, timestamps, button clicks, and feature engagement.
• Bot Detection & Security Telemetry: We implement Google reCAPTCHA Enterprise and Firebase App Check to defend against automated scrapers, ticket scalping bots, credential stuffing, and unauthorized API abuse. These tools analyze hardware, network, and interaction signals to produce an automated risk score. Google's Privacy Policy and Terms of Service govern this processing.

To ensure system stability, optimize user experience, and monitor application health:

• PostHog (Product Analytics & Session Replay): We use PostHog to analyze user navigation patterns and product adoption. When enabled, PostHog collects telemetry on user clicks, taps, scrolls, and in-app journeys, and may capture session recordings (replays) of user screen interactions to diagnose usability bugs and improve user workflows. Session recording and product telemetry default to disabled (opted out) until you grant consent via our Cookie/Analytics Banner or within Settings. You can opt out at any time using our self-serve toggle. PostHog does not sell your data.
• Google Analytics 4 (GA4) & Google Tag Manager (GTM): We use GA4 and GTM alongside Firebase Analytics to evaluate aggregate audience traffic and engagement metrics across web and mobile surfaces. GA4 is configured with Google Consent Mode v2 and strictly respects your analytics consent choices.
• Sentry (Error Diagnostics & Crash Reporting): We utilize Sentry to monitor software crashes, unexpected runtime exceptions, and infrastructure stability. When an unhandled error or system crash occurs, technical diagnostics (stack trace, error message, device OS, browser version) are transmitted to Sentry. Importantly, for authenticated users, the user's Firebase Auth User ID (UID) and registered email address are attached to error reports (Sentry.setUser({ id, email })) so our engineering team can isolate, reproduce, and resolve critical account-specific bugs and failed ticket transactions. Core crash and error diagnostic reporting operates as an essential technical and security service independent of non-essential analytics consent, while optional visual session replays honor your analytics consent toggle.

• Google Sign-In: If you sign in using Google, we receive your name, verified email address, language preference, and profile picture URL from Google Identity Services.
• WiPay Caribbean: For digital ticket purchases and payouts, payment processing is executed via WiPay. WiPay transmits transaction confirmation IDs, payment rail status (debit card, credit card, or digital wallet), and settlement amounts to HOTSPOT JA. Credit and debit card numbers, CVVs, and banking credentials entered during checkout are processed directly by WiPay under PCI-DSS Level 1 compliance and are NEVER received, processed, or stored on HOTSPOT JA servers.

When event organizers utilize our AI Flyer Autofill feature to parse event details from promotional flyers:

• Google Gemini Vision Models: Flyer images are temporarily transmitted over encrypted TLS connections to Google Gemini APIs (`@genkit-ai/googleai`) to extract event titles, dates, times, locations, and descriptions into structured event drafts.
• Exclusivity & Training Safeguards: HOTSPOT JA uses Google Gemini exclusively for AI parsing and does NOT use OpenAI models. Uploaded flyer imagery is not retained or used by HOTSPOT JA to train artificial intelligence models.

• Create, authenticate, and manage your user account.
• Display interactive parish maps, calculate venue proximity, and power event search.
• Process digital ticket purchases, issue HMAC-signed QR ticket passes, and manage digital ticket wallets.
• Facilitate revenue payouts to event organizers via Jamaican bank transfers and payment rails.
• Enable venue reviews, promoter ratings, event bookmarks, and calendar exports.
• Deliver responsive customer support and resolve user inquiries.

• Diagnose software crashes, resolve API exceptions, and ensure system uptime via Sentry.
• Analyze aggregate feature adoption, page engagement, and conversion flows via PostHog and GA4.
• Evaluate server performance, database query response times, and app responsiveness.

• Transactional Emails (Resend): We utilize Resend to deliver automated purchase receipts, order confirmations, account security alerts, and official PDF ticket attachments containing QR code passes.
• Push Notifications: With your permission, we send real-time reminders about saved events, ticket verification confirmations, and organizer announcements.

• Verify event promoter identity (Government ID & TRN) to protect ticket buyers and administer the Patron Purchase Protection program.
• Mitigate automated abuse, ticket scalping, and fraudulent account creation using reCAPTCHA Enterprise and Firebase App Check.
• Comply with statutory obligations under Jamaica's Proceeds of Crime Act (POCA), Tax Administration Jamaica (TAJ) recordkeeping, and the Data Protection Act (DPA).

• Event Listings: Event details, venues, flyers, ticket tiers, and organizer names are publicly visible across the App and web platform.
• Public Feedback: Reviews, ratings, and comments you post on events or venues are visible to all users.

We share data with trusted vendors who process information on our behalf under strict data processing agreements:

• Google Cloud & Firebase: Authentication, cloud database (Firestore), private document storage, and push notifications.
• Google Maps Platform: Map rendering, venue geolocation, places autocomplete, and distance calculations.
• WiPay Caribbean: Payment gateway processing for debit/credit card checkouts and automated organizer bank payout settlements.
• Resend, Inc.: Transactional email delivery service. Receives recipient names, email addresses, order numbers, transaction totals, and PDF ticket attachments with HMAC-signed QR passes.
• PostHog, Inc.: Product analytics, feature flag evaluation, and user session replay (subject to your analytics consent).
• Functional Software, Inc. (Sentry): Real-time error monitoring and crash diagnostics. Receives error stack traces, device parameters, and authenticated user ID and email address to investigate software exceptions.
• Google Gemini AI: Image parsing of promotional event flyers for organizer form autofill.
• Google reCAPTCHA Enterprise & Firebase App Check: Bot detection, request attestation, and anti-abuse scoring.

We may disclose personal data if required to do so by applicable Jamaican law or valid legal processes (e.g., court orders, formal requests by the Jamaica Constabulary Force or regulatory bodies), or where necessary to investigate fraud, enforce our Terms of Use, or protect user physical safety.

In the event of a merger, acquisition, corporate restructuring, or sale of assets, user data may be transferred to the acquiring entity, subject to this Privacy Policy.

• Account Profile & Preferences: Retained for the active lifespan of your account until deletion is requested.
• Promoter Verification Records (Government ID & TRN): Retained for the duration of the promoter's active verified status (90-day verification cycles) and up to 7 years following ticket sales to comply with statutory Jamaican tax (TAJ) and financial auditing requirements, after which documents are securely destroyed.
• Financial & Ticket Transaction Ledgers: Ticket purchase receipts, payout ledgers, and order references are retained for 7 years to satisfy Jamaican statutory accounting, tax, and anti-money laundering regulations.
• Observability & Diagnostic Logs: Sentry crash logs and PostHog analytics records are retained on rolling 90-day to 12-month retention windows before automated purge or aggregation.
• Customer Support Inquiries: Retained for 2 years following ticket resolution.

We provide transparent, real-time deletion mechanisms:

• Immediate In-App Deletion: When you initiate account deletion in the App (via Profile > Settings > Delete Account), your profile record, authentication credentials, saved preferences, and verification documents are deleted immediately in real time from our live databases.
• Manual Email Deletion Requests: Deletion requests submitted via email to privacy@hotspotja.app or support@hotspotja.app are verified and executed by our technical team within 1–2 business days.
• Disaster Recovery Backup Purge: Encrypted system backup snapshots systematically rotate and permanently overwrite residual data within up to 90 days.
• Public Events Notice: Events submitted by an organizer that have already been published and ticketed remain visible as public records for attendees, with all personal organizer contact details disassociated.

You have the right to request a copy of the personal data we maintain about you in a structured, machine-readable format.

You can edit your profile details, display name, preferred parish, and categories directly within the App's Profile settings at any time, or request correction of inaccurate records.

You can permanently delete your account and associated personal data at any time:

• In-App: Navigate to Profile > Settings > Delete Account.
• Web Portal (Logged Out / Accessible to All): Visit our dedicated web deletion page at https://hotspotja.app/account-deletion, which provides both self-serve instructions and a direct email deletion route.

You maintain full control over optional data collection:

• Analytics & Session Replay Opt-Out: You can toggle analytics on or off at any time directly in the App via Profile > Settings > Privacy & Analytics, or via our Cookie Consent banner. Toggling this off immediately halts PostHog product analytics, PostHog session replay, Sentry visual session replay, GA4, and Firebase Analytics.
• Sentry vs. Consent Disclosure: Please note that while visual session replays honor your analytics opt-out, core Sentry error diagnostics and crash monitoring continue operating as an essential service strictly necessary to diagnose infrastructure stability, prevent payment errors, and preserve platform security.
• Device Permissions: Location and camera permissions can be disabled at any time through your device operating system settings.

To submit a Data Subject Access Request (DSAR) or exercise your privacy rights, please contact our Data Protection Officer at privacy@hotspotja.app (or hotspotapp876@gmail.com). We acknowledge requests within 48 hours and provide substantive responses within 30 days.

If you believe our data processing violates Jamaican law, you have the right to lodge a formal complaint with:
Office of the Information Commissioner (OIC) Jamaica
Website: https://www.oic.gov.jm