CerebrOS Privacy Policy

Effective October 22, 2026

Version: 3

This Privacy Policy explains how Creative Code Collective Labs LLC, doing business as CerebrOS AI ("CerebrOS", "we", "us"), collects, uses, discloses and protects personal information.

CerebrOS runs ticketing, check-in and messaging infrastructure for event organizers. We call an event organizer an "Operator". When you buy or reserve a ticket through CerebrOS, you buy it from the Operator, not from us.

1. Two roles: who decides what happens to your information

We handle personal information in two different roles. Which one applies depends on who you are.

You are	Who is responsible for your information	Our role
A buyer, guest or ticket holder at an Operator's event	The Operator that runs the event. The Operator decides how your information is used.	Service provider to that Operator. We process your information on the Operator's behalf and on its instructions.
A person who uses the Console for an Operator (an owner, admin, staff or door user)	CerebrOS	Business (controller) for your account information.
A visitor to cerebrosai.com, or someone who writes to us	CerebrOS	Business (controller).

If you bought a ticket, the Operator's own privacy notice also applies to you. The Operator is named on the ticket page, at checkout, on your receipt and on your ticket. Questions about how an Operator uses your information go to that Operator first. You can also write to us, and we will pass your request to the Operator or act on it on the Operator's instructions (Section 11).

2. The short version

We do not sell your personal information. We do not share it for cross-context behavioral advertising. We have not done so since we started.
Card numbers never reach us. You enter card details into Stripe's secure payment fields. We keep only the charge reference and amounts.
One record per person, per Operator. If you buy from two Operators, they are two separate records. Neither Operator can see the other's record, and we do not link them.
Marketing is optional. You can buy a ticket without agreeing to marketing email or texts. Each is a separate, unchecked choice.
We do not collect information from children. Adults buy tickets. We do not ask for a child's name or contact details.
You can ask to know, correct or delete your information (Section 11).

3. Notice at collection: what we collect and why

The tables below are our notice at collection. They list the categories of personal information, where each comes from, why we use it, who receives it and how long we keep it. "Sold or shared" means sold, or shared for cross-context behavioral advertising, as the California Consumer Privacy Act ("CCPA") defines those terms.

3.1 Buyers, guests and ticket holders (processed for the Operator)

Category	What we collect	Source	Why	Disclosed to	Sold or shared
Identifiers and contact details	First and last name, email address, phone number, ZIP code	You, at checkout, before payment	To issue and deliver your tickets, send your receipt, contact you about the event, look up your order at the door	The Operator; our service providers (Section 7)	No
Ticket holder names	First and last name of each other person on your order, if you enter them	You, at checkout. Optional.	To put a name on each ticket	The Operator; our service providers	No
Order and ticket records	Event, ticket types, the price you paid and how it breaks down (ticket price, service charge, payment processing), order status, refunds, disputes, ticket codes	You; created by the Service	To process the sale, refunds and disputes for the Operator, and keep accurate records	The Operator; Stripe; our service providers	No
Payment information	Card number, expiry and security code	You, directly into Stripe's payment fields	To take payment	Stripe only. We never receive or store card numbers. We keep the Stripe charge reference, payment status and amounts.	No
Check-in records	A time-stamped record each time a ticket is scanned or admitted at the door, including re-entry, the result of the scan, and the staff user and device that made it	Created when event staff scan or admit a ticket	To control entry, stop duplicate use, and show the Operator attendance	The Operator	No
Consent and preference records	Each choice you make about marketing email or texts, and your answer to the optional personalized advertising choice (CerebrOS Connect, Section 8): the exact wording you saw, its version, where it was shown and when. For the advertising choice and for opt-outs, also the IP address and browser it came from	You, at checkout or later; your browser, if it sends Global Privacy Control	To honor your choices and prove them	The Operator	No
Messages	Emails and texts sent to you through the Service, delivery status, opt-outs and replies such as STOP or HELP	Created by the Service; you	To deliver tickets, updates and (if you agreed) marketing; to stop messages you opted out of	The Operator; our email and text providers	No
Apple Wallet pass data	If you add a ticket to Apple Wallet: a device identifier and push token issued by Apple for that pass, and the pass serial number, so we can update it	Your device, through Apple	To update your pass if event details change, and stop updates when you remove it	Apple, to deliver pass updates through the Apple Push Notification service: the device push token and pass serial number only	No
Technical information	IP address, browser type, and request logs created when you use ticket pages	Your browser	To run, secure and debug the Service, and prevent fraud	Our hosting provider; Stripe (Section 15); Google, which serves the fonts our pages use (Section 7)	No
Pseudonymous email key	For a checkout that was never paid: a keyed one-way hash of the email address, kept after the contact details are removed (Section 10). The key is held separately for each Operator, so the hash cannot be reversed by trying addresses from outside our database or compared across Operators. It is still personal information, not de-identified data.	Created by the Service from the email you entered	To link a later checkout to an earlier unpaid one at the same Operator, and to show that a message was sent to that address	Not disclosed. Kept in the Operator's records within the Service.	No
Modeled estimates	Estimates drawn from the data above, such as travel distance from your ZIP code or whether you are a repeat attendee	Created by the Service	To give the Operator insights about its own events (Section 6)	The Operator	No

3.2 People who use the Console (CerebrOS is the business)

Category	What we collect	Source	Why	Disclosed to	Sold or shared
Account identifiers	Name, email address, sign-in method, user ID, role in each Organization	You; your Organization's owner or admin, who invites you	To create and secure your account and give you the right access	Clerk (sign-in); our hosting and database providers	No
Sign-in credentials	Password or single sign-on details	You, directly to Clerk	To sign you in	Clerk only. We do not store your password.	No
Organization and business details	Your Organization's legal name, business name, business address, tax and Stripe account details, event details, venue addresses	You	To run your Organization, show your business name and address to buyers as the law requires, and connect payments	Stripe; Google (address suggestions only, Section 7); our service providers	No
Agreement records	Each version of the Operator Terms you accepted, your typed name, user account, verified email, sign-in method, time, IP address, and a fingerprint of the exact text	You, when you accept	To prove the agreement	Our service providers	No
Activity records	Changes, exports, refunds and scans you make, with time and user	Created by the Service	Security, audit and support	Our service providers	No
Billing details	Payment method for paid Add-Ons, billing history and renewal consents	You	To bill Add-Ons and keep required records	Stripe	No
Support messages	What you tell us when you contact us	You	To help you	Our email provider	No

3.3 Visitors to cerebrosai.com and people who contact us

Category	What we collect	Source	Why	Disclosed to	Sold or shared
Technical information	IP address, browser type, pages requested, request logs	Your browser	To run and secure the site	Our hosting provider; Google, which serves the fonts our pages use (Section 7)	No
Anonymous page counts	A count of each page view and button click, with the page path, the referring site's domain and any campaign tag in the link. No IP address, cookie, visitor ID or browser details are stored with it, so it is not linked to you. Browsers that send Global Privacy Control or Do Not Track are not counted.	Your browser	To see which pages people use	Not disclosed	No
Contact details and messages	Name, email address and anything you write to us	You	To reply	Our email provider	No

We do not use advertising cookies, tracking pixels or third-party analytics on any CerebrOS site. See the Cookie Notice.

4. Sources

We collect personal information:

from you, when you buy or reserve a ticket, use the Console, or contact us;
from the Operator, for example when the Operator adds a guest by hand or imports a contact list it collected (Operators must confirm they collected imported contacts lawfully, under Operator Terms §8.6);
automatically, when tickets are scanned, when your browser requests our pages, or when Apple Wallet registers a pass; and
from our service providers, for example payment status from Stripe and delivery status from our email and text providers.

We do not buy personal information. We do not use data brokers. We do not scrape websites or social media.

5. How we use personal information

We use personal information only for the purposes in Section 3 and these business purposes:

to sell, issue, deliver, refund and check in tickets for the Operator;
to send service messages about tickets you hold, such as delivery, entry details, time or venue changes and cancellations;
to send marketing email or texts only if you separately agreed, on the Operator's instructions and approval;
to keep records of agreements, consents and opt-outs, and to honor opt-outs;
to give the Operator reports and insights about its own events;
to provide support and to debug and repair the Service;
to secure the Service, and detect and prevent fraud, security incidents and illegal activity;
to create de-identified and aggregated data (Section 6); and
to comply with law and enforce our agreements.

We do not use personal information to make decisions that produce legal or similarly significant effects about you.

6. Modeled estimates, de-identified data and model training

Modeled estimates. Some insights include estimates about a person, such as travel distance or whether they are a repeat attendee. These are estimates from patterns in the data, not verified facts. The Service labels them as estimates. We do not produce estimates about minors. We do not estimate any age range below 18. We do not derive estimates from the type of place a person visits, such as a school or place of worship. Operators may not use an estimate to make decisions about credit, housing, education, employment, healthcare or anything else with a legal or similarly significant effect on a person.

De-identified and aggregated data. On the Operator's instructions, we de-identify and aggregate Operator data. We do this separately for each Operator before combining anything. We use the result to produce benchmarks and insights for Operators, and to maintain, secure, improve and develop the Service, including by training and improving models such as machine-learning and AI models. De-identified data cannot reasonably be linked to you. A hashed or tokenized identifier is not de-identified data. We commit to keep and use de-identified data only in de-identified form, and not to try to re-identify it, except to test that our methods work. We contractually require anyone who receives it to do the same. We never use information about minors for this. We never disclose aggregated data about a group of fewer than 10 people outside CerebrOS.

7. How we disclose personal information

We disclose personal information only:

to the Operator whose event your information relates to;
to our service providers, who process it for us under written contracts that limit their use to providing services to us. The current list, with what each one does, is in our Subprocessor List at cerebrosai.com/legal/subprocessors. In short: Stripe (payments), Vercel (hosting and file storage), Neon (database), Clerk (Console sign-in), Resend (email), Twilio (text messages), Apple (Wallet pass updates), OpenRouter and the AI model providers it routes to (Console questions, see below), and Google Maps Platform (address suggestions in the Console, when enabled);
to Apple, only if you add a ticket to Apple Wallet, so that pass updates reach your device;
to Google, when a Console user types into an address field and Google's address suggestions load. This sends the typed text and the user's browser information to Google. Buyer pages do not use it. Separately, our pages and emails load typefaces from Google Fonts, so your browser or email program requests them from Google, which receives your IP address and browser information. We send Google nothing else, and Google Fonts sets no cookies;
when the law requires it, such as a valid subpoena or court order, or to protect the rights, safety or property of people at an event, our users, us or others;
in a merger, acquisition or sale of assets, subject to this Policy; and
with your direction, for example when you ask us to send something to someone.

Stripe also uses some payment and device information for its own purposes, such as fraud prevention and meeting its legal obligations, under its own privacy policy.

We do not give personal information to third parties for their own direct marketing. We do not give one Operator's buyer records to another Operator.

AI answers in the Console. When a Console user asks the Service a question in plain language, the Service sends the question and the results of read-only queries about that Operator's own events to an AI model provider, through OpenRouter, to write the answer. Query results are aggregates, such as ticket counts, revenue totals, event names and ZIP codes with counts, and at most a few guest names shortened to first name and last initial. We never send buyer email addresses, phone numbers, street addresses, ticket codes, order or payment identifiers, or card data. We instruct OpenRouter to route only to providers that do not store prompts or train on them. Questions are logged with email addresses and phone numbers removed. The feature reads data. It does not send messages to buyers.

8. We do not sell or share personal information

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We have not done either in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Our sites and ticket pages carry a "Your Privacy Choices" link anyway, so you can opt out of sale or sharing in advance. We honor opt-out preference signals (Section 12).

CerebrOS Connect: we ask and record your choice. We have not shared. At checkout, a ticket page may show an optional personalized advertising choice with two equal options, "Agree" and "Do Not Agree". It asks whether the Operator and CerebrOS may use your email address and telephone number to create matched advertising audiences through advertising platforms, including Google and Meta, so that we can show you advertisements for that Operator's events, products, services, and disclosed sponsor offers. Neither option is selected for you. You can buy without choosing either one, and your answer does not affect your purchase.

We record the choice you make, with the exact wording shown, its version, the time, its source (checkout, or a Global Privacy Control signal from your browser), and the IP address and browser it came from. If you choose neither option, we record no choice. We keep a copy of what the checkout showed for each version of the wording.

We have not shared anyone's information with any advertising platform. No buyer information is uploaded to, matched with, or disclosed to any advertising platform, sponsor or other company, and agreeing does not start any sharing. Before any sharing begins, we will update this Policy and our notice at collection, and the opt-out controls in this Policy will be in place. Any such program would include only adults in the United States who agreed, and would never include information about minors.

You can withdraw your agreement, or opt out of sale or sharing for advertising whether or not you agreed, at any time on the Your Privacy Choices page (Section 11). It works without an account, and it is separate from email and text unsubscribe.

9. Sensitive personal information

The only sensitive personal information we handle is Console sign-in credentials, which Clerk holds. We use it only to sign users in and keep accounts secure. We do not use sensitive personal information to infer characteristics about anyone. The right to limit its use therefore does not apply.

We do not collect government ID numbers, financial account numbers (other than through Stripe), precise geolocation, health information, or information about race, religion, sexual orientation or other protected characteristics. Operators may not configure the Service to collect them (Operator Terms §13.2).

10. How long we keep information

We keep personal information only as long as needed for the purposes in this Policy, then delete or de-identify it.

Information	How long
Buyer, guest, ticket and check-in records for completed orders	While the Operator's account is active, unless the Operator deletes them sooner or we delete them in response to a deletion request (Section 11).
Order, refund and payout records	7 years after the transaction, to meet tax, accounting and dispute obligations. A deletion request removes the contact details we do not need for these records.
Checkouts that were never paid	A checkout holds tickets for 30 minutes. If payment does not complete, the checkout closes and the order is cancelled. 30 days after the checkout closed, we remove the contact details entered (name, email, phone and ZIP, and any ticket holder names), and the IP address and browser information recorded with any consent on that checkout. We keep the order record (event, amounts, status, times and payment reference), the log of emails sent, and a keyed one-way hash of the email address. The hash is pseudonymous personal information, not de-identified data (Section 3.1). We keep the contact details if the person separately agreed to marketing email or texts from that Operator, because that consent is its own purpose.
When an Operator leaves CerebrOS	The Operator has 30 days to export its data. We then delete it within 90 days. Backups expire within a further 35 days.
Consent records and the wording shown, and records of messages sent	At least 5 years after the message or consent, or longer if the law requires
Opt-out records	At least 10 years, so we do not contact you again. Deleting your record does not delete the minimal record that you opted out.
Payment card data	Held by Stripe under its own retention rules. We never hold it.
Apple Wallet registration	Until you remove the pass, or the ticket is deleted
Console account information	While your account is active. Within 90 days after your account or your Organization closes, we delete it, except the agreement and activity records listed in this table.
Operator Terms acceptance records and Add-On billing consents	At least 3 years after the Organization closes
Server and request logs	30 days
Records needed for fraud prevention or an open dispute	As long as the law requires or the dispute lasts

11. Your privacy rights

Depending on where you live, you may have these rights, subject to exceptions the law allows:

Know and access. Ask what personal information we hold about you, its sources, why we use it, and who receives it, and get a copy.
Delete. Ask us to delete personal information we collected from you.
Correct. Ask us to correct inaccurate information.
Opt out of sale or sharing. We do not sell or share. You can opt out now anyway, on the Your Privacy Choices page, and your opt-out will apply if that ever changes.
Limit use of sensitive personal information. We do not use it in ways that trigger this right.
Non-discrimination. We will not deny you service, charge you a different price or give you a worse service for using your rights.

How to make a request

Email privacy@cerebrosai.com for any request; or
use the Your Privacy Choices page at cerebrosai.com/privacy-choices (also at /privacy-choices on every ticket page host) to opt out of sale or sharing for advertising, to stop marketing email or texts, or to ask us to delete your information. It confirms the request through your email address.

You do not need an account to make a request.

If you are a buyer or guest, your information belongs to the Operator. We will either pass your request to the Operator, help the Operator answer it, or act on it on the Operator's instructions. We will tell you which. You can also contact the Operator directly.

Verification. To protect you, we verify requests to know, delete or correct. We do this by matching details you give us, such as your email address and an order number, against our records, and by confirming through your email address. We do not need to verify an opt-out request.

Authorized agents. You may use an authorized agent. We may ask the agent for signed permission from you, and ask you to confirm your identity with us directly, unless the agent holds a valid power of attorney.

Timing. We confirm receipt within 10 business days. We respond within 45 calendar days. If we need more time, we may extend that once by up to 45 more days, and we will tell you why within the first 45 days.

Appeals. If we decline your request, you may appeal by replying to our decision or emailing privacy@cerebrosai.com with "Appeal" in the subject. You may appeal within 60 days of our decision. We will respond to an appeal within 60 days. If you are not satisfied, you may contact your state attorney general.

12. Opt-out preference signals (Global Privacy Control)

We treat a legally recognized opt-out preference signal, such as Global Privacy Control, as a valid request to opt out of the sale or sharing of personal information. We apply it to the browser that sends it and, where we know who you are, to you. We do not sell or share today, so the signal changes nothing about how we handle your information now. At checkout, we record the signal as an opt-out from the personalized advertising choice (Section 8). If that ever changes, the signal will take effect without any further step from you.

We do not track you across other websites. Our public site does not count a visit from a browser that sends Global Privacy Control or Do Not Track (Section 3.3).

13. Children and minors

The Service is for adults. People who buy tickets or use the Console must be at least 18. We do not knowingly collect personal information directly from children under 13. We do not ask for a child's name or contact details at checkout.

Some Operators run events for young people. Those Operators may not use the Service to collect information about a child at checkout (Operator Terms §11.2). We do not use information about minors for marketing, advertising, model training or de-identified data, and we never sell or share it.

If you believe a child gave us personal information, email privacy@cerebrosai.com and we will delete it.

14. Email and text messages

Service messages. We send messages about tickets you hold, such as your tickets, entry details, changes and cancellations, by email. These are not marketing, and you cannot opt out of them while you hold tickets. We do not send service messages by text.

Marketing. You receive marketing from an Operator only if you separately agreed, and only from that Operator. You can unsubscribe from marketing email using the link in any marketing email. You can stop marketing texts by replying STOP. Opting out of one channel does not opt you out of the others. Opting out is not the same as deleting your information (Section 11).

Mobile information. We do not sell, rent or share mobile phone numbers or text-message consent with third parties or affiliates for their marketing or promotional purposes. Text-message opt-in data and consent are never shared with any third party, except the text messaging providers that deliver the messages. See the Text Message Terms at cerebrosai.com/legal/sms.

15. Cookies and similar technologies

We use only the cookies and browser storage needed to run the Service: to sign Console users in, to keep checkout secure, and to let door devices work offline. We do not use advertising cookies, tracking pixels or third-party analytics. Stripe sets cookies on ticket and checkout pages for fraud prevention. Clerk sets cookies when someone opens the Console sign-in. See the Cookie Notice at cerebrosai.com/legal/cookies.

16. Security

We use reasonable safeguards suited to the information we hold. They include encryption in transit and at rest, database-level separation of each Operator's data, role-based and least-privilege access, logging of changes and exports, and payment through Stripe so card data never reaches our servers. Door devices store ticket codes only in scrambled (hashed) form, never the codes themselves. No system is completely secure.

17. Where we operate

The Service is for events in the United States and is run from the United States. Our systems store information in the United States. Checkout accepts US ZIP codes only. We do not direct the Service to people in Canada, the European Union or the United Kingdom.

18. California "Shine the Light"

California Civil Code §1798.83 lets California residents ask about disclosures of personal information to third parties for their own direct marketing. We do not make those disclosures.

19. Changes to this Policy

We may update this Policy. We post each version with its version number and effective date. We keep every earlier version and will send you a copy if you ask at privacy@cerebrosai.com. If a change is material, we will give notice on our sites and, where we have your email and the law requires it, by email, before it takes effect. We will not use personal information already collected for a materially different purpose without notice and, where the law requires, your consent.

20. Contact us

Creative Code Collective Labs LLC, doing business as CerebrOS AI 3631 Truxel Road #1272, Sacramento, CA 95834 Privacy requests and questions: privacy@cerebrosai.com Legal notices: legal@cerebrosai.com Support: support@cerebrosai.com Security reports: security@cerebrosai.com

If you bought a ticket, the Operator's name and contact details are on your receipt and ticket.