Privacy Policy

Effective date: October 2, 2026

This Privacy Policy explains how Audacious Innovations, LLC, doing business as EventSage ("EventSage," "we," "us"), collects, uses and shares personal information when you visit eventsage.io, use our app at app.eventsage.io, or open a proposal, contract, invoice, form or payment page sent through EventSage.

The short version: we collect what we need to run EventSage, we don't sell personal information, we don't use advertising or analytics trackers in the app, and the businesses that use EventSage control the information they put in it about their clients and staff.

1. Two roles we play

• When we decide how data is used (controller). This covers our website visitors, people who apply for or sign up to EventSage, and the account owners and teammates who use it. This policy fully applies to that information.
• When a business decides (processor or service provider). Mobile bars, caterers and other event businesses ("Operators") use EventSage to manage their clients, events and staff. When an Operator puts your information into EventSage, for example because you booked an event with them or work for them, the Operator decides how it's used and their own privacy policy applies. We process it on their behalf. If you're an Operator's client or staff member and have a question or request about your information, please contact that Operator first. We'll help them respond.

2. Information we collect

From Operators and their teammates

• Account details: name, email, password (stored hashed), role, business name, address and phone.
• Billing details: plan, billing history and Stripe customer IDs. Card details are collected and stored by Stripe, not by us.
• Payment setup: details Stripe collects during onboarding to open your connected account. We receive account status, not your full bank account numbers.
• Business settings and content, including payment instructions you choose to show clients, email signatures, brand voice samples, templates and files you upload.
• Connected accounts: if you connect Google or Microsoft, an encrypted access token and the scopes you approve (see Section 5).
• Security information: login activity, IP addresses for security events and two-factor settings.

About Operators' clients (entered by the Operator or by the client)

• Contact details: name, email, phone, company, title, address and social media handles.
• Event details: dates, venues, guest counts, menus, notes, and any allergy or dietary information shared for the event.
• Billing and tax details: invoices, payments, refunds, tips, autopay consent and tax-exemption documents. Saved payment methods are stored by Stripe on the Operator's account.
• Contract signing records: your name, typed or drawn signature, initials, consent to sign electronically, timestamps, IP address, browser and device information and time zone, kept as an audit trail.
• Form and inquiry submissions, including the IP address and browser of people who view or submit an Operator's inquiry or order form.
• Messages and email activity: emails sent through EventSage and whether they were delivered, opened, bounced or marked as spam.

About Operators' staff (entered by the Operator or by the staff member)

• Contact details, role, start date, employment type and pay rate.
• Legal name, business name and mailing address for tax reporting, W-9 status, and only the last four digits of an SSN or EIN. We don't store full tax ID numbers.
• Alcohol service and other certifications, including certificate numbers, issuing state, expiration dates and uploaded copies.
• Schedules, timesheets, pay and tip records.
• Location at clock-in and clock-out. If a staff member allows location access in their browser, we record their approximate GPS location when they clock in and out, so the Operator can confirm attendance at the event. We don't track location at any other time. Staff can decline location access in their browser settings.
• Push notification subscriptions, if a staff member turns on notifications.

Collected automatically

• Log and device data: IP address, browser type, device type, pages requested and timestamps, used for security, debugging and preventing abuse.
• Essential cookies and browser storage that keep you signed in and remember settings. See our Cookie Policy.

From our website and application forms

• If you join our waitlist or apply for founding membership, your name, email, business details and answers to our questions.

3. How we use information

• To provide, secure and support EventSage, including sending proposals, contracts, invoices, receipts and notifications.
• To process subscription payments and help Operators collect payments through Stripe.
• To power AI features (Section 4).
• To send service emails, such as security alerts, billing notices and product updates. Operators can opt out of non-essential updates.
• To prevent fraud and abuse, enforce our Terms and comply with the law.
• To improve EventSage, using de-identified and aggregated information where we can.

4. AI features

EventSage includes AI features, such as our assistant SageAI, that draft emails and proposals, summarize events and read uploaded documents. When an Operator uses them, we send the content needed for that request to our AI provider, Anthropic. That can include client names, contact details and event details. Anthropic processes it to return a response, doesn't use it to train its models, and keeps it only for a limited time for safety and abuse monitoring under its commercial terms.

We keep AI conversations in the Operator's account so they can see their history. We may use de-identified and aggregated information about how AI features are used, which doesn't identify any person, to improve EventSage. The account owner can turn this off at any time under Your account in the app. We never use information received from Google APIs for this.

5. Google and Microsoft connections

Operators can connect a Google account (Gmail and Google Calendar) or a Microsoft account (Outlook and calendar). We request only the permissions needed to do two things. The first is to send email from the Operator's own address, whether the Operator writes or approves each message or sets EventSage to send it automatically. The second is to create, update and delete the calendar events we create for the Operator's bookings.

We don't read, search or index the Operator's inbox, and we don't read the Operator's other calendar entries. Tokens are encrypted at rest. The Operator can disconnect at any time from EventSage or from their Google or Microsoft account settings.

Google Limited Use. EventSage's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the features the Operator turned on. We don't sell it, use it for advertising, use it to develop or train generalized AI or machine learning models, or let people read it, except with the Operator's permission, for security, or when the law requires it.

6. Who we share information with

We don't sell personal information, and we don't share it for cross-context behavioral advertising. We share it only:

• With the Operator whose account it belongs to, and with clients and staff as the Operator directs (for example, sending a proposal).
• With service providers who help us run EventSage, under contracts that limit their use to providing services to us:

• For legal reasons, when we believe in good faith it's required by law or needed to protect the rights, safety or property of EventSage, our users or others.
• In a business transfer, such as a merger, reorganization or sale, where information transfers to the successor under this policy.

7. How long we keep information

• Operator accounts and Customer Data: for as long as the account is open, then 90 days after it closes so the Operator can request an export, then deleted.
• Records we must keep: invoices, payments, tax records and signed contracts with their audit trails are kept as long as tax, accounting and legal rules require, which can be up to seven years or longer.
• Security logs: for as long as needed to protect the Service.
• Backups: deleted on our normal backup cycle.
• Waitlist and application data: until you ask us to delete it or we no longer need it.
• Google and Microsoft connections: when you disconnect, we delete our stored access token and stop sending email or updating your calendar. For Google we also ask Google to revoke the token. For Microsoft, you can remove EventSage's access from your Microsoft account page. Calendar entries we already created stay on your calendar until you delete them.

8. Security

We use encryption in transit, encryption of sensitive tokens at rest, hashed passwords, breached-password checks, two-factor authentication for administrators, role-based access and audit logs. No system is completely secure, so please use a strong password and keep links to proposals, contracts and invoices private. Anyone who has one of those links can open it.

9. International transfers

EventSage is based in the United States, and we store and process information in the United States. EventSage is offered to businesses in the United States and Canada. If you're in Canada, your information will be transferred to and stored in the US, where it may be accessible to US courts, law enforcement and national security authorities under US law. Our service providers are bound by contract to protect it.

10. Your rights and choices

Everyone. You can ask us to access, correct or delete your information, or to send you a copy. Operators can update most information in the app. To make a request, email support@eventsage.io. We'll verify your identity before acting, and we'll respond within 30 days (45 days where US state law allows). If you're an Operator's client or staff member, we'll refer your request to the Operator, who controls that information.

US residents. Depending on your state, you may have the right to know what we collect, to access, correct and delete it, to get a portable copy, and to opt out of sales, targeted advertising and profiling. We don't sell personal information or use it for targeted advertising. You may use an authorized agent. We won't discriminate against you for exercising your rights. If we deny your request, you can appeal by replying to our decision, and if you're still not satisfied you can contact your state attorney general.

Canada. You can access and correct your information and withdraw consent, subject to legal and contractual limits, and you can complain to the Office of the Privacy Commissioner of Canada.

Email. Operators' clients can unsubscribe from workflow and outreach emails using the link in each email. Contract, invoice and payment notices will still arrive because they're part of a transaction.

Location and notifications. Staff can turn off location access and push notifications in their browser or device settings at any time.

11. Children

EventSage is a business tool for adults. We don't knowingly collect information from children under 16. If you believe a child has given us information, email support@eventsage.io and we'll delete it.

12. Changes

We'll post any changes here and update the effective date. For material changes, we'll notify account owners by email or in the app before the change takes effect.

13. Contact us

Audacious Innovations, LLC, doing business as EventSage 332 Bayshore Dr, Hendersonville, TN 37075 support@eventsage.io