Off Pixel Ltd · operating Cirqlin
When you sign up for an event or launch through a Cirqlin page, we collect your email address, your phone number (if you choose to give it), and optionally a social media handle. Your approximate city comes from your internet connection, not from you — we never ask for your name. We use these details for one purpose: to add you to the list of the promoter or creator you signed up with, so they can send you what you asked for (presale access, launch news, community invites). That promoter controls your data; we process it for them and for nothing else. We never sell it, never use it for our own advertising, and never share it beyond the services the promoter has connected. Your contact details are stored encrypted in the EU. To see, export, or delete your data at any time: privacy@cirqlin.com.
Cirqlin (accessible at cirqlin.com, app.cirqlin.com, and crqln.com) is a product of:
Off Pixel Ltd
Company number: 17045733
Registered office: 124-128 City Road, London, England, EC1V 2NX
Contact: privacy@cirqlin.com
Cirqlin provides signup pages, community routing, and first-access tools to event promoters, artists, and creators ("Promoters").
Two roles, stated plainly:
When you sign up on a Cirqlin page (as a fan):
| Data | Required? | Notes |
|---|---|---|
| Email address | Yes | |
| Phone number | No | International format; used for WhatsApp community routing if the Promoter runs one |
| Social handle (Instagram or TikTok) | No | Only if you choose to add it |
| Age bracket (optional, where the Promoter enables it) | No | A broad range only (e.g. 18–24), never a date of birth — only asked if the Promoter has turned this question on, and always skippable. If you tell us you're under 18, we can't accept your signup for that event. |
| Approximate location (country, region, city) | Automatic | Derived from your connection at the moment of signup — never requested from you, never precise |
| Signup source and referral code | Automatic | e.g. which link brought you to the page |
| Consent choices | Yes | Whether you ticked the mailing-list box |
| Technical data (IP address, browser type) | Automatic | Used transiently for security, bot protection, and rate limiting; the IP address is not stored with your signup record |
Information provided about you by the Promoter (ticket records). Where a Promoter uploads their ticketing records to analyse their own events, we process on their instructions: your email address, ticket type, ticket price and quantity, and order date, relating to events you bought tickets for. This information comes from the Promoter (typically an export from their ticketing provider), not from you. It is encrypted at rest in the same way as signup data, is used solely to provide that Promoter with analytics and segments about their own audience, and is never combined across different Promoters. The Promoter is responsible for ensuring they may lawfully provide it; your rights in Section 8 apply to this data equally.
We do not collect your name, date of birth, or payment details. Ticket purchases happen on the ticket seller's own site, under their terms.
When you create a Promoter account: email address, authentication data, organisation name, and the settings and credentials you add.
Fan data is used solely to deliver the service the Promoter has configured:
What we never do with fan data: sell it; rent it; use it for our own marketing or advertising; combine it across different Promoters; use it to train machine-learning models; or process it for any purpose beyond providing the service.
Automated decision-making: we do not make automated decisions about you that produce legal effects or similarly significantly affect you. Aggregate statistics shown to Promoters (signup counts, locations, referral counts) do not identify you beyond what you submitted.
The Promoter you signed up with — they control the data and can view, export, and manage it.
Our sub-processors (services we use to run Cirqlin):
| Service | Purpose | Location |
|---|---|---|
| Supabase (on AWS) | Database and storage — your contact details are encrypted at rest | Ireland (EU) |
| Vercel | Application hosting and delivery | EU/global edge |
| Cloudflare (Turnstile) | Bot protection on signup forms | Global |
| Resend | Transactional email for Promoter accounts (not used to email fans) | EU |
Services the Promoter may connect (data flows to these only if the Promoter has enabled them, acting on the Promoter's instructions):
| Service | What is shared |
|---|---|
| Mailchimp (Intuit) | Your email, phone, and city, added to the Promoter's audience |
| Bird | Your phone number, added to the Promoter's contact list |
| Meta (Conversions API) | A hashed signup event for advertising measurement |
| TikTok (Events API) | A hashed signup event for advertising measurement |
Each of these operates under its own privacy policy.
Fan contact details (email and phone) are encrypted at rest using symmetric encryption, in a database hosted in Ireland (EU). Access is restricted by tenant-isolation controls; every export or unmasking of contact data by a Promoter is logged. Data in transit is protected by TLS. Please note that ordinary email is not a fully secure transmission method; anything you send us by email is at your own risk.
If a personal data breach affects your data, we will notify the responsible Promoter without undue delay so they can meet their obligations to you, and we will notify you and regulators directly where the law requires us to.
Cirqlin pages are not intended for children. We do not knowingly collect data relating to anyone under 16, and Promoters are prohibited from using Cirqlin to do so. If you believe a child's data has been submitted, contact privacy@cirqlin.com and we will delete it.
We retain fan data for as long as the Promoter uses Cirqlin to run their audience, or until the Promoter deletes it or instructs us to. If a Promoter's account is closed, associated fan data is deleted within 30 days. You can request deletion directly at any time (Section 8) — where we act as processor we will notify the Promoter and act on their instruction or, where required by law, act directly.
Under UK and EU data protection law you have the right to access, correct, export, delete, and object to the processing of your personal data, and to withdraw consent.
The public signup pages set no advertising cookies of our own. We use strictly necessary session cookies on the Promoter dashboard (app.cirqlin.com) for login. Cloudflare Turnstile may set a functional cookie for bot protection. Where a Promoter has enabled a Meta or TikTok pixel on their page, those platforms may set cookies under their own policies — the Promoter is responsible for the lawful configuration of these tools.
Data is stored in the UK/EEA. Where a connected service (Section 4) transfers data outside the UK/EEA, those transfers are governed by that provider's safeguards (such as the UK IDTA or EU Standard Contractual Clauses).
We will post updates to this policy here, with the date above. Material changes affecting fan data will be communicated to Promoters, who are responsible for informing their audiences where required.
privacy@cirqlin.com · Off Pixel Ltd, 124-128 City Road, London, England, EC1V 2NX