Privacy Policy

01 · Who is responsible

imin is the data controller for the ticketing platform. Each event organizer is a separate, independent controller for the attendee data relating to their own events (for example, managing their guest list). Our full legal entity and registration details are being finalized and will be published here once confirmed.

02 · What we collect

• Order details — the name and email you provide at checkout, and the tickets and events you buy.
• Payment data — handled by Stripe. imin does not store your full card number.
• Usage and attribution data — basic analytics about how pages are used, and marketing attribution parameters (such as UTM tags) when you arrive from a campaign link.

03 · Processors we use

We share data only with the service providers needed to run the platform:

• Stripe — payment processing at checkout.
• Resend — sending transactional email (your tickets, order recovery, and refund links), from the imin.support domain.
• Vercel — hosting for the buyer-facing website.
• Railway — hosting for the imin backend and database.
• OpenStreetMap Foundation — the map on an event page is drawn from raster tiles fetched by your browser from tile.openstreetmap.org, which means your IP address and the tile coordinates around that venue reach them directly. It happens on every event page that has a map, whatever you answered in the consent banner, because the map is part of the page you asked for and no tile carries an identifier of ours.
• Meta (Facebook) Pixel and Conversions API— used only when an event’s organizer has connected their own Meta Pixel and you have accepted analytics cookies in our consent banner. If either is absent, no Meta tracking runs.

04 · Cookies, storage & consent

The banner asks one question: may the Meta Pixel run? Press Accept all and it loads; press Essentials only and it never does. Everything below is the full list of what this site stores on your device, whichever you pick.

No cookie is needed to buy a ticket. Checkout hands you to Stripe, which sets its own cookies on its own pages under its own policy, and your order is reached through a link we email you — not through anything stored in your browser.

Cookies

• imin_buyer_session

  Cookie · set by api.imin.wtf · HttpOnly, Secure, SameSite=Lax

  Set by

  imin

  Purpose

  Keeps you signed in to your imin account.

  Lifetime

  180 days, and 90 days without use, whichever comes first. Signing out ends it immediately.

  Legal basis

  Strictly necessary — exempt from consent under ePrivacy Art. 5(3), because it exists only to deliver a service you explicitly asked for by signing in. It is not part of the banner's decision, and declining analytics does not affect it.

  Set only when you sign in — with a password or with Google. Buying as a guest never sets it, and neither does browsing while signed out.

• imin_oauth_nonce

  Cookie · set by api.imin.wtf · HttpOnly, Secure, SameSite=Lax

  Set by

  imin

  Purpose

  A one-time random value that ties a Google sign-in to the browser that started it, so somebody else cannot finish a sign-in in your browser.

  Lifetime

  10 minutes, and it is cleared the moment the sign-in completes.

  Legal basis

  Strictly necessary — a security measure for a sign-in you started. Exempt from consent under ePrivacy Art. 5(3).

  Set only while a Google sign-in is in flight, and cleared the moment it finishes or is abandoned.

• imin.lang

  Cookie · set by this site · not HttpOnly

  Set by

  imin

  Purpose

  Remembers which language you chose in the footer, so pages render in it.

  Lifetime

  One year.

  Legal basis

  Strictly necessary — a display preference you set yourself, and nothing else reads it. Exempt from consent under ePrivacy Art. 5(3).

  The site currently offers English only, so the language switcher that writes this cookie is not shown and it is not set today.

• _fbp, and _fbc if you arrive from a Meta ad link

  Cookie · set by Meta's script running on this site

  Set by

  Meta (Facebook)

  Purpose

  Lets the event organizer measure whether an advert of theirs led to a ticket sale.

  Lifetime

  Set by Meta, not by imin. Their cookie policy is the authority on it.

  Legal basis

  Consent. These exist only after you press Accept all, and only on events whose organizer has connected their own Meta Pixel. If either is missing, no Meta script loads and no Meta cookie is set.

Stored in your browser, not as cookies

These are local and session storageentries. Unlike cookies, your browser never attaches them to a request, so they do not travel to us unless the page deliberately sends them. Clearing this site’s stored data removes all of them.

• imin.consent

  Local storage · not a cookie

  Set by

  imin

  Purpose

  Your answer to the banner above, so it stops asking.

  Lifetime

  Until you clear this site's stored data.

  Legal basis

  Strictly necessary — it is the record of the choice you made, and keeping it is what lets us honour a refusal.

• imin.saved

  Local storage · not a cookie

  Set by

  imin

  Purpose

  The events you tapped save on, on this device. Up to 200.

  Lifetime

  Until you clear this site's stored data. Signing in copies the list to your account.

  Legal basis

  Strictly necessary — a feature you asked for by pressing save.

• imin.anon, imin.attr, imin.fv.*

  Session storage · not cookies

  Set by

  imin

  Purpose

  A random id for this browsing session, the campaign tags in the link you arrived by, and a marker per event you have already been counted for. They are sent to imin's own servers so organizers can see how many people viewed their event and how many started checkout.

  Lifetime

  Cleared when you close the tab. The random id is not linked to your name or email unless you go on to buy, in which case the order records it.

  Legal basis

  First-party measurement of our own service. These are set on every visit, including when you choose Essentials only — that button governs the Meta Pixel, which is a third party, and not this. Whether that is the right treatment under ePrivacy Art. 5(3) is one of the points under review with our counsel, and this paragraph will say plainly what we settle on.

• imin.auth.next

  Session storage · not a cookie

  Set by

  imin

  Purpose

  The page you were heading for when you started a Google sign-in, so the round trip through Google can put you back on it instead of on a generic landing page.

  Lifetime

  Read once by the sign-in callback, which deletes it as it reads. Otherwise it goes when you close the tab.

  Legal basis

  Strictly necessary — it exists only to finish a sign-in you started.

  Only a path on this site is ever stored. Anything else is discarded and the sign-in lands on your tickets.

• imin.refundReceipt

  Session storage · not a cookie

  Set by

  imin

  Purpose

  Carries the refund request you just submitted to the confirmation screen.

  Lifetime

  Deleted the moment that screen has read it.

  Legal basis

  Strictly necessary — it is the page you asked for.

• Offline ticket cache

  Service worker cache

  Set by

  imin

  Purpose

  Copies of the ticket pages you have opened, plus the site's own layout and fonts, so your QR code still opens at a venue with no signal.

  Lifetime

  Until you clear this site's stored data. Older copies are dropped when the site updates.

  Legal basis

  Strictly necessary — offline entry is the feature, and it is why the app can be installed at all.

  Order pages and refund pages are deliberately never cached.

Changing your mind

Cookie settings, in the footer of every page, re-opens the banner with your current answer marked. Either button overwrites imin.consent, so withdrawing costs exactly what agreeing cost.

Declining also expires _fbp and _fbcon every scope this site can address, and the Meta script is not loaded again. A cookie Meta chose to set on a wider scope than this page can reach is the one thing we cannot delete for you; clearing this site’s stored data removes those too.

05 · Your GDPR rights

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• receive your data in a portable form;
• object to, or restrict, certain processing;
• withdraw consent to analytics cookies at any time.

To make a request (a Data Subject Access Request), email contact@imin.support. For data tied to a specific event, the organizer may also be an independent controller; we will help you reach them.

If you have an imin account you can start an erasure yourself from your account. It is scheduled rather than immediate: you get 30 days to cancel, and nothing is erased before that. What is erased and what is kept is set out below.

06 · Retention

We keep order data for as long as needed to deliver tickets, support entry at the door, and meet legal and accounting obligations. As a practical example, order-recovery emails cover purchases from the last 90 days, and refund-request links expire 60 minutes after they are sent.

When you delete your account

Erased after the 30-day grace period: the account itself, the addresses verified on it, saved events, notification preferences and sign-in history.

Kept: the record of what was bought and paid, because accounting law requires it. It is no longer reachable from an account, and nobody at imin uses it to contact you. That record still contains the email address the purchase was made with, so it remains personal data about an identified person — what changes is that no account or profile exists any more and the record is out of every marketing path. Tickets already bought keep working, because the ticket links live on those same records.

How long those purchase records are kept is fixed by accounting and tax law rather than by us, and the exact period is being confirmed with our counsel. It will be stated here as a number of years, and on the deletion screen itself, once it is.

07 · International transfers

Some of our processors may store or process data outside France. The specific safeguards for international transfers are being finalized with our legal counsel and will be detailed here.

08 · Contact

For any privacy question or to exercise your rights, contact contact@imin.support. See also our terms of service.