Privacy Policy

This Privacy Policy explains how Brokerverse, Inc. ("Brokerverse," "we," "us," or "our") collects, uses, shares, and protects information when you use the Brokerverse service (the "Service"). Brokerverse is a business-to-business product intended for professional ticket brokers.

We collect the following categories of information:

• Account and profile information: email address, name, company, phone number, city, state, and broker bio that you provide at sign-up and during onboarding.
• POS credentials: API keys, tokens, account identifiers, and other credentials required to connect your Ticket Evolution, SkyBox, or Ticket Utils account.
• Inventory data: ticket listings synced from your connected POS, including events, sections, quantities, and prices.
• Messages: the contents of messages you send or receive through the in-app messaging features.
• Billing information: handled by our payment processor (Stripe). Brokerverse does not store full bank account numbers on its own systems.
• Usage and device information: log data, authentication events, IP address, browser type, and timestamps generated as you use the Service.

We use the information we collect to:

• Provide, operate, secure, and maintain the Service.
• Synchronize your inventory from connected POS systems and surface it to authorized members.
• Enable broker-to-broker messaging and contact features.
• Send transactional emails (sign-in links, billing receipts, payment-failed notices, message digests, and similar service-related communications).
• Process subscription billing and detect or prevent fraud.
• Comply with legal obligations and enforce our Terms of Service.

We do not currently use member data to train machine-learning models or for advertising.

We do not sell your personal information. We share information only as described below:

• Service providers: infrastructure and tools used to run the Service, including Supabase (database, auth, realtime), Stripe (subscription billing), Resend (transactional email), and Inngest (background sync). These providers process data on our behalf under contractual confidentiality and security obligations.
• Other members: your broker profile (name, company, city, state, bio, avatar) and synced inventory are visible to other authorized members of the Service. Messages are visible to the recipient.
• Legal compliance: when required by law, subpoena, court order, or other valid legal process, or to protect the rights, property, or safety of Brokerverse, members, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of all or a portion of our assets, subject to the receiving party honoring this Policy.

POS credentials are stored encrypted at rest, scoped to your account, and used exclusively to fetch inventory from the POS system you connect. Credentials are never displayed back to you after submission, never shared with other members, and never used for any purpose other than inventory synchronization. You can disconnect a POS connection at any time from /dashboard/pos, which deletes the stored credentials.

[FOR LEGAL/ENG REVIEW: Credential encryption at rest is a planned implementation — see TODO in `lib/pos/` and the product status doc. This Policy must accurately describe the state of encryption at the time of launch. Update wording if the encryption model differs.]

We use cookies only to maintain authenticated sessions through our identity provider. In V1, we do not use third-party analytics, advertising, retargeting, or cross-site tracking cookies. If we add such tools in the future, we will update this Policy and, where required, provide an opt-in mechanism.

We retain account and inventory data for as long as your account is active. When you delete your account, we soft-delete your profile and hide your listings from the Service. Message history sent to or received from other members may be retained on the other party's side so that they continue to have access to their own conversation history. Backups, audit logs, and records required for tax, accounting, or legal compliance may be retained for longer periods as required by law.

You can access, correct, or update your profile information at any time from /dashboard/settings. You can request deletion of your account from the same page. Where applicable law provides additional rights — such as the rights to access, portability, correction, deletion, or to object to processing — you may exercise those rights by contacting us at legal@brokerverse.com.

We use commercially reasonable administrative, technical, and physical safeguards to protect information against unauthorized access, disclosure, alteration, and destruction. These include encryption in transit, row-level access controls, scoped service accounts, and audit logging. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your sign-in email and POS credentials confidential.

The Service is a business-to-business product intended for professional ticket brokers aged 18 or older. It is not directed to children, and we do not knowingly collect information from anyone under 18. If we become aware that we have collected personal information from a child, we will delete it.

The Service is operated from the United States and is intended for use by brokers operating in the United States. If you access the Service from outside the United States, you do so at your own initiative. The Service may not comply with all privacy and data-protection laws of jurisdictions outside the United States.

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice through the Service or by email.

Questions about this Privacy Policy or our handling of your information can be directed to legal@brokerverse.com.