Privacy Policy

Last updated June 3, 2026

This Privacy Policy describes how Smoking Gun Collective LLC ("BuzzHive", "we", "us", or "our"), a Washington state limited liability company, collects, uses, shares, and protects personal information when you use the ticketing platform at buzzhive.info (the "Platform"). It applies to all visitors, ticket buyers ("Buyers"), and event promoters ("Promoters") who interact with the Platform.

Plain-English summary We collect the minimum we need to sell tickets and run the platform. Stripe handles your payment information — we never see your card numbers. We don't sell your personal information. We share your name and email with the Promoter you bought tickets from so they can communicate about the event. Washington residents have additional rights described in Section 7.

Sections 1. Information we collect 2. How we use information 3. How we share information 4. Cookies and similar technologies 5. Data retention 6. Security 7. Your rights (Washington and elsewhere) 8. Children's privacy 9. Third-party services 10. International transfers 11. Changes to this policy 12. Contact us

1. Information we collect

Information you provide directly

When you buy a ticket: your name, email address, and (optionally) phone number. You may also enter a ticket-transfer recipient's name when applicable.
When you register as a Promoter: your name, email address, business or organization name, and a password (which we store as a one-way hash, never in plaintext). During Stripe Connect onboarding, Stripe collects additional identity-verification information (legal name, date of birth, address, tax ID, bank account); we receive only the account status and connected-account identifier from Stripe and do not see the underlying documents.
When you contact us: your name, email address, the message you send, and an optional order number if you reference one.
When you use the AI chat widget: the messages you send to the assistant and the assistant's replies. Chat sessions are tied to a randomly generated session identifier, not to your personal account unless you are signed in as a Promoter.

Payment information

Payment card details are entered into Stripe's hosted checkout and are transmitted directly from your browser to Stripe. We do not receive or store your full card number, CVV, or bank account number. We receive only the last four digits, the card brand, the payment-intent identifier, and (for Promoters) Stripe's payout status data. Stripe's handling of your payment information is governed by Stripe's Privacy Policy.

Information collected automatically

Usage information: the pages you view, the buttons you click, the events you browse, the time and date of your visit, and similar interaction data.
Device and connection information: your IP address, browser type and version, operating system, device type, referring URL, and approximate location derived from your IP address.
Security-relevant information: failed login attempts, rate-limit triggers, and signals our anti-spam systems use to distinguish humans from bots (such as how long a form was on screen before submission).

Information from other sources

We may receive limited information from Stripe (account status, payout confirmations), email delivery providers (delivery and bounce status), and security vendors (e.g., signals indicating that an IP address has been associated with fraud). We do not buy personal information from data brokers.

2. How we use information

We use the information we collect to:

Process ticket purchases, deliver tickets, and provide confirmation receipts;
Operate the Promoter dashboard, including event creation, order management, refunds, payouts, scanning, and team accounts;
Provide customer support and respond to your inquiries;
Send transactional emails (purchase confirmations, ticket delivery, refund notifications, password resets);
Detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms of Service;
Comply with legal obligations and respond to lawful requests from authorities;
Improve the Platform, including through aggregated analytics about how it is used.

We do not use your personal information to train third-party generative-AI models. We use a third-party large-language model (Anthropic Claude and a third-party CrewAI deployment) to draft and review support replies, and to power the on-site chat assistant. Anthropic's handling of API inputs is governed by its commercial terms; under those terms, inputs are not used to train Anthropic's models by default.

With the Promoter of the event you buy a ticket to

When you buy a ticket, we share your name, email address, phone number (if provided), and order details with the Promoter who is hosting that event. The Promoter needs this information to send you event-related communications, manage door check-in, and handle refunds. Each Promoter is a separate data controller for the data they receive about their Buyers; we are not responsible for how a Promoter uses that information once they receive it.

With Stripe

Stripe receives payment-card data directly from your browser, processes charges, and transfers funds to Promoter accounts. We share order details (amount, currency, Promoter identifier, event identifier) with Stripe to facilitate payments.

With service providers

We share information with vendors that help us operate the Platform, including:

Our web host (Plesk / GoDaddy) for application and database hosting;
Anthropic, for the Claude API that powers support-reply review and the chat widget;
Our CrewAI deployment provider, for support-reply drafting;
Email delivery (SMTP) providers for transactional email;
Slack, for internal team notifications about new support requests.

Each vendor is contractually obligated to use the information only to provide their service to us.

For legal reasons

We may share information when we believe in good faith that disclosure is required by law, regulation, legal process (such as a subpoena or court order), or government request, or necessary to protect the rights, property, or safety of BuzzHive, our users, or the public.

In a business transaction

If BuzzHive is involved in a merger, acquisition, sale of assets, or bankruptcy, personal information may be transferred to the successor entity. We will provide notice on the Platform of any such change.

What we do NOT do

We do not sell your personal information. We do not share your information with third-party advertisers for cross-context behavioral advertising. We do not allow Promoters to share your information with their own marketing partners; if a Promoter sends you marketing email beyond what's necessary to operate the event, that is the Promoter's obligation to handle in accordance with the law (including obtaining your consent where required).

4. Cookies and similar technologies

The Platform uses a small number of essential cookies and similar technologies:

Session cookies — used to keep you signed in to your Promoter account, to power the CSRF protection on our forms, and to remember anti-spam timing information. These are essential and cannot be disabled if you want to use the Platform's authenticated features.
Chat session identifier — a random identifier stored on your device so the AI chat assistant can remember the recent messages in a single conversation.
Local storage — used minimally to remember UI preferences such as which support inbox filter you last selected.

We do not use third-party advertising cookies, retargeting pixels, or cross-site tracking.

5. Data retention

We retain personal information as long as needed to provide the Platform, comply with our legal obligations, resolve disputes, and enforce our agreements. In practice that means:

Order records and ticket records are retained for the life of the account and as required for accounting and tax compliance (generally seven years).
Support requests and chat transcripts are retained for up to two years for quality and dispute-resolution purposes, then deleted.
Failed-login and security-event logs are retained for up to one year.
Marketing-style server logs (IP addresses, user agents) are retained for up to 90 days unless required longer for an investigation.

6. Security

We use reasonable technical and organizational measures to protect personal information. These include HTTPS for all traffic, bcrypt-hashed passwords (we never store plaintext passwords), CSRF protection on state-changing requests, rate limiting, server-side input validation, and access controls on administrative interfaces. No security program is perfect; if you suspect your account has been compromised, please contact us via the contact form immediately.

7. Your rights

Washington residents

If you are a Washington resident, you have rights under Washington law including the Washington Consumer Protection Act (RCW 19.86) and, where applicable, the My Health My Data Act (we do not knowingly collect "consumer health data" as defined in that act through normal Platform use). You may:

Request access to the personal information we hold about you;
Request correction of inaccurate personal information;
Request deletion of personal information, subject to our right to retain information as required by law and to enforce our agreements;
Object to certain processing where you have a basis to do so;
Receive a copy of your personal information in a portable format;
Designate an authorized agent to make a request on your behalf.

Other U.S. residents

Residents of California (CCPA / CPRA), Colorado, Connecticut, Utah, Virginia, and other states with comprehensive privacy laws have rights similar to those above. To exercise any of these rights, use our contact form and select the relevant topic. We will verify your identity (typically by confirming the email associated with your account) before fulfilling the request and will respond within the time required by the applicable law (generally 45 days, extendable by 45 more days if reasonably necessary).

Right to non-discrimination

We will not deny service, charge different prices, or provide a different level of quality to users who exercise their privacy rights.

8. Children's privacy

The Platform is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information without parental consent, please contact us via the contact form and we will delete the information promptly.

Some events listed on the Platform are age-restricted (e.g., 21+). Promoters set the age policy for their event; the Platform does not verify age at purchase. The Promoter or venue is responsible for age verification at the door.

9. Third-party services

The Platform contains links to third-party websites, including Stripe, the U.S. Postal Service, venue websites, and social-media platforms. We are not responsible for the privacy practices of any third-party site you visit. Please review the privacy policy of any third-party site before providing them with personal information.

10. International users

The Platform is hosted in the United States and intended primarily for U.S. residents. If you access the Platform from outside the United States, your information will be transferred to, processed in, and stored in the United States, which may have data-protection laws different from those of your country. By using the Platform, you consent to this transfer. Residents of the European Economic Area, the United Kingdom, and Switzerland should be aware that we rely on appropriate safeguards for cross-border transfers where required.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the current version. If we make a material change we will provide reasonable notice by email or by posting a prominent notice on the Platform before the change takes effect. Your continued use of the Platform after the effective date of a change constitutes your acceptance of the updated Privacy Policy.

12. Contact us

For privacy questions, requests to exercise your rights, or concerns about our handling of your information, please use our contact form and a real person will reply within one business day. Legal notices may also be sent to:

Smoking Gun Collective LLC
Attn: Privacy
Seattle, WA