1. Introduction

Hold360 ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our event management platform.

2. Information We Collect

We collect information that you provide directly to us, including:

• Name, email address, phone number, and username
• Profile information including job role and profile picture
• Event information, artist details, venue information, and financial data
• Communication preferences and activity logs
• Information from third-party authentication providers (e.g., Google)

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and manage event operations
• Send you technical notices, updates, and administrative messages
• Respond to your comments and questions
• Monitor and analyze usage patterns and trends
• Detect, prevent, and address technical issues and security threats

4. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• With your consent or at your direction
• With service providers who perform services on our behalf
• To comply with legal obligations or protect our rights
• In connection with a business transaction (merger, acquisition, etc.)

5. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the Internet is 100% secure.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

7. Your Rights

You have the right to:

• Access and receive a copy of your personal information
• Correct inaccurate or incomplete personal information
• Request deletion of your personal information
• Object to or restrict certain processing of your information
• Withdraw consent where processing is based on consent

8. Cookies and Tracking

We use cookies and similar tracking technologies to track activity on our service and store certain information. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent.

9. Third-Party Authentication

When you sign in using Google or other third-party authentication providers, we receive limited information from these providers as permitted by your privacy settings with them. We use this information solely for authentication and account creation purposes.

10. Third-Party Integrations and Data Processors

Hold360 uses the following third-party services to operate and to enable optional integrations. Data is shared with each service only to the extent required to provide the corresponding feature, and only after you (or an administrator authorized by you) explicitly enable that integration.

• Supabase (database and authentication hosting) — stores your account, organization, event, and financial data. Subject to Supabase's privacy policy and data-processing terms.
• Vercel (web hosting) — serves the Hold360 web application. Vercel may receive standard server-access logs (IP address, user agent, request path).
• Anthropic (AI features) — when AI-powered features such as expense categorization, reply drafting, or content suggestions are used, the relevant input text is sent to Anthropic's API for processing. Anthropic does not retain this data for training.
• Intuit QuickBooks Online (accounting integration) — when an authorized administrator connects a QuickBooks Online company to Hold360 from Settings → Integrations, Hold360 may send the following data to QuickBooks Online on your behalf: expense transactions (date, amount, vendor name, description, payment method, and category mapping), and a chart-of-accounts identifier you have explicitly mapped. The integration is one-way (Hold360 → QuickBooks). Hold360 reads only your chart-of-accounts metadata (account list, classes, and company info) to enable mapping. You can disconnect the QuickBooks integration at any time from Settings → Integrations → QuickBooks, after which Hold360 will stop sending data and tokens will be invalidated.
• Google (Gmail, Calendar, Contacts, Drive, Sheets) — only when you connect a Google account. See section 11 for exactly what Hold360 accesses and how it is used.

We do not sell your data to any third party. We do not enable third-party advertising on Hold360.

11. Google User Data

Hold360 accesses Google user data only after you (or an administrator of your organization) connect a Google account and approve the requested permissions. Each connection asks only for the permissions its feature needs:

• Email address (userinfo.email) — to show which Google account is connected.
• Send email (gmail.send) — to send emails you initiate in Hold360 (for example employment offers, performance offers, and daily reports) from your own address. Hold360 does not read your mailbox with this permission.
• Read and organize email (gmail.readonly, gmail.modify) — only if you enable the Inbox feature: to display your messages inside Hold360, link them to events and contacts, and apply the read / archive / label actions you choose.
• Calendar (calendar) — to show your Google Calendar events alongside Hold360 events and to create or update the events you choose to sync.
• Contacts (contacts) — to sync the directory contacts you select (for example agents) to your Google Contacts.
• Drive and Sheets (drive.file, spreadsheets) — to save the backups and exports you request into your Google Drive. drive.file only gives Hold360 access to files it creates.

How we use it. Google user data is used only to provide and improve the user-facing features described above. When you use an AI feature on your email (such as request classification or reply drafting), the relevant message text is sent to our AI provider, Anthropic, solely to produce that result for you; it is not used to train AI models.

What we don't do. We do not sell Google user data, use it for advertising, use it to train generalized AI or machine-learning models, or let humans read it — except with your explicit consent, when needed for security or to comply with the law, or when aggregated and anonymized for internal operations.

Storage and deletion. Google access tokens are stored in our database, which is encrypted at rest, and are used to call Google only for the features above. You can disconnect any Google account at any time from Settings → Integrations (or revoke access at myaccount.google.com/permissions); Hold360 then stops accessing it, and you can ask us to delete synced data at privacy@hold360.io.

Hold360's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

12. Children's Privacy

Our service is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: privacy@hold360.io