Cookie policy and sub-processor disclosures

Eventually Ticketing publishes public legal pages that disclose the cookies and third-party vendors used across the platform. This article summarizes the current cookie policy and sub-processor disclosures as of July 2026.

The cookie policy covers cookies, local storage, and tracking pixels used on the marketing website, signed-in application, public registration pages, embedded widgets, and emails. The policy does not use cookies or pixels for advertising or cross-context behavioral tracking.

Google Analytics

The marketing site uses Google Analytics 4 (GA4). The cookie table lists only _ga and _ga_<id>. The legacy _gid cookie used by Universal Analytics has been removed.

Name	Category	Set by	Purpose
`_ga`, `_ga_<id>`	Analytics	Google Analytics	Marketing-site analytics

Other cookies used across the platform include session tokens, Stripe payment identifiers, Cloudflare security and Turnstile tokens, Intercom chat identifiers, and PostHog analytics for signed-in users. See the full cookie policy on the public site for the complete inventory.

Sub-processors

Eventually Ticketing uses the following sub-processors under written agreements. A 30-day notice is provided before adding or replacing any sub-processor.

Infrastructure

Sub-processor	Role	Region
Salesforce, Inc. (Heroku)	Production application hosting (runs on AWS)	United States (AWS us-east-1)
Crunchy Data Solutions, Inc.	Managed PostgreSQL database	United States (AWS us-east-1)
DigitalOcean, LLC	Staging environment hosting (non-production, used for pre-release QA only)	United States
Cloudflare, Inc.	CDN, DNS, WAF, SSL termination, DDoS protection, bot management, Turnstile	Globally distributed edge; control plane US
Cloudflare, Inc. (R2)	Object storage for customer-uploaded media and Squarespace event images	Eastern North America (ENAM)
GitHub, Inc.	Source code repository, CI/CD, container registry. No production customer data is stored here.	United States
Let's Encrypt (Internet Security Research Group)	SSL certificate authority for staging environment	United States

Payments

Sub-processor	Role	Region
Stripe, Inc.	Subscription billing for Eventually customers; ticket sales where customers select Stripe checkout	United States

Source platform integration

Sub-processor	Role	Region
Squarespace, Inc.	Source platform — Eventually accesses customer's Squarespace data per OAuth scopes the customer grants	United States

Communication

Sub-processor	Role	Region
ActiveCampaign, LLC (Postmark)	Transactional email — confirmations, password resets, registration emails to end users	United States
Peaberry Software, Inc. (Customer.io)	Lifecycle email to Eventually customers. Does not process Squarespace end-user data.	United States (US data center)
Kit (formerly ConvertKit)	Marketing newsletter and prospect/lead email. Processes data for Eventually's own marketing list, not Squarespace end-user data.	United States
Intercom, Inc.	In-app messaging and customer support chat. Identifies the signed-in Eventually customer; not loaded for end users on registration pages.	United States (AWS us-east-1)
Slack Technologies, LLC	Internal operational notifications. Limited metadata, not full personal data records.	United States

Monitoring and analytics

Sub-processor	Role	Region
Honeybadger Industries LLC	Error tracking. Errors may incidentally include personal data in stack traces; access is restricted.	United States
Conva Ventures Inc. (Fathom Analytics)	Privacy-friendly, cookieless analytics on the marketing site and public event pages	Canada / United States
Google LLC (Google Analytics)	Marketing-site analytics only. Not loaded inside the application or on registration pages.	United States / global
PostHog, Inc.	Product analytics and feature flags inside the authenticated app. Configured with `person_profiles: "identified_only"`.	United States (US Cloud, us.i.posthog.com)

AI

Sub-processor	Role	Region
Anthropic, PBC	NLP processing of event content for the AI-assisted event parsing feature	United States

Frontend services

Sub-processor	Role	Region
Google LLC (Maps Platform)	Address autocomplete and timezone lookup for events	United States / global

Project management and operations

Sub-processor	Role	Region
Linear, Inc.	Issue and feature tracking. May contain customer support context if tickets reference specific accounts.	United States
Rootabl	Affiliate program management. Limited metadata only.	To be confirmed

Customer-direct integrations (not sub-processors)

These integrations are controlled by the customer and are not Eventually sub-processors.

Integration	What it does
Klaviyo, Inc.	Customer connects their own Klaviyo account; Eventually syncs the Customer's attendee data into the Customer's Klaviyo for the Customer's email marketing. Eventually does not maintain a Klaviyo account that processes Customer data on its own behalf.

Tools that do not process customer personal data

1Password — secrets management; encrypted credentials only
Cursor Bugbot — automated code review on GitHub PRs; no production data access
Flipper — feature flag management (self-hosted on Eventually infrastructure)
Anthropic (Claude) for code review and development — separate from the production AI feature integration

Recent changes

On July 12, 2026, the following updates were published to the public legal pages:

The cookie policy removed the _gid cookie from the Google Analytics row. The table now lists only _ga and _ga_<id>, matching GA4 behavior.
The sub-processors page replaced drafting placeholders with concrete regions: Heroku and Crunchy Data are now listed as AWS us-east-1; Cloudflare R2 is Eastern North America (ENAM); Customer.io is United States (US data center); and Intercom is United States (AWS us-east-1).
Rootabl is explicitly labeled To be confirmed rather than internal placeholder text.

View the full legal pages at /legal/cookie-policy and /legal/subprocessors.

Was this helpful?