Cookie policy and sub-processor disclosures
Eventually Ticketing publishes public legal pages that disclose the cookies and third-party vendors used across the platform. This article summarizes the current cookie policy and sub-processor disclosures as of October 2026.
Cookie policy
The cookie policy covers cookies, local storage, and tracking pixels used on the marketing website, signed-in application, public registration pages, embedded widgets, and emails. The policy does not use cookies or pixels for advertising or cross-context behavioral tracking.
Google Analytics
The marketing site uses Google Analytics 4 (GA4). The cookie table lists only _ga and _ga_<id>. The legacy _gid cookie used by Universal Analytics has been removed.
Name | Category | Set by | Purpose |
|---|---|---|---|
| Analytics | Google Analytics | Marketing-site analytics |
Other cookies used across the platform include session tokens, Stripe payment identifiers, Cloudflare security and Turnstile tokens, Intercom chat identifiers, and PostHog analytics.
Consent behavior
Visitors in the European Economic Area, the United Kingdom, Switzerland, and visitors whose location cannot be determined must opt in: nothing in the Functional or Performance and Analytics categories loads or writes browser storage until the visitor allows it. Visitors everywhere else, including the United States, are treated as having allowed both optional categories from their first visit, and can turn them off at any time.
PostHog does not load until Performance and Analytics is allowed. Each consent choice is recorded with the visitor's country, IP address, and browser user agent, and the record is kept for two years as evidence of consent.
The marketing website is governed by Squarespace's own cookie banner and categories. In the United States, Squarespace's optional categories are enabled by default, so Squarespace cookies, Stripe fraud-prevention cookies, PostHog analytics cookies, and Rootabl referral cookies can be set before any choice is made.
See the full cookie policy for the complete inventory.
Sub-processors
Eventually Ticketing uses the following sub-processors under written agreements. A 30-day notice is provided before adding or replacing any sub-processor.
Infrastructure
Sub-processor | Role | Region |
|---|---|---|
Salesforce, Inc. (Heroku) | Production application hosting (runs on AWS) | United States (AWS us-east-1) |
Crunchy Data Solutions, Inc. | Managed PostgreSQL database | United States (AWS us-east-1) |
DigitalOcean, LLC | Staging environment hosting (non-production, used for pre-release QA only). The staging copy contains no attendee data, user accounts, or Squarespace credentials. | United States |
Cloudflare, Inc. | CDN, DNS, WAF, SSL termination, DDoS protection, bot management, Turnstile | Globally distributed edge; control plane US |
Cloudflare, Inc. (R2) | Object storage for customer-uploaded media, Squarespace event images, signed waiver PDFs, and images used in emails | Eastern North America (ENAM) |
GitHub, Inc. | Source code repository, CI/CD, container registry. No production customer data is stored here. | United States |
Let's Encrypt (Internet Security Research Group) | SSL certificate authority for staging environment | United States |
Payments
Sub-processor | Role | Region |
|---|---|---|
Stripe, Inc. | Subscription billing for Eventually customers, and payment for domains or websites bought through Eventually. Ticket payments are processed by the customer's own commerce platform or their own Stripe account via Stripe Connect, not through Eventually's Stripe account. | United States |
Source platform integration
Sub-processor | Role | Region |
|---|---|---|
Squarespace, Inc. | Source platform: Eventually accesses customer's Squarespace data per OAuth scopes the customer grants, and sends specified customer and registrant details to Squarespace when provisioning a domain or website | United States |
Communication
Sub-processor | Role | Region |
|---|---|---|
ActiveCampaign, LLC (Postmark) | Transactional email: confirmations, password resets, registration emails to end users | United States |
Peaberry Software, Inc. (Customer.io) | Lifecycle email to Eventually customers. Does not process Squarespace end-user data. | United States (US data center) |
Kit (formerly ConvertKit) | Marketing newsletter and prospect/lead email. Processes data for Eventually's own marketing list, not Squarespace end-user data. | United States |
Intercom, Inc. | In-app messaging and customer support chat. Identifies the signed-in Eventually customer; not loaded for end users on registration pages. | United States (AWS us-east-1) |
Slack Technologies, LLC | Internal operational notifications. Alerts can include team, site, and event names, attendee names, and selected checkout or billing emails for flagged orders. Not full personal data records. | United States |
Monitoring and analytics
Sub-processor | Role | Region |
|---|---|---|
Honeybadger Industries LLC | Error tracking (backend and frontend). Errors may incidentally include personal data in stack traces; access is restricted. | United States |
Functional Software, Inc. (dba Sentry) | Error and performance monitoring (backend and frontend), alongside Honeybadger. Errors may incidentally include personal data in stack traces; signed-in users are identified by ID and email only, and access is restricted. Page-load timing is sampled for a subset of visits. | United States |
Conva Ventures Inc. (Fathom Analytics) | Privacy-friendly, cookieless analytics on the marketing site, public event and series pages, and application pages, whether signed in or not | Canada / United States |
Google LLC (Google Analytics) | Marketing-site analytics only. Not loaded inside the application or on registration pages. | United States / global |
PostHog, Inc. | Product analytics inside the application and on the marketing site, plus server-side error capture. Events use internal IDs rather than names, email addresses, or phone numbers. Configured with | United States (US Cloud, us.i.posthog.com) |
AI
Sub-processor | Role | Region |
|---|---|---|
Anthropic, PBC | Event-content parsing, answers about a customer's aggregate event statistics, and sample event-content generation for the AI-assisted features. Attendee personal data reaches Anthropic only in two cases: attendee lookups, which an owner or admin must turn on, and order matching, where an ambiguous order is sent with the checkout email, billing and shipping names, and the names and email addresses of candidate registrations. Under Anthropic's commercial terms, submitted data is not used to train models. | United States |
Frontend services
Sub-processor | Role | Region |
|---|---|---|
Google LLC (Maps Platform) | Address autocomplete on event location forms and on the registrant address form when a customer buys a domain or website, and timezone lookup for events. Processes the IP address and search query at the time of lookup. | United States / global |
Project management and operations
Sub-processor | Role | Region |
|---|---|---|
Linear, Inc. | Issue and feature tracking. May contain customer support context if tickets reference specific accounts. | United States |
Rootabl | Affiliate program management. Rootabl's script runs in the visitor's browser on our sign-up page, only after Performance and Analytics consent, and receives the visitor's IP address, browser user agent, and referral identifiers. | United States |
Customer-direct integrations (not sub-processors)
These integrations are controlled by the customer and are not Eventually sub-processors.
Integration | What it does |
|---|---|
Klaviyo, Inc. | Customer connects their own Klaviyo account; Eventually syncs the Customer's attendee data into the Customer's Klaviyo for the Customer's email marketing. Eventually does not maintain a Klaviyo account that processes Customer data on its own behalf. |
MCP (Model Context Protocol) | Customer connects their own AI vendor; Eventually exposes read-only access to owners and admins, with optional attendee-detail consent. Access is audited and revocable, and the receiving AI vendor is under the customer's own contract. |
Tools that do not process customer personal data
1Password: secrets management; encrypted credentials only
Claude Review: automated code review on GitHub PRs, run from a founder's own machine using Anthropic's Claude; code review only, no production data access
Flipper: feature flag management (self-hosted on Eventually infrastructure)
Anthropic (Claude) for code review and development: separate from the production AI feature integration
UptimeRobot: uptime monitoring; sends unauthenticated requests to a health-check endpoint and receives only an HTTP status code, with no customer or end-user data
Recent changes
The Cookie Policy, Privacy Policy, Terms of Service, and Sub-processors pages are published at their /legal/ routes, without a legal-review banner. The publication set the US opt-out and EU/UK/Switzerland opt-in consent model, two-year retention for consent records, revised vendor disclosures including Rootabl's region now listed as the United States, and clarified which tools load before consent.
The public pages are the authoritative, current versions of these documents; this article summarizes them.