Cookie policy and sub-processor disclosures
Eventually Ticketing publishes public legal pages that disclose the cookies and third-party vendors used across the platform. This article summarizes the current cookie policy and sub-processor disclosures as of August 2026.
Cookie policy
The cookie policy covers cookies, local storage, and tracking pixels used on the marketing website, signed-in application, public registration pages, embedded widgets, and emails. The policy does not use cookies or pixels for advertising or cross-context behavioral tracking.
Google Analytics
The marketing site uses Google Analytics 4 (GA4). The cookie table lists only _ga and _ga_<id>. The legacy _gid cookie used by Universal Analytics has been removed.
Name | Category | Set by | Purpose |
|---|---|---|---|
| Analytics | Google Analytics | Marketing-site analytics |
Other cookies used across the platform include session tokens, Stripe payment identifiers, Cloudflare security and Turnstile tokens, Intercom chat identifiers, and PostHog analytics. On the marketing website, PostHog, Rootabl, Stripe, and Squarespace set consent-related cookies before any consent choice is made. See the full cookie policy on the public site for the complete inventory.
Sub-processors
Eventually Ticketing uses the following sub-processors under written agreements. A 30-day notice is provided before adding or replacing any sub-processor.
Infrastructure
Sub-processor | Role | Region |
|---|---|---|
Salesforce, Inc. (Heroku) | Production application hosting (runs on AWS) | United States (AWS us-east-1) |
Crunchy Data Solutions, Inc. | Managed PostgreSQL database | United States (AWS us-east-1) |
DigitalOcean, LLC | Staging environment hosting (non-production, used for pre-release QA only) | United States |
Cloudflare, Inc. | CDN, DNS, WAF, SSL termination, DDoS protection, bot management, Turnstile | Globally distributed edge; control plane US |
Cloudflare, Inc. (R2) | Object storage for customer-uploaded media and Squarespace event images | Eastern North America (ENAM) |
GitHub, Inc. | Source code repository, CI/CD, container registry. No production customer data is stored here. | United States |
Let's Encrypt (Internet Security Research Group) | SSL certificate authority for staging environment | United States |
Payments
Sub-processor | Role | Region |
|---|---|---|
Stripe, Inc. | Subscription billing for Eventually customers. Ticket payments are processed by the customer's own commerce platform, not by Eventually through Stripe. | United States |
Source platform integration
Sub-processor | Role | Region |
|---|---|---|
Squarespace, Inc. | Source platform — Eventually accesses customer's Squarespace data per OAuth scopes the customer grants | United States |
Communication
Sub-processor | Role | Region |
|---|---|---|
ActiveCampaign, LLC (Postmark) | Transactional email — confirmations, password resets, registration emails to end users | United States |
Peaberry Software, Inc. (Customer.io) | Lifecycle email to Eventually customers. Does not process Squarespace end-user data. | United States (US data center) |
Kit (formerly ConvertKit) | Marketing newsletter and prospect/lead email. Processes data for Eventually's own marketing list, not Squarespace end-user data. | United States |
Intercom, Inc. | In-app messaging and customer support chat. Identifies the signed-in Eventually customer; not loaded for end users on registration pages. | United States (AWS us-east-1) |
Slack Technologies, LLC | Internal operational notifications. Limited metadata, not full personal data records. | United States |
Monitoring and analytics
Sub-processor | Role | Region |
|---|---|---|
Honeybadger Industries LLC | Error tracking. Errors may incidentally include personal data in stack traces; access is restricted. | United States |
Conva Ventures Inc. (Fathom Analytics) | Privacy-friendly, cookieless analytics on the marketing site and public event pages | Canada / United States |
Google LLC (Google Analytics) | Marketing-site analytics only. Not loaded inside the application or on registration pages. | United States / global |
PostHog, Inc. | Product analytics and feature flags inside the authenticated app. Configured with | United States (US Cloud, us.i.posthog.com) |
AI
Sub-processor | Role | Region |
|---|---|---|
Anthropic, PBC | Event-content parsing, answers about a customer's aggregate event statistics, and sample event-content generation for the AI-assisted features | United States |
Frontend services
Sub-processor | Role | Region |
|---|---|---|
Google LLC (Maps Platform) | Address autocomplete and timezone lookup for events | United States / global |
Project management and operations
Sub-processor | Role | Region |
|---|---|---|
Linear, Inc. | Issue and feature tracking. May contain customer support context if tickets reference specific accounts. | United States |
Rootabl | Affiliate program management. Limited metadata only. | To be confirmed |
Customer-direct integrations (not sub-processors)
These integrations are controlled by the customer and are not Eventually sub-processors.
Integration | What it does |
|---|---|
Klaviyo, Inc. | Customer connects their own Klaviyo account; Eventually syncs the Customer's attendee data into the Customer's Klaviyo for the Customer's email marketing. Eventually does not maintain a Klaviyo account that processes Customer data on its own behalf. |
MCP (Model Context Protocol) | Customer connects their own AI vendor; Eventually exposes read-only access to owners and admins, with optional attendee-detail consent. Access is audited and revocable, and the receiving AI vendor is under the customer's own contract. |
Tools that do not process customer personal data
1Password — secrets management; encrypted credentials only
Cursor Bugbot — automated code review on GitHub PRs; no production data access
Flipper — feature flag management (self-hosted on Eventually infrastructure)
Anthropic (Claude) for code review and development — separate from the production AI feature integration
UptimeRobot — uptime monitoring; sends unauthenticated requests to a health-check endpoint and receives only an HTTP status code, with no customer or end-user data
Recent changes
On July 12, 2026, the following updates were published to the public legal pages:
The cookie policy removed the
_gidcookie from the Google Analytics row. The table now lists only_gaand_ga_<id>, matching GA4 behavior.The sub-processors page replaced drafting placeholders with concrete regions: Heroku and Crunchy Data are now listed as AWS us-east-1; Cloudflare R2 is Eastern North America (ENAM); Customer.io is United States (US data center); and Intercom is United States (AWS us-east-1).
Rootabl is explicitly labeled To be confirmed rather than internal placeholder text.
View the full legal pages at /legal/cookie-policy and /legal/subprocessors.