Privacy policy

1. General provisions

This Privacy Policy sets out how personal data of users of the AOA platform (the "Platform"), available at aoa.com.ua, is collected, used, stored and protected.

The owner and operator of the Platform is Individual Entrepreneur Melnyk Zakharii Volodymyrovych, registered in accordance with the laws of Ukraine (single tax, group 3, non-VAT payer; KVED 62.01, 47.91).

By using the Platform, you consent to the processing of your personal data in accordance with this Policy and the Law of Ukraine "On Personal Data Protection" No. 2297-VI. The Platform is aimed at users in Ukraine, and this Law is the basis for data processing.

The controller of personal data within the meaning of clause 4 of part 1 of Article 2 of the said Law is Individual Entrepreneur Melnyk Zakharii Volodymyrovych (RNOKPP 3724105699), address: vul. Bohatyrska, 6A, Kyiv, 04209. Your personal data is located on the servers specified in section 5 of this Policy.

Legal grounds for processing (Article 11 of the Law): your consent; the need to perform a contract to which you are a party (the Public Offer); the fulfilment of obligations imposed on us by law.

2. What data we collect

Authentication data (OAuth): name, email, avatar, received from the Google and Apple providers when you sign in.

Profile data: gender, date of birth, city, phone number, photos, entered by you voluntarily. The date of birth is needed for the Platform's age rules (section 9), so we ask you to provide it when you first sign in.

Geolocation: the coordinates of your location, used to show venues nearby. Collected only with your explicit permission.

Technical data: IP address, device and browser type, operating system, collected automatically to keep the service working.

Cookies: necessary (sign-in, language, referral code, your cookie choice), analytics and advertising. The list and retention periods are given in section 6.

Push notifications: a subscription token, if you have allowed notifications.

Payment data: processed by the acquiring bank Monobank (JSC "UNIVERSAL BANK"). We do not store full bank card details. Only the masked card number and a token for repeat payments (with your consent) are stored.

Delivery data: the recipient's full name, phone number and the address of the Nova Poshta branch or parcel locker, used to fulfil orders.

Strava data (optional): if you voluntarily connect your Strava account in the settings, we get access only to the following: your Strava ID, name, avatar, and public and private activities (type, distance, duration, date), used to automatically issue rewards from partner venues. Access is granted through standard OAuth 2.0, and you can revoke it at any time: with us (Settings > Account > Strava > Disconnect) or in Strava (strava.com/settings/apps). We do not store the GPS routes of your activities, coordinates, photos, heart rate or power statistics, or other biometric data.

2.1. Partner data: venues, organizations and artists

If you create a venue or organization profile, or an artist or music band profile, on the Platform, some of the data in such a profile may be personal data. In particular:

• The name of an individual entrepreneur (for example, "FOP Ivanenko I. I."), which contains the name of a specific person
• An artist's stage name or the name of a band, if they are firmly associated with a specific person
• An artist's real name, their photos, biography and contact details

Such data is processed on the basis of your consent (Article 11 of the Law of Ukraine "On Personal Data Protection") for the purpose of operating the service: creating and displaying the profile, linking it to Events and communicating with visitors.

Please note: profiles of venues, organizations and artists are public. They are available to all visitors and open to indexing by search engines. More about the scope of publicity, the license to content and the right to turn off a public page is in the Public Offer (section 11).

Use of a partner's name, logo or photos in the marketing materials of the Platform itself (advertising, landing pages, case studies) is carried out only with separate consent and is not covered by this Policy. Publishing photos depicting natural persons requires their consent in accordance with Article 308 of the Civil Code of Ukraine.

You may withdraw your consent to the processing of such data at any time. The withdrawal applies to the future and does not make the processing carried out before that moment unlawful.

2.2. Identity verification through Diia (optional)

If you voluntarily verify your identity using Diia.Signature, we receive from the qualified electronic signature and process: your surname and first name, taxpayer registration number (RNOKPP), unique record number in the Register (UNZR), EDRPOU code (for entrepreneurs), as well as the date of birth and gender derived from the RNOKPP. In addition, technical data of the signature is stored: the certificate serial number, the name of the provider of electronic trust services, and the signing time.

Purpose: confirming that you are a real person and checking your age for events with an age restriction. Legal ground: your consent (clause 1 of part 1 of Article 11 of the Law), which is given directly in the Diia app before the signature is applied. Verification is not mandatory for basic use of the Platform.

This data is used solely for verification and is not shared with venues, event organizers or other users: the organizer only sees an "identity verified" mark, without access to the RNOKPP or other details of the document. The data is stored for as long as your account exists and is deleted together with it. You can contact us to cancel the verification and delete this data separately while keeping your account.

3. How we use your data

• Creating and personalizing your profile
• Showing venues and events near you (geolocation)
• Communication: push notifications and emails about the service and orders
• Processing payments and delivering orders
• Usage analytics (in aggregated, anonymized form)
• Content moderation and user safety
• Age rules: minimum age, events with an age restriction, age groups in AOA Connect (section 9)
• Compliance with legal requirements

4. Data protection

• Data is stored on secure servers with restricted access
• All connections are protected by HTTPS (TLS encryption)
• Sensitive data (tokens, keys) is stored in encrypted form
• Session data has a limited retention period and is deleted automatically
• We regularly review and improve our security measures

4.1. Personal data retention periods

In accordance with part 5 of Article 6 of the Law of Ukraine "On Personal Data Protection", data is stored no longer than necessary for the purpose of its processing. Below are the actual periods configured on the Platform. Deletion runs automatically every day.

Account data (profile, settings, photos, event registrations, saved venues) is stored for as long as your account exists. After you delete the account in the settings, this data is deleted immediately and irreversibly, with no "recovery period". An account cannot be restored after deletion.

Payment and ticket data is stored for up to 1095 days (3 years) after the transaction. This period is due to the requirements of tax law and the limitation period: the amounts, dates and statuses of transactions are needed for reporting, refunds and dispute resolution. Such records are not deleted together with the account, but are anonymized where possible.

Contacts in incomplete orders (email, name, phone entered at checkout without completing payment) are kept for 90 days, after which they are erased, while an anonymized record of the amount and time remains for financial reporting.

Analytics data (page views, steps of event registration, a visitor's path through the website) is kept for up to 3650 days (10 years). This period lets venues and organizers see the long history of visits to their pages. Page view data is also stored in anonymized aggregated form (daily totals only, not linked to a specific person); aggregates are not personal data and are not limited in time.

Technical and security logs:

• Account sign-in attempts: 30 days
• NFC tag and ticket scan attempts: 30 days
• Records of connections to venue rooms: 30 days
• Presence sessions in venue rooms: 60 days
• Messages in venue rooms: 180 days
• Log of sent emails: 180 days
• Hourly venue statistics: 90 days
• Server log files: 14 days

Backups of the database are kept for up to 30 days. Within this period, deleted data may temporarily remain in backups, from which it is removed automatically as they rotate.

If the law sets a longer mandatory retention period (in particular for accounting and tax documents), the period set by law applies.

5. Transfer of data to third parties

We transfer your data to third parties only to the extent necessary to provide the services:

• Monobank (JSC "UNIVERSAL BANK"): payment processing
• LiqPay (JSC CB "PrivatBank"): payment processing as an alternative payment provider: if the event organizer has chosen it, the ticket payment goes through LiqPay. In this case, too, we do not receive or store card details.
• Nova Poshta LLC: delivery of orders
• Google, Apple: authentication (OAuth)
• Resend (Resend, Inc., USA): sending all emails: registration confirmations, tickets, order notifications, newsletters. Your email address, name and the content of the email are transferred.
• Mapbox (Mapbox, Inc., USA): map services. When a map loads, the service learns your IP address and the map area you are viewing. We do not transfer your name, email or profile to Mapbox.
• Telegram (Telegram Messenger Inc.): notifications, the Platform bot and the Mini App (only if you have activated this feature). Your Telegram chat ID and username are processed, as well as the data you send to the bot yourself: your phone number (with your explicit confirmation) and images confirming payment, if you send them.
• Axiom (Axiom, Inc., USA): storage of technical logs of the service for diagnosing failures. Logs may contain the IP address, user ID and technical parameters of the request. We deliberately do not write passwords, card details or full document data to the logs.
• Strava: receiving data about sports activities (only if you have connected the integration). We do not publish Strava data on your behalf and do not transfer it to partner venues in its original form: the venue only sees the reward issued and the fact that the rule criterion was met (activity type + distance). We do not create new activities in your Strava account.
• Meta (Facebook, Instagram): to understand which ad brought you to us, and so as not to show you the same ad if you have already registered. We transfer a minimal set of data: email, phone and name only as a SHA-256 hash (an irreversible fingerprint). Meta can match it with the data of its own users, but cannot recover your email or name from it. Data of Users under 18 is not transferred to Meta.

Storage infrastructure. The database, cache (Redis) and the files you upload are hosted on a rented dedicated server in the European Union. Only authorized persons of the Controller have access to the server. Backups are stored there as well and may also be duplicated to the hosting provider's object storage.

Cross-border transfer (Article 29 of the Law). Some of the recipients listed above are located outside Ukraine, in particular Resend, Axiom, Google, Apple, Mapbox and Meta (USA), and Telegram. Data is transferred to these services on the basis of your consent and is necessary to perform the contract with you (sending a ticket by email, signing in with Google or Apple, showing a map). We transfer the minimum necessary amount of data and engage only providers that publicly declare the use of standard contractual clauses for data protection. If you do not want such a transfer, you may choose not to use the relevant feature (for example, not to connect Telegram); the basic features of the Platform will remain available, except those that are technically impossible without sending email.

We do not sell your data. Everything we share with partners is needed only for the service to work or to measure the effectiveness of our advertising.

6. Cookies and analytics

Cookies on the Platform are divided into three groups. Necessary cookies are always on: without them, sign-in, security and saving settings are impossible. Analytics and advertising cookies are optional. We show the cookie banner where the law requires prior consent (in particular in the EU). In that case, new analytics and advertising cookies are set only after your consent (the "Accept" button or a choice under "Customize"), and the "Necessary only" button leaves only the necessary ones. Simply continuing to browse is not considered consent.

Necessary (no consent required):

• Session: to maintain authentication and security
• Locale: to save the selected interface language (Ukrainian/English)
• Referral: to track referral invitations (period: 7 days)
• Your choice (aoa_consent): remembers what you agreed to, so we do not ask on every page. Period: 12 months after consent, 6 months after refusal.

Analytics (with consent):

• aoa_vid: a random visitor ID, used to count unique people correctly and not to count one visit several times. Period: 365 days.
• aoa_js: the number of the current visit, used to link steps on the website into one path. Period: 30 minutes of inactivity.
• aoa_src, reg_utm_*, reg_referrer, reg_landing_path, reg_last_*: remember where you came from (search, Telegram, a newsletter, an ad campaign), so we can see which channels work. Period: up to 30 days, 24 hours for reg_last_*.
• Google Analytics (_ga, _ga_*): website visit statistics (Google Ireland Limited / Google LLC). Period: up to 2 years. Without your consent, Google Analytics does not set or read cookies and receives only anonymized signals without an identifier (Google Consent Mode).

Advertising (with consent):

• Meta Pixel (_fbp, _fbc): measuring the effectiveness of our ads on Facebook and Instagram (Meta Platforms Ireland Ltd.). Period: 90 days.
• reg_fbclid, reg_fbc, reg_gclid, reg_ttclid: the ID of the ad click you came from. Period: 30 days.
• Organizer tags: on the event pages of organizers who have connected their own Meta Pixel or Google tag, these tags load only with your consent to advertising cookies.

You can change or withdraw your choice at any time as easily as you made it: the "Cookies" link at the bottom of the website or the cookie settings here. After withdrawal, we do not set new optional cookies and do not use those already stored. You can delete them in your browser settings.

Important about analytics. The aoa_vid identifier does not contain your name or email, but it pseudonymously distinguishes your browser from others. Therefore, under the Law it is considered personal data, and we do not claim that all analytics is fully anonymized. Together with it, page view records store an ipHash, an irreversible cryptographic hash of your IP address (used if the cookie is missing). The IP address itself does not get into such records. Clicks on short links and QR codes are counted in the same way: the record holds a visitorHash, an irreversible hash of aoa_vid, and without this cookie (for example, if you have refused analytics cookies) a hash of the IP address together with the browser name and language that the browser sends itself.

Only the daily aggregated totals of page views are anonymized without reservation: they store only numbers, and it is impossible to identify a specific person from them.

You can delete or block these cookies at any time in your browser settings; this will not affect access to the main features of the Platform.

7. Your rights

In accordance with Article 8 of the Law of Ukraine "On Personal Data Protection", you have the right to:

• Know the sources of collection and the location of your personal data, the purpose of its processing, and the location and name of the Controller (this information is given in sections 1, 2 and 5 of this Policy)
• Receive information about the conditions for granting access to personal data, in particular information about the third parties to whom it is transferred
• Access your personal data, including receiving a copy of it in a machine-readable format
• Receive, no later than 30 calendar days from the date the request is received, an answer as to whether your data is being processed, and information about its content
• Submit a reasoned objection to the Controller against the processing of your personal data
• Submit a reasoned request to change or destroy your personal data if it is processed unlawfully or is inaccurate
• Protection of your personal data against unlawful processing and accidental loss, destruction or damage
• File complaints about the processing of your personal data with the Ukrainian Parliament Commissioner for Human Rights or with a court
• Use legal remedies in the event of a breach of personal data protection law
• Make reservations regarding the restriction of the right to process your personal data when giving consent
• Withdraw consent to the processing of personal data (the withdrawal applies to the future and does not make the processing carried out before that moment unlawful)
• Know the mechanism of automatic processing of personal data and be protected against an automated decision that has legal consequences for you

Automated decisions. The Platform does not make decisions about you that have legal consequences solely by means of automated processing. Automatic mechanisms (for example, matching people or recommending events) are for information only and do not limit your rights; you can always turn them off in the settings or ask us to have a decision reviewed by a person.

7.1. How to exercise your rights

You can exercise your rights as follows:

• Yourself, in your account: view and correct profile data in the "Profile" section; change your consents to notifications and marketing in the "Settings" section; disconnect connected services (for example, Strava or Telegram) in the same place; delete your account together with the related data in "Settings > Account"
• Unsubscribe from newsletters: using the "Unsubscribe" link in any email; this turns off all marketing messages
• By written request: send a request to support@aoa.com.ua with the subject "Personal data". This applies to requests that cannot be fulfilled in your account: obtaining a copy of your data, objecting to processing, requesting that data be changed or destroyed, cancelling verification through Diia

We consider a request within 30 calendar days of the date it is received. To protect your data from others, we may ask you to confirm your identity, for example by sending the request from the email address linked to the account. The service is free of charge. If we refuse to satisfy a request, we inform you of this and give our reasons.

7.2. Users from the European Union

The Platform is aimed at users in Ukraine and does not direct its activities at the European Union market. However, if you are in the EU, you additionally have rights under Regulation (EU) 2016/679 (GDPR), to the extent the Regulation applies to the processing of your data: the right of access, rectification, erasure, restriction of processing, objection to processing and data portability. To exercise these rights, use the same procedure as described in clause 7.1.

8. AI assistants and external integrations

AOA can be connected to AI assistants (ChatGPT, Claude, Gemini, Muse) and to booking services (Reserve with Google). Through these channels you can search for venues and events, book a table and register for events without opening the website. Below is what happens to your data in this case.

8.1. What we receive from the assistant

AI assistants do not pass your identity to us: no name, phone number or email. We receive only anonymized technical signals: an anonymous session ID, the interface language and an approximate city (to suggest which city to search in). These signals are used solely to protect against abuse and for language localization, and do not allow you to be identified.

8.2. Data you enter yourself

To book a table without an account, you enter your name and phone number in the form inside the booking card. This data is sent directly to us and is needed by the venue to welcome you and confirm the booking. We do not take contacts from the text of your conversation with the assistant, even if you mentioned them in the chat.

The venue where you book sees your name, phone number, date, time, number of guests and booking comment, as well as a mark that the booking was created through an assistant.

8.3. Connecting an AOA account

If you connect your AOA account to an assistant, we show a consent screen with a list of permissions. The assistant receives limited access on your behalf: viewing your bookings, creating and cancelling them, and registering you for events. Access is valid for 180 days and can be revoked at any time in your account settings. Your password or access keys are never passed to the assistant.

8.4. What is shared externally

In responses to the assistant, we pass only public information about venues and events and the details of your booking (date, time, number of guests, status). Your phone number and name do not get into the text of the conversation: technically, they are passed through a separate channel available only to the booking card interface, not to the language model.

8.5. Storage and deletion

Guest booking data is stored on the same basis as regular bookings (see the section on retention periods). To delete a guest booking and the contacts related to it, write to us at the email address in the "Contact information" section, and we will delete them within 30 days. If the booking was created from a connected account, it is deleted together with the account.

9. Age restrictions and data of minors

Minimum age. The Platform can be used from the age of 16. The Platform does not accept a date of birth according to which a person is under 16. We do not knowingly collect data of persons under 16. If we learn of such an account, including from parents, we block it and, within 30 days, delete the personal data, except records that the law requires us to keep (section 4.1).

Users aged 16 to 18. We process their data on the same grounds as adults' data (Article 11 of the Law): performance of a contract (the Public Offer) and consent. The current Law does not set a separate age from which a person can consent to the processing of their own data. For online services in the EU, this age is, as a general rule, 16 (Article 8 GDPR), and the Platform's minimum age is the same. We also use the date of birth to protect minors (clause 6 of part 1 of Article 11 of the Law): not to sell them tickets to events with an age restriction and not to match them with adults in AOA Connect.

What is different for ages 16-17. In AOA Connect, minors are matched in pairs and at tables only with peers aged 16 to 18, and meetings are not scheduled in bars or pubs. For events with an age restriction, a ticket is not sold and registration is not accepted. In all other respects, including venue rooms, analytics and newsletters, the data of Users aged 16 to 18 is currently processed in the same way as adults' data. Special purchase rules for minors are described in the Public Offer (section 3.1).

Parents' rights. The parents (adoptive parents) or custodian of a minor, as their legal representatives (Article 242 of the Civil Code of Ukraine), may exercise the rights in section 7 on the minor's behalf: find out what data we process, request that it be corrected or destroyed, and delete the account. Write to support@aoa.com.ua with the subject "Personal data of a minor". To protect the child's data, we will ask you to confirm that the request comes from a legal representative. We reply within 30 calendar days.

Safety. You can report or block a person in a venue room (on the person's card) and in AOA Connect. How this works is described in the Public Offer (section 12). Complaints are reviewed by the AOA team, which may restrict or block the offender's account.

10. Changes to the Policy

We may update this Privacy Policy. We will notify you of material changes by email or by a notification in the app. The date of the last update is shown at the beginning of the document. Continued use of the Platform after the changes are made means your agreement with the updated Policy.

11. Contact information