Privacy policy

What we collect, why, who sees it, and your rights under the New Zealand Privacy Act 2020 and, if you are in the European Union or the United Kingdom, the GDPR.

Last updated 30 October 2026.

Who we are: Comealong is run by AIM Dev Ltd, a software studio in Auckland, New Zealand. We decide how most of the details below are used. For an organiser's news emails and texts, the organiser decides who gets them and what they say, and we send them on the organiser's behalf. For anything about your details, write to us through the AimDev support page linked below.
If you book a ticket: We keep your name, email, phone number if you gave one, your answer to the organiser's question, what you booked, how you paid and whether you arrived. The organiser of that event and the people they named to help run it see these. Nobody else does. An organiser can also add you from a guest list they upload: then we keep the name and email they give, and may email you your ticket.
If you came through a promoter's link: The booking notes whose link you used, and a cookie remembers it for 30 days for that event. The promoter sees how many people opened their link, how many tickets were booked and the money they brought in, never who booked. If a promoter gives you a free ticket themselves, they see the name and email they entered for you.
If you give or pass a ticket to someone: We keep the name and email you enter for that person and use them to send the ticket and the reminder for that event. Nothing else is sent to them.
If you resell a ticket: We keep the ticket you listed, its price and who bought it. The organiser sees the seller's name and email and the buyer's name, so they can send the seller's money back. The buyer does not see who sold it. When it sells, the old ticket's code and any wallet pass stop working, and the buyer gets a new code.
If you register for a presale: We keep your name, email, how many tickets you asked for and of which types, and your place in the draw. The organiser sees these. For a ballot paid by card, Stripe saves your card on the organiser's Stripe account, and we keep only Stripe's reference to it. It is charged only if you are drawn. You can withdraw before the draw (for early access, before you book).
If you pay by bank transfer, PayPal or from your bank app: A transfer goes from your bank straight to the organiser. We never see your bank login. If you choose PayPal, you pay the organiser inside PayPal, and PayPal tells us when the payment is complete. When an event offers payment from your bank app, you approve it inside your own bank through Akahu, a New Zealand open banking provider. Akahu tells us whether it went through and which account it came from; we keep that account number so a refund can go back to it. If you are refunded by transfer, we ask for the account number to send the money to and show it to the organiser who is refunding you.
If you pay by card or Afterpay: You pay on Stripe's page, into the organiser's own Stripe account. Stripe receives your email address and the amount. We never see or store your card number; we keep only Stripe's reference for the payment, so that a refund can go back to the same card. For a presale ballot, or an event that goes ahead only with enough bookings, Stripe saves your card on the organiser's account to charge it later, as the terms explain. If you choose Afterpay on Stripe's page, Afterpay handles that payment under its own terms and privacy policy.
If you organise events: We keep your name, email, the identifier of the AimDev account you sign in with, the photo, description and link you add, your events, and the bank account number you want guests to pay into. Guests who choose bank transfer see your name and that account number. We also keep the monthly statements of our fees, including the texts you sent. If you add promoters, we keep the name and email you give for each. If you paste a link to fill in a new event, our server fetches that public page once; what you paste is read on our own servers and is not kept unless you save the event. If you connect Telegram, your booking alerts, with guests' names, go to your Telegram chat.
If you join a waitlist or ask us for help: We keep your name and email and use them only for that: to offer you a place, or to answer you.
If you follow an organiser: We keep your email, the organiser you follow and the language you followed in, and send you one email for each new public event they announce. That organiser sees your email address in their list of followers. Every email has a link that stops them at once. Stopping removes you from their followers, and we keep a note that you said no, so they cannot write to you again.
News from an organiser: When you book, you can tick a box to get news from that organiser. It starts unticked. Following an organiser puts you on the same list. We keep your email, name and language, and when and on which event you said yes. Your yes is to that organiser only. The organiser decides whether to write, what to say and to whom; we send it for them. They see your name and email on their list. We count whether you click the event button in their email, so they can see how many people did. Every email has a one-click unsubscribe link, which also ends a follow of that organiser. After that nothing more is sent to you from them, unless you say yes again.
Texts: If you give a phone number and tick the box when you book, the organiser can text you about that booking: the day-before reminder, and messages about the event. Texts go through WebSMS, a New Zealand text gateway, from its short code; WebSMS receives your number and the text. Every text has a link that stops texts from that organiser to your number, on all your bookings.
What we use it for: To run bookings, presales and resales, send tickets and reminders, pass on messages from the organiser about the event you booked, send an organiser's news and texts to the people who said yes to them, and stop abuse. We do not send our own marketing to guests, sell or rent anyone's details, show advertising, or use analytics or advertising trackers from other companies.
Cookies and what stays on your device: Cookies keep an organiser signed in and remember which organisation they act for, remember your language, and remember for 30 days the name of the link that brought you here, if that link carried one (for example a post in a group), so we can see which posts bring people; we note that name with a booking you make. If you came through an aimdev.site address and the link carried campaign tags, a cookie shared across aimdev.site keeps the first ones for 90 days, so the AimDev account service can note them if you sign up. For an event, one cookie remembers a promoter's link for 30 days, and one keeps your place in a waiting room for a day. One keeps a new event you are drafting for 7 days. None of them holds your name or contact details. The door screen keeps the guest list on the organiser's phone so entry works without a signal.
Who else handles your details: The service runs on servers we operate ourselves in Auckland. Cloudflare carries the traffic and stores our backups. Resend, in the United States, delivers our emails. WebSMS, in New Zealand, delivers texts when an organiser sends them. Stripe handles card payments, saved cards and the cards organisers save for our fees. Afterpay handles payments made with Afterpay. PayPal handles PayPal payments. Akahu, in New Zealand, handles payments from your bank app once we offer them. Sign-in uses the AimDev account service, which offers Google, Facebook, Apple or email. An Apple Wallet pass is a file we make that goes straight to your phone. If you add a ticket to Google Wallet, we send Google the event and the name on the ticket. Organisers who connect Telegram get their alerts through Telegram. Maps are pictures our server draws from OpenStreetMap tiles, so your device does not contact OpenStreetMap; the address search organisers use sends what they type to Photon (komoot). An event page may show a YouTube video the organiser added; YouTube sees your IP address when it loads. Our servers keep IP addresses in short-lived logs and use them to limit repeated requests.
How long we keep it: For as long as the event's organiser keeps their account, or until you ask us to delete it. We delete on request unless the law requires us to keep a record: fee statements, for example, are kept for seven years. A yes to an organiser's news lasts until you unsubscribe; after that we keep only the note that you did, so you are not written to again.
If you are in the European Union or the United Kingdom: We use your details to give you what you asked for (a booking, a presale registration, a resale), with your consent (an organiser's news, texts, following), for our legitimate interest in keeping the service safe and seeing which links bring people, and to keep the records the law requires. You can withdraw a consent at any time with the link in the email or text. You can also ask us to restrict or stop a use of your details, and to give you your details in a form you can take elsewhere. You can complain to the data protection authority where you live. The European Commission and the United Kingdom recognise New Zealand as protecting personal data adequately. Some of the companies above are in the United States and handle your details under their own data processing terms.
Your rights: You can ask to see the details we hold about you, to have them corrected, or to have them deleted. We answer within 20 working days. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).
Changes: If this policy changes we will publish the new version here with its date.

AimDev support →