Privacy Notice

Who we are

Ready to Q is the data controller for personal data about artists who hold accounts with us and for the operation of the Service. For guest records that an artist collects at their events, the artist is the controller and Ready to Q acts as their processor. Ready to Q is a registered business operating in Ontario, Canada.

Personal data we collect

• Account data: name, business name, email address, phone number, password credentials, logo and branding settings.
• Guest data entered at events: name, optional age, email address, optional phone number, optional birthday, service and design chosen, any notes the artist adds, and photo or marketing consent choices.
• Photos: event photos captured only where the guest gave photo consent.
• Transaction data: subscription and pass purchases are handled by Stripe, including the billing address Stripe needs to calculate tax, which Stripe holds. We keep order references, the plan bought and its period dates, plus the artist's own note of how a guest said they would pay at a vendor event. Guest payments happen outside the Service, and card details are never seen or stored by us.
• Usage and technical data: log data, device and browser information, IP address, and product analytics about how the Service is used.
• Communications: messages, inquiries and support requests you send us.

Why we use it

To provide and secure the Service (contract), to process payments and prevent fraud (contract and legal obligation), to improve the product and communicate with you (legitimate interests), and to send marketing emails to guests only where the guest explicitly opted in (consent). Consent can be withdrawn at any time.

Who we share it with

• Stripe, Inc. and its affiliates: our payment processor. Stripe handles card processing, billing, sales tax calculation (Stripe Tax) and receipts, and receives the name, email, billing address and payment details needed to do so, processing them under its own privacy policy (stripe.com/privacy), including in the United States. We never see or store your full card details.
• Supabase: database, authentication, file storage and hosting infrastructure.
• Email delivery providers: to send thank-you, review and marketing emails you trigger.
• Authorities: where required by law, and acquirers in the event of a business transfer.

We never sell personal data.

International transfers

Our providers may process data outside your country. Where that happens, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

Retention

Account and guest data is kept while the account is active and for up to 30 days after closure, unless a longer period is required for tax or legal reasons. Purchase and tax records are kept for as long as Canadian tax law requires, generally six years. Artists can delete individual guest records at any time from the customer database.

Event photos are deleted automatically 30 days after the event they were taken at, both the original and any branded copy, unless the artist has separately saved a copy of their own outside the Service. Artists, events and accounts can also be deleted earlier at any time, which removes the photos immediately.

Your rights

Depending on where you live, you may request access, correction, deletion, restriction, portability, or object to processing, and withdraw consent at any time. Guests should contact the artist who served them; artists should contact us through our contact form or at care@readytoq.com. You may also complain to your local data protection authority.

Security

Data is encrypted in transit and at rest, access is isolated per artist account by row-level security, and administrative access is limited to what is needed to run the Service.

Children, in plain terms

Most of what we ask for is simple and temporary: your child's name, and if you'd like, their birthday (month and day only, no year) so we can send a small birthday discount, and your email so we can send you the queue update and photo. That's it, we don't ask for a home address, we don't track your location, and we never see or store your card details.

If you'd like a photo taken, we ask first, no consent, no photo, every time, no exceptions. We then ask separately whether that photo may be shown publicly, and it is only used to show off the artist's actual work, for example in their portfolio or on social media, if you said yes to that second question. Photos are never sold and never shared with advertisers. Photos are automatically deleted 30 days after the event either way, and you can ask the artist to delete your child's information sooner at any time.

Children

The Service is not offered to children. Where a guest is a minor, the artist is responsible for obtaining consent from a parent or guardian before recording data or taking photos. Photo consent is a hard gate: the Service technically prevents a photo from being captured or uploaded for a guest unless consent has been recorded, so this is enforced by the system and not by policy alone. Publishing a photo requires a second, separate consent recorded at the same time. Where both were given, the artist may use the photo to show their own work, including on their mini-site and social media; where only the first was given, the photo is sent to the guest and used nowhere else.