PRIVACY POLICY

Scube Innovations LLC d/b/a Evenzs.com

Effective Date: October 17, 2026

Supersedes: Privacy Policy dated October 16, 2026

1. Introduction and Scope

1.1. Scube Innovations LLC, a limited liability company doing business as Evenzs.com ("Evenzs," "we," "us," or "our"), provides the Evenzs Ops application for mobile devices and web browsers (the "App") and the website located at evenzs.com (the "Site," and together with the App and all related services, the "Services").

1.2. This Privacy Policy (the "Policy") describes the categories of Personal Information we Process in connection with the Services, the purposes and legal bases for such Processing, the categories of recipients to whom such Personal Information is Disclosed, the retention periods applied, and the rights available to Data Subjects and Consumers under applicable Privacy Laws.

1.3. This Policy applies to the App and the Site. Where a provision applies to only one of them, that provision so states. This Policy does not apply to the practices of third parties that we do not own or control, including any third-party service a user elects to access through a link in the Services.

1.4. Evenzs acts as a Controller (or "business," as that term is defined under applicable United States state Privacy Laws) with respect to the Personal Information described in Section 3, except where Section 3.4 provides otherwise.

1.5. The Services are intended for business and professional use by event operators. By accessing or using the Services, you acknowledge that you have read this Policy.

2. Definitions

2.1. "Consumer" means a natural person to whom rights are afforded under an applicable United States state Privacy Law.

2.2. "Controller" means the entity that determines the purposes and means of Processing Personal Information.

2.3. "Data Subject" means an identified or identifiable natural person.

2.4. "Disclose" means to make Personal Information available to a third party by any means.

2.5. "Event Content" means information a user enters into the App in the course of planning or operating an event, as further described in Section 3.2(b).

2.6. "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Data Subject or household, and includes "personal data" as defined under the GDPR.

2.7. "Privacy Laws" means all applicable laws relating to privacy, data protection, and the Processing of Personal Information, including without limitation the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (collectively, the "CCPA"), the Texas Data Privacy and Security Act (the "TDPSA"), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, Regulation (EU) 2016/679 (the "GDPR"), and the UK General Data Protection Regulation.

2.8. "Process" or "Processing" means any operation performed on Personal Information, whether or not by automated means, including collection, recording, organization, storage, use, Disclosure, transmission, erasure, or destruction.

2.9. "Processor" means an entity that Processes Personal Information on behalf of and under the documented instructions of a Controller, and includes a "service provider" as defined under the CCPA.

2.10. "Sensitive Personal Information" has the meaning given to that term, or to the term "sensitive data," under the applicable Privacy Law.

3. Categories of Personal Information Processed; Sources

3.1. Sources. We Process Personal Information obtained (a) directly from you, (b) automatically from your device or browser through your use of the Services, (c) from our Processors acting on our behalf, including our authentication provider, and (d) from the identity provider you elect to authenticate with, being Apple Inc. or Google LLC, which releases to us the attributes described at Section 3.2(a). We do not acquire Personal Information from data brokers.

3.2. Categories. The following table sets out the categories of Personal Information Processed, mapped to the statutory categories enumerated at Cal. Civ. Code § 1798.140(v)(1).

3.3. Sensitive Personal Information. We do not solicit Sensitive Personal Information. Event Content entered at a user's discretion may contain information that constitutes Sensitive Personal Information under an applicable Privacy Law, including dietary restrictions or accessibility requirements relating to event attendees. Such information is Processed solely to provide the Services and is not used to infer characteristics about any Data Subject. Users are instructed not to enter payment card numbers, government-issued identifiers, financial account information, or health information beyond what is operationally necessary. We do not Process Sensitive Personal Information for the purpose of inferring characteristics, and accordingly the limitation right under Cal. Civ. Code § 1798.121 is not engaged.

3.4. Event Content relating to third parties. Where a user enters Personal Information relating to a guest, teammate, or vendor, the user is responsible for having an appropriate legal basis for doing so and for providing any notice required of that user under applicable Privacy Laws. With respect to such Personal Information, Evenzs Processes on the user's behalf in the capacity of a Processor. Where a user invites a teammate to an event, Evenzs sends an invitation email to the address the user supplies, and further reminders only when the user requests them, no more than once an hour. The email contains the event name and date, the inviting user's name, and the level of access offered.

3.5. Categories not Processed. We do not Process precise or background geolocation, payment card data, device contact lists, device calendar data, or biometric identifiers. Section 6.3 addresses biometric authentication.

4. Purposes of Processing and Legal Bases

4.1. We Process Personal Information for the following purposes: (a) to authenticate users and administer accounts; (b) to provide, synchronize, and support the event workspace and collaboration features; (c) to deliver notifications you have enabled; (d) to secure the Services, prevent fraud and abuse, and investigate security incidents; (e) to diagnose faults and measure and improve performance and feature utility; (f) to respond to support requests and other communications; (g) to conduct voluntary product research as described in Section 7; (h) to comply with legal obligations and to establish, exercise, or defend legal claims; and (i) where you have opted in, to send you product news and planning tips by email.

4.2. Where the GDPR or UK GDPR applies, we rely on the following legal bases: (a) performance of a contract, Art. 6(1)(b), for the purposes at Sections 4.1(a), (b), and (f); (b) consent, Art. 6(1)(a), for the purposes at Sections 4.1(c), (g), and (i), and for the Processing described in Section 5; (c) legitimate interests, Art. 6(1)(f), for the purposes at Sections 4.1(d) and (e), being our interest in operating a secure and reliable service, balanced against the rights and freedoms of Data Subjects; and (d) compliance with a legal obligation, Art. 6(1)(c), for the purposes at Section 4.1(h). Where consent is the legal basis, it may be withdrawn at any time without affecting the lawfulness of Processing carried out before withdrawal.

4.3. Usage data. Feature-use events and screen views (Section 3.2(c)) are used to understand which features are used and to improve the Services, and are associated with your account identifier so that we can count active accounts and erase your usage history when your account is deleted. They never include names, email addresses, telephone numbers, guest details, monetary amounts, event, task or vendor titles, AI conversation text, or imported file contents. You may stop this Processing at any time with the "Share usage data" setting in Settings › Privacy, which takes effect immediately for the App and for events our servers record on your behalf. Error reports and performance diagnostics continue, as they are necessary to keep the Services working.

4.4. Product news by email. We send product news and planning tips only to users who have opted in, by ticking the box offered at sign-up or by turning on "Evenzs news by email" in Settings › Privacy. The box is not ticked by default. The Site's beta request form also offers the box; because anyone can type an email address into a form, we send news to an address given there only after its owner confirms from an email we send to it, and it never changes the choice in your account, which you make in the App. You may withdraw at any time in Settings › Privacy or with the unsubscribe link in each email. Emails concerning your account, such as team invitations and account deletion notices, are not marketing and do not depend on this choice.

4.5. We do not engage in automated decision-making producing legal or similarly significant effects concerning Data Subjects within the meaning of GDPR Art. 22, and we do not conduct profiling in furtherance of decisions that produce such effects for purposes of applicable United States state Privacy Laws.

5. Optional Artificial Intelligence Processing

5.1. Certain features of the App transmit Event Content to OpenAI, L.L.C. ("OpenAI") for the generation of plans, briefs, responses, or drafts.

5.2. No Event Content is transmitted to OpenAI unless and until the user grants permission through an in-App disclosure presented before first transmission. Permission is scoped to the account on the applicable installation.

5.3. Where permission is granted, the categories of Personal Information transmitted may include event names, dates, locations, budgets, guest and vendor names, tasks, notes, run-of-show details, and conversation text. Opening or refreshing an AI-generated brief may initiate a transmission while permission remains in effect.

5.3A. Where a user elects to attach documents or photographs (for example a run sheet, budget, vendor list, or a photograph of a printed plan) so that the App may build an event from them, the content of those files is transmitted to OpenAI for that purpose. Evenzs does not store the attached files on its servers. The text read from them is held on the user's device only until the event is created or the import is cancelled. The App does not import guest names or contact details from attached files.

5.4. Permission may be withdrawn at any time through Settings, which prevents further transmissions from that installation. Withdrawal does not operate retrospectively, and transmissions already effected cannot be recalled.

5.5. Declining or withdrawing permission does not restrict access to the non-AI functionality of the Services.

5.6. Outputs generated by AI features may be inaccurate and should be reviewed before use. Evenzs does not transmit AI-generated drafts to vendors, guests, or other third parties on a user's behalf without that user's action.

6. Device Permissions (App)

6.1. Camera and photo library. Accessed solely where a user elects to add or replace a profile photograph. The resulting image is stored with the user's profile.

6.2. Microphone and speech recognition. Dictation requires microphone and speech recognition permissions granted at the operating-system level. On-device recognition is used where available. Where on-device recognition is unavailable, Apple Inc. may Process the audio through its speech recognition service in accordance with Apple's own privacy terms. Evenzs does not retain dictation audio. Transcribed text becomes Event Content, or an AI prompt under Section 5, only upon the user's submission.

6.3. Biometric authentication. Application unlock may use the authentication result returned by the operating system. Evenzs does not receive, Process, or store biometric templates or other biometric identifiers, and no Processing subject to a biometric information privacy statute is undertaken.

6.4. Each permission described in this Section 6 may be granted or revoked at any time through operating-system settings.

7. Site Visitors and Voluntary Research

7.1. The Site collects Personal Information independently of the App. The waitlist form and the multi-step questionnaire collect the contact details submitted, the respondent's role, the categories of events the respondent operates, and the respondent's answers concerning event operations.

7.2. Personal Information collected under Section 7.1 is Processed for product research and product-development purposes on the basis of the respondent's voluntary submission. Participation is optional and is not a condition of access to the Services.

7.3. Scheduling of consultations is facilitated by Cal.com, Inc., which collects the information necessary to schedule the applicable appointment.

7.4. The App contains no survey or research questionnaire.

7.5. Research responses may be retained in aggregated or de-identified form following deletion of an associated account. Where information is maintained in de-identified form, we maintain such information in de-identified form, do not attempt to reidentify it, and contractually obligate recipients to observe the same restrictions, in accordance with Cal. Civ. Code § 1798.140(m).

7.6. Site analytics. The Site counts page views without cookies and without storing anything on your device. For each page view we record the page visited, the website that referred the visit, campaign tags present in the link (such as utm_source), approximate country derived from IP address, browser and device type, and whether you selected a link to the App Store. Each page view is counted separately and is not associated with a person or profile. This Processing is performed by PostHog, Inc. on our behalf, on the basis of our legitimate interest in understanding how visitors find the Services.

7.7. Site request forms. The Site offers forms to request an invitation to the private beta, to apply to become a vendor partner, and to introduce yourself for work with us. Each form collects the name and email address you enter and the other answers you choose to give: for the beta, your company, approximate number of events a year, the kinds of events you plan, a note, an optional description of an event you are planning, and whether you would like to receive Evenzs news; for vendor partners, your business name, category, city or region, website or social profile, telephone number and a description of your work; for work with us, a link you provide and your note. We use this information to review and answer your request, to send you an invitation, and, for the beta, to offer the event description you entered when you first sign in to the App with the same, verified email address, so that it can be used to draft your plan. We email you once to acknowledge each request; for the beta, that email asks you to confirm your address, and only a confirmed address can receive Evenzs news or have its event description offered in the App. We send a copy of each request to our own inbox using Resend, Inc.; those copies are deleted automatically from the inbox after twelve (12) months, like the request itself (Section 10.6). The Site does not store anything you enter in these forms in your browser; your browser may offer to remember what you type (autofill), which you control in its own settings. The form also contains a field hidden from people, used to recognise automated submissions, and we limit how many requests one email address may send in a day.

7.8. Vendor links. An Event Manager or Planner may share a private link with a vendor booked for their event. The link opens a page on the Site that shows, without an account, the event's name, place and dates, the vendor's own run-of-show items (their time, length, title, place and description), and the name and telephone number of the contact the team chose (by default, the person who shared the link). It never shows notes, statuses, guests, budgets, other vendors or the rest of the team. Anyone who holds the link sees the same page, so it should be sent only to the vendor. The secret part of the link follows a "#" sign, which browsers do not send to web servers; we store only a one-way fingerprint of it. When the page is opened we record the time; when the vendor confirms, we record the time and the name they choose to enter, if any, and the event's team sees both in the vendor's change history. We count requests from each network address for a short time to limit misuse. A link stops working when the team turns it off or shares a new one, when the vendor is removed, cancelled or declined, when the event is archived, or seven (7) days after the event's last day, and is deleted thirty (30) days after it stops (Section 10.7).

7.9. The App in a web browser. The App is also available in a web browser at app.evenzs.com. In a browser the lists in your events (guests, vendors, tasks, budget lines and the rest) are held only while the page is open, and changes are saved only while connected. For each event you open, the browser does keep a small record on your computer: your role, what you may see and change, your own name in the event, which event you last used, when the page last synced, and summary figures (guest counts and money totals). The browser's record also includes which alerts you have looked at (each alert's title and the day it first appeared), the last page you opened, a short log of recent error messages, your display, notification and privacy settings, and, if you ticked the box for Evenzs news emails while creating an account and have not yet confirmed your email, your email address and account number with that choice until you sign in. To keep you signed in, the browser stores your sign-in session and a small marker that ends when you close the browser; when the browser closes, the sign-in is deleted the next time the page opens. If you choose "Keep me signed in on this computer", the sign-in is kept for up to thirty (30) days instead. Signing out deletes the sign-in, the marker and these records, except the privacy choices you made on this computer. Dictation in a browser uses the browser's own speech recognition, which may send the audio to the browser's maker (for example, Google for Chrome) under its own terms; Evenzs does not receive the audio. If you choose to sign in with Google in a browser, you are taken to Google's sign-in page and returned to the App. On the sign-in page, the "Continue with Apple" button is provided by Apple: your browser loads it from Apple's servers when the page opens, which, like any web request, lets Apple see your IP address and browser type, even if you don't use it. If you choose it, Apple's sign-in opens in a small window and Apple sends us a confirmation of your sign-in, and the first time also your name and email address (or Apple's private relay address). If Apple's button cannot load, a button that takes you to Apple's sign-in page is shown instead. What the browser keeps for the App belongs to app.evenzs.com alone; the Site at evenzs.com cannot read it.

7.10. Calendar links. Any member of an event may make a private calendar link for it, which calendar applications such as Apple Calendar, Google Calendar and Microsoft Outlook read to show the event's dates. Each read shows only what the member's role may see at that moment: titles and dates of tasks, milestones, run-of-show items and the event's days, and, for those who see the budget or manage vendors, payment due dates and vendor follow-ups by name only. It never includes amounts, guests or contact details. Anyone who holds the link sees the same dates, so it should not be shared. We store only a one-way fingerprint of the link and the time it was last read; the calendar application's provider receives the dates under its own privacy policy. The member can replace the link or turn it off at any time, which stops it at once; a link stops showing anything when its member leaves the event, and is deleted thirty (30) days after it is replaced or turned off, or with the member's account.

8. Disclosure of Personal Information

8.1. We Disclose Personal Information to the following categories of recipients, each engaged as a Processor under a written agreement restricting Processing to the purposes specified:

8.2. We may additionally Disclose Personal Information: (a) where required by applicable law, legal process, or lawful governmental request; (b) where necessary to establish, exercise, or defend legal claims; (c) where necessary to protect the rights, property, or safety of Evenzs, users of the Services, or the public; and (d) to an acquirer or successor in connection with a merger, acquisition, reorganization, financing, or sale of assets, subject to the obligations of this Policy or a successor policy providing equivalent protection.

8.3. Sign-in to the App is available by email and password, by Sign in with Apple on supported iOS devices, and by federated authentication with Google. Where you elect Sign in with Apple or Continue with Google, the authentication exchange is conducted with that identity provider, which returns to us the attributes described at Section 3.2(a). Your interaction with that identity provider is governed by that provider's own privacy policy, and your account credentials for that provider are never received by Evenzs.

9. No Sale or Sharing of Personal Information

9.1. We do not sell Personal Information and have not sold Personal Information in the preceding twelve (12) months, within the meaning of Cal. Civ. Code § 1798.140(ad) or any analogous provision of an applicable state Privacy Law.

9.2. We do not share Personal Information for cross-context behavioral advertising within the meaning of Cal. Civ. Code § 1798.140(ah), and do not engage in targeted advertising as that term is defined under the TDPSA or any analogous state Privacy Law.

9.3. We do not sell Sensitive Personal Information and do not Process Sensitive Personal Information for purposes requiring an opt-in or notice under the TDPSA.

9.4. We do not knowingly sell or share the Personal Information of any Data Subject under sixteen (16) years of age. See Section 14.

10. Retention and Deletion

10.1. Account and Event Content are retained for so long as the associated account remains active and for such further period as is necessary to provide the Services.

10.2. A user may request deletion of an account through Settings or Profile within the App. Upon such request: (a) account access is restricted immediately; (b) push notification and Lock Screen display registrations are revoked, and calendar links (Section 7.10) are deleted; and (c) Event Content of events on which no other user holds access is scheduled for permanent deletion upon expiry of a thirty (30) day grace period. Events on which other users hold access are retained for those users; the requesting user's account is unlinked from them, and the user is no longer named in their activity records. A user deleting an account may choose why from a short list of reasons and, where something was missing, what it was from a second short list; if a reason is chosen, we record only the choices made and how many days the account existed, without the account identifier or any other detail of the account.

10.3. A deletion request may be cancelled before expiry of the grace period by means of the link sent to the account's email address at the time of the request, or by contacting support. Following permanent deletion, restoration is not possible.

10.4. Notwithstanding Section 10.2, we retain: (a) records of deletion requests and their disposition, for audit and compliance purposes; and (b) such Personal Information as is required to be retained to comply with a legal obligation, to resolve a dispute, or to establish, exercise, or defend a legal claim.

10.5. Diagnostics, analytics, and backup records held by Processors are subject to the retention schedules of those Processors. Restriction of access or deletion of primary records does not effect immediate erasure of previously created backups or of every Processor record. We coordinate Processor follow-up in respect of verified erasure requests.

10.6. Requests made through the Site request forms (Section 7.7) are retained for up to twelve (12) months from submission, or for so long as necessary to manage the resulting relationship if you become a customer, vendor partner or colleague, and are deleted earlier on request to contact@evenzs.com. This applies to the stored request and to the copy sent to our inbox, which an automatic daily process deletes once it is twelve (12) months old.

10.7. The following records are deleted automatically on the schedule stated: (a) conversations with the in-App assistant, thirty (30) days after the last message; (b) records of push notifications sent to a device, whose message content and device token are removed after thirty (30) days, and which are deleted after ninety (90) days; (c) tasks, vendors, run-of-show items, guests and budget lines that a user has deleted, which are hidden from every user at once and kept so they can be recovered if deleted by mistake, including by our support staff at the request of the event's team, thirty (30) days after their deletion; (d) automatically generated event briefs, fourteen (14) days after the day they cover for daily briefs and thirty (30) days after they are generated for operational briefs, except the most recent operational brief of each event; (e) responses generated by AI features and saved for reuse, one (1) day after they expire; (f) vendor links (Section 7.8), thirty (30) days after they stop working; (g) Lock Screen display codes (Section 3.2(e)), when Live Mode is left, when the event ends, when the person leaves the event, or in any case twelve (12) hours after they are given to us; and (h) calendar links (Section 7.10), thirty (30) days after they are replaced or turned off.

10.8. Where no specific period is stated, retention is determined by reference to the purpose for which the Personal Information was collected, the existence of a legal obligation to retain it, and the applicable limitation period for claims.

11. Information Security

11.1. We maintain administrative, technical, and organizational measures designed to protect Personal Information against unauthorized access, disclosure, alteration, and destruction, including access controls, encryption of data in transit, and the storage protections afforded by our Processors.

11.2. No method of transmission or storage is wholly secure, and we do not warrant absolute security.

11.3. We maintain procedures for the assessment and notification of security incidents in accordance with applicable Privacy Laws.

12. International Transfers

12.1. Personal Information may be Processed in the United States and in such other jurisdictions in which our Processors operate.

12.2. Where Personal Information is transferred from the European Economic Area, the United Kingdom, or Switzerland to a jurisdiction not benefiting from an adequacy decision, such transfer is effected pursuant to an appropriate safeguard under GDPR Art. 46, including the Standard Contractual Clauses adopted by the European Commission, together with the UK International Data Transfer Addendum where applicable. A copy of the relevant safeguard may be requested at contact@evenzs.com.

13. Rights of Data Subjects and Consumers

13.1. Rights. Subject to the conditions and exemptions of the applicable Privacy Law, you may have the right to: (a) confirm whether we Process your Personal Information and obtain access to it; (b) obtain a copy of your Personal Information in a portable format; (c) request correction of inaccurate Personal Information; (d) request deletion of your Personal Information; (e) opt out of sale, sharing, targeted advertising, or profiling in furtherance of decisions producing legal or similarly significant effects, noting that we do not engage in such Processing; (f) restrict or object to Processing; (g) withdraw consent where Processing is based on consent; and (h) not be subjected to discrimination or retaliation for the exercise of any right.

13.2. Exercise of rights. Requests may be submitted to contact@evenzs.com. Deletion of an account may also be initiated directly within the App as described in Section 10.2.

13.3. Verification. We will take reasonable steps to verify the identity of a requesting party before acting, and may decline to act on a request that cannot be verified. An authorized agent may submit a request on a Consumer's behalf upon provision of evidence of authority.

13.4. Response times. We respond within forty-five (45) days of receipt of a verifiable request, extendable by a further forty-five (45) days where reasonably necessary and upon notice, or within such other period as the applicable Privacy Law prescribes. Requests under the GDPR are answered within one (1) month, extendable by two (2) further months where necessary upon notice.

13.5. Appeal. Where a request is declined in whole or in part, you may appeal that decision by written notice to contact@evenzs.com bearing the subject line "Privacy Appeal." We will respond to an appeal in writing within sixty (60) days of receipt, stating the reasons for the decision taken. Where an appeal is denied, a Consumer resident in Texas may submit a complaint to the Office of the Attorney General of Texas, and a Consumer resident in another state affording an appeal right may submit a complaint to that state's Attorney General.

13.6. Supervisory authority. A Data Subject in the European Economic Area or the United Kingdom may lodge a complaint with the supervisory authority of their habitual residence, place of work, or place of the alleged infringement.

14. Children

14.1. The Services are directed to adult event professionals and are not directed to, or intended for use by, individuals under eighteen (18) years of age. We do not knowingly Process Personal Information of a child under thirteen (13) years of age within the meaning of the Children's Online Privacy Protection Act.

14.2. Where we become aware that Personal Information of a child has been Processed without appropriate authorization, we will delete that Personal Information. Notice may be given to contact@evenzs.com.

14.3. Personal Information concerning event attendees is to be entered by an authorized organizer only, in accordance with Section 3.4.

15. Third-Party Services and Links

15.1. The Services may contain links to websites and services operated by third parties. Processing undertaken by such third parties is governed by their respective privacy policies, and Evenzs assumes no responsibility for it.

16. Amendment

16.1. We may amend this Policy from time to time. The Effective Date at the head of this Policy identifies the current version.

16.2. Where an amendment is material, we will provide notice by such means as is appropriate in the circumstances, which may include notice within the Services or by email, in advance of the amendment taking effect where required by applicable Privacy Law.

17. Notices and Contact

17.1. Enquiries, requests, and notices under this Policy may be addressed to:

Scube Innovations LLC d/b/a Evenzs.com 2425 Great Path Leander, Texas 78641 United States contact@evenzs.com

17.2. This Policy is made available in a format that may be printed and retained.