Privacy Policy

Personal data we collect

Depending on how you use the site, we may collect:

• Contact and profile details: your email address (stored in normalized form), first and last name, Instagram handle, WhatsApp phone number, and preferred language.
• Waitlist and referral data: your position in the waitlist queue, your referral code, who referred you and whom you invited, and your invite counts.
• Game data: your points balance and a ledger of the point-earning actions you take, plus your "I'll be there" interest in each realm.
• Ticket orders: order information synced from Fourvenues, including the buyer email, per-attendee emails, and order totals and currency.
• Merch orders: purchases processed through Shopify.
• Realm Keys and check-ins: the venue check-ins ("Realm Keys") you collect and the perks you earn.
• Form submissions: sponsor and promoter enquiries, including brand, email, contact name, and message.

Analytics and tracking

We use PostHog for product analytics to understand how people use the site. This includes:

• Autocapture of pageviews and clicks, and capture of errors and exceptions.
• Session replay, which records your on-page interactions. Text you type into inputs is masked and is not recorded.
• Storage of a first-party analytics identifier in your browser's localStorage and cookies. Analytics data is sent through a first-party proxy (palms.tulumbible.com).
• A cross-app visitor id (tb_visitor_tbu_id) that helps recognize you across our sibling Tulum sites.

We also use advertising measurement so we can tell whether our ads work: the Meta Pixel, the TikTok Pixel and the Google tag (Google Ads) in your browser, and the Meta and TikTok server-side counterparts (Meta Conversions API, TikTok Events API), which receive the same events from our backend together with a hashed form of your email, phone number and name and the platforms' own click identifiers. We may also use Plausible, a cookieless analytics tool. In the European Union, the EEA, the United Kingdom, Switzerland and Quebec these tools load only after you accept the cookie banner. Everywhere else, including Mexico, they load when you visit and you can opt out from the banner or from Privacy choices at the bottom of every page; we also honour the Global Privacy Control signal. Server-side events are sent only for people who have not opted out. If you opt out, only essential storage is used and no analytics or advertising trackers are loaded.

Cookies and local storage

We use two categories of storage:

• Essential (always on): the realtime session used by our database (Convex), your saved consent choice, and your passport key and member code stored in your browser's localStorage. These are needed for the site to work and are not used for tracking.
• Analytics and advertising: PostHog, the Meta Pixel, the TikTok Pixel and the Google tag, with their server-side counterparts. In the EU, EEA, UK, Switzerland and Quebec they run only after you accept; elsewhere they run unless you opt out.

How we use your data

We use your personal data to:

• Run the waitlist, referral game, and leaderboard.
• Sell tickets and merch, and process your orders.
• Deliver your passport, Realm Keys, and earned perks.
• Send you transactional email such as magic sign-in links, receipts, and reveal announcements.
• Understand how the site is used and improve it.

Who we share your data with

We do not sell your personal data. We share it only with service providers ("processors") who help us run the festival and site. Each has its own privacy policy:

• Convex — database and backend hosting.
• Vercel — website hosting.
• Resend — transactional email delivery.
• Fourvenues — ticket sales and payment; Fourvenues' own policy governs the ticket purchase data collected on their platform.
• Shopify — merch checkout and payment processing.
• PostHog — product analytics.
• Meta — the Meta Pixel and Conversions API, for measuring our advertising (hashed email, phone and name, plus click identifiers).
• TikTok — the TikTok Pixel and Events API, where enabled, for the same purpose.
• Google — the Google tag, for measuring our Google Ads (with a hashed email so a sign-up can be matched to the ad), and Sign in with Google when you choose to use it.

Data retention

We keep order and transaction records for as long as required for tax and legal purposes. Other personal data is kept only as long as needed and is deleted when you ask us to delete it.

Your rights

Under the LFPDPPP you have ARCO rights — to Access, Rectify, Cancel (delete), and Object to the processing of your personal data. If you are in the EU, the GDPR also gives you rights of access, erasure, and data portability.

You can:

• View and download your data, and request deletion, yourself from your Passport at /passport.
• Or contact the organizer using the details below.

Deleting your account removes your profile and game data. For legal reasons we retain order records, but we unlink them from your identity where possible.

Contact

For any privacy question, or to exercise your rights, contact our data-protection contact at privacy@7realms.mx.

Changes to this notice

We may update this Privacy Notice from time to time. The current version, with its "last updated" date, is always the one published on this page.