Privacy Policy

We collect the following categories of information:

• Account information (organizers). When you create an account using Google or an email sign-in link, we collect your name and email address.
• Registration information (attendees). Provided by you or by the organizer who registers you: first and last name, email address, phone number, date of birth, emergency contact details, answers to the organizer's custom questions, and the tickets or add-ons selected.
• Payment information. Payments are processed by Stripe. We do not collect or store full card numbers. We receive limited transaction details such as amount, status, and a payment reference.
• Sign-up sheet information. When you claim a spot on a sign-up sheet: your name, and - only if the organizer asks for them - your email address and phone number, plus any comment you add. No account is required.
• Messages to organizers. If you use “Contact the organizer” - on an event page, an organizer's profile, your confirmation page, or a sign-up sheet - we collect your name, email address, what the message is about, and the message, so we can deliver it. The organizer sees your email address so they can answer you, and the message and any replies they send through Regify are kept with their account.
• Follow and notification requests. If you choose to follow an organizer or be notified about an event without signing in, we collect the email address you give us so we can send those updates.
• Contacts imported by organizers. Organizers may upload contact lists (for example names and email addresses of their members) to reuse across their events. That information comes from the organizer, not from you, and the organizer is responsible for having the right to provide it. See Section 9.
• Demos and trade-show stands. If you try one of our demos - for example by scanning a QR code on a card at our booth - we collect the name and email address you enter, which kinds of events you say you run, how long the demo took you, and which card and page you came from. Unlike almost everything else here, this is collected by Regify for ourselves rather than on an organizer's behalf, because you are not registering for anyone's event. See Section 10.
• Files and images. Images an organizer uploads, such as event artwork, logos, and speaker photographs. If an organizer enables camper photos, authorized staff can take or upload a camper headshot for identification at check-in and pickup. These headshots are stored separately from public event images and are served only to authorized, signed-in staff of that organization. If an organizer asks for a document on the registration form, such as an immunization record, an insurance card, or a physician form, the file you upload is stored the same private way: only signed-in members of the organizer's team can open it, the organizer can limit it to certain roles (for example a camp nurse), and each time someone opens or downloads it is recorded. Photos of documents are converted and stripped of location and camera details when uploaded.
• Communications. Emails we send on behalf of organizers (confirmations, tickets, and event messages) and any correspondence you send to us.
• Email engagement. For an organizer's marketing emails and for their updates about an event you registered for, we record whether a link was clicked and which one, and whether the email was reported as opened. For marketing, we also record whether a registration followed. We do not measure your confirmations, tickets, invoices, or other receipts. Every email we measure has a way to stop it, and stopping the email stops the measurement. See Section 6.
• Technical and usage information. IP address and basic device or browser information, used for security, to rate-limit abuse, and to run the bot check described in Section 7.

Sensitive information. Because organizers write their own registration questions, what gets collected is largely their choice. Regify does not ask for sensitive information - such as health or medical details, government identification numbers, financial account details, precise location, or information about someone's race, religion, political views, or sexual orientation - and organizers should not use custom questions to collect it unless they genuinely need it and are permitted to. An organizer who does collect it is responsible for having a lawful basis and for any additional obligations their own laws impose. If you are asked for something on a registration form that seems out of place, raise it with the organizer running that event, and you can also contact us at [email protected].

A sign-up sheet is a public web page, and by default the names of people who have signed up are visible on it to anyone with the link. That is how a sign-up sheet works - people can see which spots are taken and by whom. Any comment you add is shown in the same way. Please do not put anything on a sheet that you would not want others to see.

Your email address and phone number are never shown on the page. They are used to send you a confirmation and any reminders for the spot you took, and are visible to the organizer.

An organizer can choose to hide the list of names so that only counts are shown, and can put a password on a sheet. Those settings are the organizer's to make, not ours. A sheet link is unlisted and is not indexed by search engines, but anyone who has the link can open it.

• To provide and operate the Service, including processing registrations and payments.
• To run sign-up sheets, including showing who has taken which spot, and sending confirmations and reminders for a spot.
• To deliver a message you send an organizer through Contact the organizer, and to deliver their reply.
• To send transactional emails (confirmations, tickets) and messages that organizers send to their attendees.
• To send text messages (SMS) to attendees who have opted in, on behalf of the organizer whose event they registered for.
• To send updates you asked for, such as notifications about an organizer you follow or an event you subscribed to. Every one of these emails has an unsubscribe link.
• To send marketing emails about an event on behalf of the organizer running it, to people who already have a relationship with that organizer, and to measure whether those emails led to registrations. Every one of them has an unsubscribe link. See Section 6.
• To send you the one follow-up email you asked for when you tried a demo - a sample portal, or an overview for the kinds of events you said you run - and to measure how our trade-show stands are performing. See Section 10.
• To provide optional AI features, such as drafting an event description or answering an organizer's questions about their own data. See Section 4.
• To secure the Service, prevent fraud and abuse, and enforce rate limits.
• To comply with legal, tax, and accounting obligations.
• To respond to your requests and provide support.

• With event organizers. Information you provide when registering for an event, or in a message you send them, is shared with the organizer running that event so they can manage your registration and answer you. Once an organizer has it, they may also keep and use it under their own policies - for example in their own records or mailing list - and Regify is not responsible for that use. Deleting your information from Regify does not remove copies an organizer already exported or keeps elsewhere; ask them directly about those.
• With the pastor you name. Some organizers ask who your pastor is and let that pastor review registrations. The pastor you pick can see, through a private link, the people who picked them: names, ages and whether they have paid, plus email, phone and roles for staff. They may approve or decline where the organizer asks them to. A pastor can share that view with up to five people they choose, such as a youth leader, who see the same information and may approve only if the pastor allows it. Each person signs in with a code sent to their own email.
• With other people looking at a sign-up sheet. As described in Section 2, the name you give when you claim a spot, and any comment you add, are shown on the sheet itself unless the organizer has hidden them.
• With service providers. Stripe (payment processing), Twilio (text-message delivery), OpenAI (the optional AI features described below), Cloudflare (bot protection and image storage), our email delivery provider, our hosting and infrastructure providers, and our rate-limiting provider. These providers process information only to provide services to us. We name them because it is more useful than saying “service providers,” but the list can change as we add or replace a provider; the categories above are what stays accurate, and we will update this list when it does change.
• With advertising platforms, only if you consent. Meta and Google, for the ad measurement described in Section 7 and below. This applies to our own marketing pages, not to registering for an organizer's event.
• For legal reasons. When required by law, or to protect the rights, safety, and security of Regify, our users, or the public.
• If Regify changes hands. If Regify is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its business, personal information may be transferred as part of that transaction, and may be reviewed under confidentiality during due diligence. It goes with the Regify service, not separately: whoever takes over must keep using it under this Privacy Policy, and we will tell you before your information becomes subject to a different policy. We do not sell personal information on its own, apart from the business.

We do not sell your personal information. We never exchange it for money, and attendee or sign-up information you give an organizer is never passed to advertisers.

Advertising measurement. On our own marketing pages, and only if you accept the cookie banner, we use the Meta Pixel and Google Ads conversion tracking to measure which of our ads led someone to sign up for a Regify account (see Section 7). Some privacy laws treat that as “sharing” personal information for cross-context behavioral advertising even where no money changes hands. It is off unless you accept it, rejecting the banner stops it, and it never involves the registration or sign-up sheet information an organizer collects from you.

Email measurement is a different thing. When you click a link in an organizer's email, or your mail app loads the image that records an open (Section 6), that record stays between Regify and the organizer who sent it. It is not shared with Meta, Google, or any other advertising platform, it does not follow you around other websites, and it is not used to build a profile of you.

AI features. Some optional features send text to OpenAI to generate a result - for example drafting an event description from a few words, or answering an organizer's question about their own event data.

Where an organizer asks a question about their data, attendee names and email addresses are replaced with placeholders before the question is sent, and are filled back in afterwards in the organizer's browser. Some categories of information are never sent to OpenAI at all: attendees' phone numbers, dates of birth, and emergency contact details; answers to free-text questions; and the contents of signed consents and waivers. Free-text answers are available to the organizer through a CSV export instead, which does not involve OpenAI.

What the AI does receive is the rest of the event's data - ticket types, amounts, dates, capacity, and answers to multiple-choice questions - with each person appearing only as a placeholder. Because an organizer writes their own questions, a multiple-choice question and its chosen answer are sent as written; see “Sensitive information” in Section 1 for what organizers should not ask.

We use OpenAI's API, which under OpenAI's current terms does not use data submitted through it to train their models.

If you opt in to text messages - for example, by checking the SMS consent box during event registration - Regify and the event organizer may send you texts about that event, such as registration confirmations, reminders, and schedule, time, location, or other updates. Message frequency varies, and message and data rates may apply. Consent to receive texts is not a condition of registering for or purchasing anything. You can opt out at any time by replying STOP to any message, or reply HELP for help. We record your consent, including the date, time, and the disclosure shown to you.

We do not sell or share your mobile phone number or SMS consent with third parties or affiliates for their own marketing purposes. Phone numbers collected for text messaging are used only to send the messages you signed up for, and are processed by our messaging provider, Twilio, on our behalf. Carriers are not liable for delayed or undelivered messages.

Separately from the confirmations and tickets we send for a registration you made, an organizer can send marketing emails promoting one of their events - a short series in the run-up to it, for example. Regify provides the tool; the organizer decides who is on the list and what it says.

Who gets them. An organizer can only send these to people who already have a relationship with them: someone who registered for one of that organizer's past events, someone who chose to follow them or asked to be notified about an event, and someone who started a registration on the event and did not finish. A contact list an organizer uploads (Section 9) is not one of those audiences - it is for picking a person from a list while registering them, not for mailing. Regify does not buy, sell, rent, or scrape mailing lists, and an organizer cannot use Regify to mail people they have no relationship with.

Three kinds of email, and what you can turn off. Receipts - your confirmation, your ticket, an invoice, a refund notice - are part of the transaction you made. They carry no unsubscribe link, because turning them off would cost you the thing you paid for, and we do not measure them at all. Event updates are reminders, feedback requests, and the organizer's own announcements about an event you registered for. They arrive by default, because missing a change of venue is worse than one more email, but every one of them carries a link to turn them off for that organizer. Marketing emails promote an event and always carry an unsubscribe link and the organizer's postal mailing address.

The three are separate. Turning off an organizer's marketing does not stop reminders for an event you are registered for, and turning off their event updates is not an agreement to receive marketing. Either choice covers that organizer across all of their events, takes effect for anything sent afterwards, and is not something the organizer can undo by adding you again.

How we measure whether an email worked. Links in a marketing email point at regi-fy.com first and then forward you to the real page. When you follow one, we record that you clicked and which link, and we mark your visit in two ways so that a registration you complete afterwards can be traced back to the email that prompted it: a reference in the web address you are forwarded to, and a first-party cookie that lasts 30 days (Section 7). If you register, the organizer's report on that campaign can then show it as a registration the email produced.

Opens. Marketing emails and event updates contain a small invisible image. If your mail app loads it, our email provider records that the message was opened, and the organizer sees a count. We say “approximate” wherever that number appears, and we mean it: many mail apps - Apple Mail in particular - load images automatically for every message they receive, whether or not anyone read it, so a large share of recorded opens are nobody looking. It is a rough signal, not a record of your attention, and it is not used for anything but that count. Your receipts contain no such image.

Event updates are measured the same way - a click and an approximate open - so an organizer can tell whether their reminder reached anyone. There is no registration to attribute, so no attribution cookie is set. If you would rather not be measured, the link at the bottom of any update turns both the emails and the measurement off.

What this is and is not. The report an organizer sees is about their campaign: how many emails were sent, how many people clicked, how many tickets followed, and how much those came to. The measurement is first-party - it happens on our own domain, no advertising platform or data broker is involved, and nothing about it follows you to other websites. What an organizer learns is the shape of their own list - how many opened, how many clicked, how many registered - not a profile of you, and never anything about what you do away from their event. If you would rather not be measured at all, unsubscribing stops the emails and the measurement along with them.

Who is responsible. The organizer is the one deciding to market to you, and Regify sends on their instructions - the same split as the rest of their event data (Section 13). If you want off an organizer's list, the unsubscribe link is the fastest route; you can also email us at [email protected].

Regify uses a small number of cookies. The ones that make the Service work are always on, the advertising ones only run if you agree to them, and one is set only if you click a link in an organizer's marketing email.

• Sign-in (necessary). Keeps an organizer signed in to their account.
• Password-protected pages (necessary). When an organizer puts a password on a registration page or a sign-up sheet, entering it correctly sets a cookie for that one page so you are not asked again. It records only that the password was entered, and expires after 30 days or as soon as the organizer changes the password.
• Your cookie choice (necessary). Remembers whether you accepted or rejected advertising cookies, so we do not ask again on every visit.
• Marketing email attribution (only if you click one). Set when you follow a link in a marketing email an organizer sent you, so that a registration you complete afterwards can be credited to that email (Section 6). It holds a reference to that one click, lasts 30 days, can only be read by our own server, and is never shared with an advertising platform. If you never click a link in one of those emails, it is never set.
• Advertising measurement (only with your consent). We advertise Regify on Meta (Facebook and Instagram) and Google. While those campaigns are running, and only if you accept the cookie banner, we use the Meta Pixel and Google Ads conversion tracking to see which ad led someone to sign up. These set third-party cookies and share limited event information with Meta and Google. When no campaign is running, they do not load at all.

These advertising cookies are off until you accept them. The banner shown on your first visit has a Reject option, and rejecting it means no advertising cookies are set and no ad-measurement data is sent. You can change your mind later by clearing your cookies for this site, which brings the banner back. You can also manage or block cookies through your browser settings at any time, though blocking the necessary ones will stop you signing in or keep you out of a password-protected page.

If your browser sends a Global Privacy Control signal, you will not see the banner at all - we take the signal as a refusal, so there is nothing to ask. See Section 12.

We do not use these tools to build a profile of you for other companies' advertising, and we do not run general third-party analytics products on the Service.

Bot protection. Some public forms - registering for an event, claiming a spot on a sign-up sheet, messaging an organizer - use Cloudflare Turnstile to tell people from automated scripts. It receives your IP address and basic browser information to make that check. Turnstile is used instead of an advertising-funded CAPTCHA specifically because it does not profile you or track you across sites.

We keep personal information for as long as needed to provide the Service and to meet legal, tax, and accounting requirements. Organizers control the data associated with their events and may retain it according to their own policies. When information is no longer needed, we delete or anonymize it.

Camper photos do not automatically expire when an event ends. Authorized staff can remove or replace them from the camper's record. Turning off camper photos for an event hides them but does not delete them. Contact the organizer, or email us at [email protected], to request removal when a photo is no longer needed.

Files uploaded to a registration form (such as medical or insurance documents) are deleted between 6 and 24 months after the event ends, as the organizer chooses for that event. The organizer can delete a file sooner, and deleting an event deletes its files. To have a file removed sooner, contact the organizer, or email us at [email protected].

If you claimed a spot on a sign-up sheet, you can withdraw it yourself using the link on the sheet or in your confirmation email, which removes your name from the page. Deleting a sign-up sheet deletes the sign-ups on it.

Messages sent through Contact the organizer, and the organizer's replies, are kept with that organizer's account as part of their records, and are deleted with it. Email us at [email protected] to have yours deleted sooner. We cannot recall the copies already delivered by email.

Click records from an organizer's marketing emails (Section 6) are kept with the campaign that produced them, and deleting that campaign deletes them. A registration those emails led to is not affected - that is the organizer's record of who is coming, and it outlives the campaign.

Demo and trade-show records described in Section 10 are kept while we are still following up on them and for our own records of how a show performed. Email us at [email protected] and we will delete yours.

If an organizer closes their account. Email us at [email protected] and we will delete the organization's account, its events, and the registration data held under it. Two things survive that deletion: records we are required to keep for tax and accounting purposes, such as the transaction history for payments already taken, and records of consent - for example an SMS opt-in or a signed waiver - which exist to evidence that permission was given and are worth less than nothing to us once detached from proof of when. We also cannot recall emails or texts already delivered. Closing an account does not by itself remove attendees' information from anywhere the organizer separately exported or copied it to.

An organizer can upload a list of contacts - for example their members or past volunteers - so those people can be picked from a list instead of retyped. If your details are in such a list, they were given to us by that organizer, not collected from you by Regify.

The organizer decides what to upload and is responsible for having a lawful basis to share it with us, and for any notice or consent their own laws require. Regify processes it on their behalf. If you want your details removed from an organizer's list, the fastest route is to ask that organizer; you can also email us at [email protected] and we will forward the request or act on their instructions.

We run demonstrations of Regify, including at trade shows where a printed card carries a QR code to a demo page. If you try one, the name and email address you enter, the kinds of events you tell us you run, how long the demo took, and which card and page you came from are stored by us.

This is the one place in this policy where Regify is collecting your information for itself rather than on an organizer's behalf. You are not registering for anyone's event, and no organizer receives it.

We use it to send you the follow-up you asked for - a sample portal, or an overview of Regify for the kinds of events you run - and to measure how a show performed. It is a single email. We do not add you to a mailing list, we do not sell this information, and we do not share it with organizers.

Anything shown inside a demo - for example the sample pastor portal, with its approvals and its list of students - is invented. The names, churches, and events in it are not real people or real records.

To have your demo record deleted, email [email protected].

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing.

Regify does not offer self-serve privacy tools. To exercise any of these rights, email us at [email protected] and we will handle your request. We may need to verify your identity before acting. If your request concerns information collected for an organizer's event, we may need to forward it to that organizer or act on their instructions, and we may retain information we are legally required to keep (for example, financial records).

If you are a California resident, you have the right to know what personal information we collect, to request access to or deletion of it, to correct inaccurate information, and to opt out of the sale or sharing of personal information. We will not discriminate against you for exercising your rights.

We do not sell personal information. The one activity that may count as “sharing” under California law is the ad measurement described in Sections 4 and 7, which runs on our own marketing pages only if you accept the cookie banner. To opt out, reject that banner - or, if you already accepted, clear this site's cookies and reject it when it reappears. You can also email [email protected] and we will action it.

Email click measurement is not sale or sharing. The click tracking on an organizer's marketing emails (Section 6) is first-party: no third party receives it and it is not used for cross-context behavioral advertising, which is what the sharing opt-out covers. It is not turned off by rejecting the cookie banner or by a Global Privacy Control signal, because it is not that kind of tracking. The way to stop it is the unsubscribe link in the email. If you would like the click records an organizer holds about you deleted, email [email protected] and we will handle it.

Global Privacy Control. We honor the GPC signal. If your browser or an extension sends it, we treat it as an opt-out of sharing: no advertising cookies are set, no ad-measurement data is sent, and you will not be shown the cookie banner at all, because you have already answered it. A GPC signal overrides an earlier acceptance stored on your device, so turning GPC on is enough on its own - you do not have to come back and change a previous choice. We do not respond to Do Not Track, which has no agreed meaning.

The categories of personal information we collect are described in Section 1 and include identifiers, contact details, commercial and transaction information, and internet or network activity. To submit a request, including through an authorized agent, email [email protected].

Who is responsible for what. For the information an attendee provides when registering for an event, the organizer is generally the controller - they decide what to ask, why, and what to do with the answers - and Regify is generally the processor, handling it on their instructions. The same split applies to contact lists an organizer uploads (Section 9), and to the marketing emails an organizer sends and the click measurement behind them (Section 6) - they choose who to mail and what to say, and we send on their instructions. Where Regify decides these things for itself, we are the controller: our organizers' own account information, our marketing pages and the ad measurement in Section 7, and the demo records in Section 10. That last one is why Section 10 exists as its own section. If your request concerns an organizer's event, the organizer is usually the right first stop, and we will forward it or act on their instructions.

If you are in the European Economic Area, the United Kingdom, or another region with similar laws, you have the right to access, correct, erase, restrict, or port your personal information, and to object to processing. Our legal bases for processing include performing our contract with you, our legitimate interests in operating and securing the Service, your consent where applicable, and compliance with legal obligations.

Where your information is processed. Regify is operated from the United States, and information is stored and processed there and in other countries whose data-protection laws may differ from your own. If you are outside the United States, registering for an event on Regify or using the Service means your information is transferred there. Where a transfer out of the EEA or the UK requires a specific legal mechanism, we rely on the one that applies to that transfer and will describe it on request - email [email protected].

To exercise your rights, email [email protected]. You also have the right to lodge a complaint with your local data-protection authority.

Camps and youth programs are a real use of Regify, so minors' information does pass through the Service - but never from the minor directly. Regify is not directed to children. Children may not create Regify accounts, and children under 13 may not submit their own registration. A minor's information - such as name, date of birth, and emergency contact - must be provided by an organizer, parent, or guardian registering on the minor's behalf.

Where a parent or guardian provides that information, they are the source of it and the organizer running the event decides what is asked for and why. An organizer who registers minors is responsible for obtaining whatever parental consent and notice their own laws require, including under the Children's Online Privacy Protection Act (COPPA) where it applies to them.

We do not knowingly collect personal information directly from children under 13. If you believe a child has provided us information directly, or you are a parent or guardian who wants a minor's information reviewed or deleted, contact [email protected] and we will act on it.

We use reasonable technical and organizational measures to protect personal information. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

If there is a breach. If personal information held by Regify is involved in a security incident that requires notification under applicable law, we will notify the people and authorities the law requires, within the time it requires. Where the affected information belongs to an organizer's event, we will notify that organizer - as the controller, they are usually the one who must then tell their attendees - and we will give them the detail they need to do it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above, and significant changes may be communicated through the Service.

Questions about this policy or your personal information? Email us at [email protected].