Fanlendar — Privacy Policy and Personal Information Collection Statement
Version 1.2 Effective date: 8 October 2026 Data user: Sky Infinity Limited, which operates Fanlendar (Business Registration number 71972359), Unit 1403, 20 Connaught Road West, Sheung Wan, Hong Kong Language: The English version of this Policy prevails over any Chinese version.
1. Introduction
Sky Infinity Limited operates Fanlendar at fanlendar.com, a directory of fan-community events and a set of tools that lets organisers sell tickets and merchandise to their members.
This Policy explains what personal data we collect, why, how we use and protect it, and what rights you have. It applies to Visitors, Members, Organisers and Buyers. A Buyer is anyone who places an order, with or without a Fanlendar account.
We are the data user in respect of the data described here. Organisers are separate and independent data users in respect of their own members' and buyers' data — see Section 6.
2. Personal data we collect
2.1 Data you give us
| Category | Data | When |
|---|---|---|
| Account | Email address | On registration |
| Google sign-in | If you sign in with Google, we receive from Google your name, email address, a link to your profile photo, and your Google account ID. We keep your email address, Google account ID and the link to your profile photo; we don't keep your name. Your profile photo is shown in the site header and is fetched through our own server. We don't store any of your Google tokens (access, refresh or ID tokens). You can instead sign in with a one-time link sent to your email address. | When you sign in with Google |
| Order | See Section 2.6 | When you place an order |
| Club membership | If you join a Club: Club joined, membership status, tags applied by the organiser, join-request messages | When you join a Club |
| Organiser | Club name, contact email, event and product details, the Club's refund policy, and, if you connect a Stripe account, its identifier and status (see Section 2.7) | On creating a Club, and when you set up payments |
| Club claims | The evidence you submit, and the link to a public post | When you claim a Club |
| Support | Correspondence with us, including complaints and dispute reports | When you contact us |
| Listing reports | The text of your report, which listing it concerns, and your email address if you give one | When you report a listing |
| Marketing | Email address, and the preferences you select | When you opt in |
2.2 Data we collect automatically
| Category | Data | Purpose |
|---|---|---|
| Technical | IP address, browser and device type | Security, fraud prevention, service delivery |
| Sign-in and acceptance records | IP address (including the chain of forwarding addresses) and browser user-agent, stored with sign-in sessions, Terms acceptances and club claims | Security, fraud prevention, and proving who accepted the Terms and when |
| Activity log | IP address (including the chain of forwarding addresses) and browser user-agent, recorded when a club is created, when a club claim is decided, when an administrator acts on the site (for example resolving a report), when a club owner saves the club's refund policy or connects a Stripe account, and when a club owner or one of the club's admins opens the club's payments page (or returns from Stripe) and the club's Stripe status has changed | Security, and a record of who did what |
| Checkout rate limit | A one-way code made from your IP address (see Section 2.8) | Stopping automated misuse of checkout |
| Cookies | See Section 9 | Sign-in, language, bot checks |
2.3 Data we do not collect
- We do not collect or store payment card details. You enter them on Stripe's own checkout page. They never reach our servers.
- We do not collect Hong Kong Identity Card numbers or copies of identity documents. Where an Organiser must verify identity, that is done by Stripe directly and the documents are not disclosed to us.
- We do not collect data revealing racial or ethnic origin, political opinions, religious beliefs, health, or sexual orientation, and ask that you do not supply it.
2.4 Data about organisers in Unclaimed Listings
Some directory entries are compiled by us from publicly available sources without the organiser's involvement, and are marked "Unclaimed". These may include a publicly-published organiser name or social media handle.
We publish this on the basis that it is factual information already published by the organiser themselves for the purpose of promoting a public event, that our use is directly related to that same purpose, and that it is limited to what is necessary to make the event findable.
If you are named in an Unclaimed Listing and want it removed, email [email protected] and we will remove it within 2 Hong Kong business days. We will not ask why. You do not need to give a reason, invoke this Policy, or identify yourself beyond what is needed to locate the listing.
2.5 Listing reports
Anyone can report a directory listing, for example to correct its details or to ask for it to be removed. We store your report, the listing it concerns and your email address (if you give one) to review the report and reply to you. Giving an email address is optional; without one, we cannot reply to you. Reports are sent to [email protected] and reviewed within 2 Hong Kong business days.
A report may contain personal data about other people, for example the organiser of the listed event. We use it only to handle the report. We do not share a reporter's email address with the organiser.
2.6 Orders
You pay on Stripe's own checkout page. You give your email address, name and card details to Stripe there, not to us.
What our order record holds:
- the order number (for example FL-7KQ2M9)
- the Club and event
- each item, its quantity and price, and the total
- the order's status (for example paid, expired or refunded) and any amount refunded
- the language you used
- the Club's refund policy as it was shown to you
- the version of our Terms of Use you agreed to
- when the order was created, paid and confirmed
- Stripe references: the checkout session, the payment, and the Club's Stripe account
What it does not hold: your name, email address, phone number, postal address or card details.
We treat the order record as personal data. The Stripe references link it to the details you gave Stripe.
Your email address. After you pay, we read your email address from Stripe once, to send your order confirmation. We do not store it, and we do not write it to our logs. Our email provider, Zoho Mail, delivers the email. We use your email address only for this confirmation.
Messages from Stripe. When Stripe tells our server about a payment, the message can include your name and email address. We do not store or log them. We read the payment's status from Stripe directly.
2.7 Organisers' Stripe accounts
Organisers sell through their own Stripe account. When you connect one:
- we create the account with your Club's name and Hong Kong as its country, and ask Stripe to enable card payments
- you then give your details directly to Stripe, on Stripe's own pages
- we store the account's identifier, its status (for example active or paused), whether card payments are enabled, how many requirements Stripe says are due, and when we last checked
- when we need it, we read the support email you set in your Stripe account, to show buyers how to contact you. We do not store it
What you give Stripe is handled under Stripe's own privacy policy.
2.8 Checkout rate limit
To stop automated misuse of checkout, our server counts checkout attempts per connection.
- It turns your IP address into a one-way code straight away, and keeps only that code, a count and a time.
- It keeps them in the server's memory only, for no more than 11 minutes.
- It never stores them in our database, files or logs.
3. Purposes of use — Personal Information Collection Statement
We use personal data for the following purposes:
Operating the service
- creating and administering your account
- displaying the directory and Club pages
- if you place an order, processing and recording it, and sending you an order confirmation
- if you join a Club, managing your membership, join requests, and eligibility
- if you are an Organiser, setting up and checking your Stripe account so your Club can take payments
Trust, safety, and legal
- verifying Organisers and displaying verification status
- detecting and preventing fraud, abuse, and automated access
- proving who accepted the Terms and when
- investigating complaints and disputes
- handling listing reports and removal requests, and replying to the reporter
- keeping records of any transactions, and complying with legal obligations
Improving and communicating
- understanding how the service is used, in aggregate
- responding to your enquiries
- sending service messages about your account, any orders, or these terms
- sending marketing communications only where you have opted in (Section 7)
Supply of data. Providing the data in Section 2.1 is voluntary. However, if you do not provide the data marked as required at the point of collection, we may be unable to create your account or, if you place an order, process it.
Classes of transferees. Your personal data may be transferred to the classes of persons in Section 5.
Access and correction. You have the right to request access to and correction of your personal data — see Section 11.
4. Legal bases (for visitors in the EEA and UK)
Where the GDPR applies, we rely on: contract (operating your account and any orders); legitimate interests (security, fraud prevention, proving who accepted the Terms and when, service improvement, and publishing factual event information, balanced against your rights); consent (marketing, withdrawable at any time); and legal obligation (record-keeping and responding to lawful requests).
5. Who we share data with
We do not sell personal data. We share it with:
| Recipient | What | Why | Location |
|---|---|---|---|
| Organisers | If you join a Club: membership status. If you place an order: the Organiser sees your payment, with the details you gave Stripe, in their own Stripe account. We don't send them your contact details | So they can fulfil your order and run their event | Primarily Hong Kong |
| Stripe | For each order: the items, quantities, prices, currency, the Club's name, our order ID, and the addresses of our order pages. For each Organiser: the Club's name, its country, and our Club ID. We send no buyer contact details. What you enter on Stripe's pages goes to Stripe directly, under Stripe's privacy policy | Payment processing for the Club, which is the seller | United States, Ireland and other countries where Stripe operates |
| DigitalOcean | All hosted data | Application and database hosting | Singapore |
| Zoho Mail | For an order confirmation: your email address, and the order details (order number, Club, event, items, total, the Club's refund policy and contact, and a link to your order page). For other email: name, email, message content | Transactional and opted-in email, sent from [email protected]; our mailboxes, including listings@ and privacy@ | Singapore |
| Cloudflare | IP address, request metadata | Content delivery, security, and bot checks on our forms (Cloudflare Turnstile) | Global |
| Google LLC | If you sign in with Google: your sign-in request | Sign-in | United States |
| Professional advisers | As necessary | Legal and accounting advice | Hong Kong |
| Law enforcement / regulators | As required | Where compelled by law or to prevent crime | Hong Kong |
What Organisers receive, and what they do not. If you place an order or join a Club, the Organiser receives only what is necessary to fulfil your order and administer your membership. They do not receive your payment card details, your data relating to other Clubs, or your account credentials. Once received, the Organiser is an independent data user — see Section 6. If you report a listing, the Organiser does not receive your email address (Section 2.5).
6. Organisers as independent data users
When you join a Club or buy from an Organiser, that Organiser becomes a data user in their own right under the PDPO in respect of your data.
- Their use of your data is governed by their own practices and their obligations under the PDPO, not by this Policy.
- Our Terms require them to use it only to operate their Club and its events, not to sell or transfer it, and not to use it for direct marketing without obtaining the consent required by Part 6A of the PDPO.
- We cannot control what an Organiser does with data once disclosed to them. If you have a concern about an Organiser's handling of your data, contact them; you may also report it to us at [email protected] and to the Privacy Commissioner for Personal Data.
7. Direct marketing
We will use your personal data in direct marketing only with your explicit prior consent.
Before we do, we will tell you: that we intend to use your personal data in direct marketing; the kinds of personal data to be used; and the classes of marketing subject in relation to which it will be used. We will not use your data for that purpose without your written consent — an affirmative action by you, such as ticking an unticked box and confirming through a link we email to you.
Silence is not consent. We do not use pre-ticked boxes. We do not treat creating an account, making a purchase, or downloading a resource as consent to marketing.
Opting out. You may withdraw consent at any time, at no cost, by using the unsubscribe link in any marketing email or by emailing [email protected]. We will action it without charge and as soon as practicable.
We do not provide personal data to any other person for use in their direct marketing, whether for gain or otherwise.
8. Transfers outside Hong Kong
Some recipients in Section 5 are located outside Hong Kong: Stripe (payments, United States, Ireland and other countries), DigitalOcean (hosting, Singapore), Zoho Mail (email, Singapore), Cloudflare (global) and Google LLC (United States).
Section 33 of the PDPO, which would restrict transfers outside Hong Kong, is not in force. Nonetheless we apply the Data Protection Principles to personal data wherever it is held, and we:
- select providers with recognised security practices and appropriate certifications;
- impose contractual obligations on processors, having regard to the PCPD's Recommended Model Contractual Clauses, requiring them to use data only on our instructions, protect it, and return or delete it on termination;
- limit what is transferred to what is necessary.
For transfers of EEA/UK personal data, we rely on the European Commission's Standard Contractual Clauses or an adequacy decision, as applicable.
9. Cookies
We use only the strictly necessary cookies listed below, and Cloudflare Turnstile. We do not use analytics, marketing or advertising cookies.
| Cookie | Purpose | Duration |
|---|---|---|
__Secure-better-auth.session_token |
Keeps you signed in (sign-in session) | 7 days, renewed while you keep using the site |
__Secure-better-auth.state |
Sign-in state: protects Google sign-in against forged requests | 5 minutes, set only during Google sign-in |
NEXT_LOCALE |
Remembers your language | Until you close your browser |
These cookies are strictly necessary, so consent is not required. You can block cookies in your browser, but blocking them will prevent sign-in.
Our forms use Cloudflare Turnstile to check that they are being submitted by a person, not a bot. To detect bots, Cloudflare Turnstile processes signals such as your IP address, TLS fingerprint and browser user-agent, which Cloudflare treats as strictly necessary. See Cloudflare's Turnstile privacy policy.
Stripe. No Stripe script, cookie or tracker loads on fanlendar.com. Checkout and Organiser account setup happen on Stripe's own pages (checkout.stripe.com and connect.stripe.com). Stripe sets its own cookies there, under Stripe's privacy policy.
10. Security and breaches
10.1 We take all practicable steps to protect personal data. We don't use passwords: you sign in with Google or with an email sign-in link, which can be used only once and expires after 10 minutes. Data is encrypted in transit (TLS), and our database, DigitalOcean Managed PostgreSQL, encrypts it at rest. We also restrict access to personal data to those who need it.
10.2 We never hold payment card data. You enter card details on Stripe's own page, and they go directly to Stripe.
10.3 No system is completely secure. You are responsible for keeping access to your email account and Google account secure.
10.4 Breaches. Hong Kong does not currently impose a mandatory breach notification requirement. We nonetheless commit that, if a breach occurs which is likely to result in a real risk of significant harm, we will notify the Privacy Commissioner for Personal Data and affected individuals as soon as reasonably practicable, describing what happened, the data affected, the likely consequences, and the steps taken. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours.
11. Your rights
Access and correction (PDPO). You may request a copy of the personal data we hold about you, and correction of data that is inaccurate.
- Send requests to [email protected].
- We will respond within 40 days, as required by the PDPO.
- We may charge a fee for a data access request, which will not exceed HK$100 and will not exceed the direct costs of compliance. We will tell you before charging.
- If we refuse a request, we will tell you in writing and give reasons.
- Buyers: we don't store your contact details, so please include your order number (for example FL-7KQ2M9) to help us find your order record.
Additional rights where the GDPR applies. Erasure; restriction; portability; objection to processing based on legitimate interests; withdrawal of consent; and the right to lodge a complaint with your supervisory authority.
All users, always. You may ask us to delete your account at any time by emailing [email protected], and opt out of marketing at any time.
Complaints. Contact us first at [email protected]. You may also complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong — pcpd.org.hk, +852 2827 2827.
12. Retention
| Data | Retention | Reason |
|---|---|---|
| Account data | Until you ask us to delete it; we then delete it within 30 days, except records we must keep | Operating your account |
| Sign-in sessions, with their IP address and browser user-agent | Until the session expires or you sign out. A session expires 7 days after it was last renewed, and is renewed at most once a day while you keep using the site | Keeping you signed in; security |
| Email sign-in links | Expire after 10 minutes | Signing you in |
| Terms acceptance records, club claim records and the activity log | For as long as the club is listed on Fanlendar, and for 7 years afterwards. Entries not linked to a club (for example, resolving a report about an unclaimed listing): 7 years after the entry is made | Proving who accepted the Terms and when; a record of who did what |
| Order records for orders that were paid (including refunded and disputed orders), and the records of Stripe's notices about them | 7 years after the order date | Tax and accounting records; refunds, chargebacks and disputes |
| Order records for orders that were never paid (expired, cancelled or failed) | 90 days after the order date | Answering questions about a checkout that didn't complete, and looking into misuse |
| Organisers' Stripe account records (identifier and status) | For as long as the club is listed on Fanlendar, and for 7 years afterwards | A record of which account each club sold through |
| Order confirmation emails | We do not keep a copy. Zoho Mail delivers them | Sending your confirmation |
| Checkout rate limit (a one-way code made from your IP address) | In server memory only, for no more than 11 minutes | Stopping automated misuse of checkout |
| Support correspondence | 3 years. Records of data access or correction requests that we refuse: at least 4 years, as section 27 of the PDPO requires | Handling recurring issues |
| Server and security logs | Kept by our hosting provider for up to 90 days. We don't keep separate copies. | Security and abuse investigation |
| Unclaimed Listing data | Until claimed or removal is requested | Operating the directory |
| Listing report records: the listing's title and link, when the report was received and resolved, the outcome, and our internal note (which never includes the reporter's email address or report text) | Permanently | A record of how each report was handled |
| Reporter's email address and report text | 3 years after the report is resolved, then erased. Copies in the listings@ mailbox follow the same period | Handling the report and any follow-up |
We erase personal data when it is no longer necessary for the purpose for which it was collected, as required by section 26 of the PDPO.
13. Children
Our service is not directed at children under 13, and we do not knowingly collect their personal data. Members aged 13–17 may use the service only with the consent of a parent or guardian. A Buyer under 18 may buy only with the consent of a parent or guardian, and confirms that consent at checkout.
A parent or guardian who believes their child has provided us with personal data may contact [email protected] to request access, correction, or deletion, and we will act on it.
14. Changes
We may update this Policy. Material changes will be notified by email or prominent notice at least 30 days before taking effect. The current version and its effective date are always published at fanlendar.com/privacy.
15. Contact
Data Protection Contact · [email protected] Sky Infinity Limited, Unit 1403, 20 Connaught Road West, Sheung Wan, Hong Kong