Effective September 11, 2026. This notice explains the information practices described below and how to contact us about your rights.
Who handles your information
Doorstop, Inc. provides Turnstile. Reach us about privacy at legal@turnstileos.com or Doorstop, Inc., 1111b South Governors Ave, Ste 96313, Dover, DE 19904.
An organization using Turnstile generally decides why it collects event, contact, form, talent, and agreement information and who may use its records. Turnstile provides the processing tools for those instructions. The organization’s privacy notice also matters, including when it holds a record about you without a Turnstile account.
Doorstop separately uses information for Turnstile account administration, service operation, security, support, and the platform safety activities described below. Our role depends on the particular activity. We can help route a request when the relevant information is controlled by an organizer.
Information we handle
Information comes from you, organizers and their authorized teammates, people submitting forms or reports, and providers involved in features you use. Website delivery and security systems also process technical information such as requests, IP addresses, browser information, and related logs.
- Account and security information, including names, email addresses, password and authenticator records, passkey records where used, sessions, verification activity, and support messages.
- Organizer records, including contact details, biographies, company and household associations, relationships, notes, tags, tasks, talent profiles, rosters, representation, and bookings.
- Event and transaction records, including registrations, tickets, orders, waitlists, transfers, check-in, payment references, refund requests, and dispute information. A purchase confirmation can retain the reviewed order, applicable organizer policy, acknowledgment, time, and limited account-verification facts. Passwords, authenticator secrets, and recovery codes are not part of the purchase record.
- Form and agreement information, including questions, answers, review decisions, agreement text, recipients, and signatures and document records when signing is enabled.
- Optional profile information you supply, such as a display name, biography, pronouns, coarse location, interests, links, appearance settings, and photo.
How information is used
We use information to provide requested features, authenticate accounts, apply permissions, maintain event and transaction records, deliver service messages, respond to support and privacy requests, investigate misuse, and retain relevant security and action records. An organizer decides the purpose of its own questions, contact records, and communications.
Turnstile’s search feature can create numerical representations of limited organizer records to find related results. The current implementation runs within Turnstile’s infrastructure and does not send those records or search queries to an external embedding service. Private CRM notes, contact emails and phone numbers, relationship records, and platform safety evidence are excluded from that search projection.
Operating search does not give us a blanket right to train unrelated AI models on private information. A materially different use requires an appropriate legal basis, an accurate notice, and any choice or agreement required by law.
Organization access and account connections
Organization access depends on current permissions. A parent organization does not automatically receive access to a child organization. A relationship, household link, talent representation, or matching email address does not itself grant account access.
Your personal account is separate from an organizer’s contact record. The supported account-to-contact connection uses an explicit consent step associated with an eligible ticket. You can withdraw that connection, including when the organization’s ordinary features are unavailable. Withdrawal does not erase independently held organizer records or reverse an event transaction.
A reviewed form response can be linked to an organizer’s contact record without creating a connection to your login account. Ask the organizer about the purpose of its records and contact us if you need help identifying the responsible party.
Public profiles and your sharing choices
Personal profiles are private by default. If you publish a profile, Turnstile creates a separate public copy of the fields you select. A display name is required; other supported fields and your photo are optional. Showing an available verification badge is a separate choice and depends on the current verification record.
You can unpublish the profile or rotate its public link. A difficult-to-guess link and search-indexing restrictions do not make published information confidential. Other people may save, copy, or share what you publish, and unpublishing cannot remove copies they already made. Organizers separately control publication of their events and forms.
Confirming an order does not consent to unrelated marketing or publish your profile. Publishing a profile does not grant an organizer access to your private account. Use each feature’s specific sharing choice for the purpose it describes.
Providers involved in the features you use
We use hosting, website delivery, security, email, and operational providers to run Turnstile. Where the marketing website is delivered through Cloudflare, Cloudflare processes the technical request information needed to provide that service. The marketing site currently has no advertising-pixel or third-party audience-analytics integration. An enabled product feature may involve a different provider; not every integration is active for every organization.
When Stripe payments are enabled, Stripe handles hosted payment setup and checkout for the organizer’s connected account. Turnstile retains necessary payment references, amounts, outcomes, refunds, and dispute records. Enter card information only in the designated payment experience, not in a Turnstile form or support message.
Choosing Gravatar import sends an email-derived hash to Gravatar to request your photo. That hash is not anonymous. Turnstile processes and stores the imported image; the import does not automatically send each public-profile visitor to Gravatar. Uploaded and imported photos are resized and re-encoded to remove source metadata.
Choosing an enabled event-address check sends the entered address fields to Mapbox. Manual address entry does not require that request. A match does not verify residence, ownership, or postal deliverability. Electronic signing, when enabled, shares the agreement and recipient information with DocuSeal and loads its signing experience. Adding a pass to a wallet may disclose pass information to the selected wallet provider.
Configured internal operator sign-in uses Microsoft Entra. Providers may process information under their own notices when they act for their own purposes, such as payment security. Ask legal@turnstileos.com about the providers and processing locations relevant to your use. We do not represent that all information remains in your country or that every deployment has the same providers. Location or transfer requirements for a business service must be addressed in the applicable arrangement.
Other disclosures
We may disclose relevant information to people you authorize, to an organizer or recipient involved in your requested transaction, or to service providers supporting that activity. A support or privacy request may require coordination with the organization responsible for the record.
We may also disclose information when reasonably necessary to comply with law or legal process, protect people or service security, or establish or defend legal rights. We assess the request and the information needed; this notice does not authorize unrestricted access to customer records. If information is transferred as part of a business reorganization or sale, applicable confidentiality, privacy, and notice obligations continue.
Safety reports and review
Eligible organizers can report relevant concerns about a buyer or ticket account. Reports and evidence are restricted for platform review. A report alone does not establish wrongdoing or create a shared customer directory.
The current safety workflow requires independent review before a supported, substantiated fraud signal can require an additional review of the same account’s paid order with another organizer. That organizer receives a generic review requirement, not the source organization’s allegation or evidence. A chargeback does not automatically cause a permanent account ban.
Eligible account holders can review the case information available in their account and submit an appeal. An open appeal pauses the signal’s cross-customer effect. For a privacy or fairness concern, or if the available information is insufficient to explain a decision affecting you, contact legal@turnstileos.com.
Protecting information
Turnstile uses account verification, required multifactor authentication, permission checks, session controls, and restricted administrative access to help protect information. Relevant actions are audited. No service can guarantee that every security incident will be prevented.
Keep your password, authenticator, recovery codes, and private invitation or signing links secure. Send suspected account compromise or a security concern to legal@turnstileos.com without including those secrets. We will provide a suitable way to share additional evidence if needed.
Children and organizer-managed records
Personal account use requires the capacity and authority to accept the applicable terms under the law that applies to the user. Turnstile does not provide a dedicated child-account, guardian-account, or parental-consent program, and does not claim to automatically verify every person’s age.
A child may attend an organizer’s event or be represented in an organizer-managed household or other record without having a Turnstile account. The organization is responsible for the authority, notices, and permissions needed for that collection. Do not direct children to submit information through an account or collection process that cannot meet the applicable legal requirements.
A parent or guardian who believes a child has submitted information improperly, or wants to raise a concern about a child’s record, can contact the organizer or legal@turnstileos.com. We will review the concern, verify authority as appropriate, and take the action required for the circumstances and applicable law.
Retention and deletion
How long information is needed depends on its purpose, the account or organization relationship, outstanding transactions and claims, legal obligations, and any applicable service arrangement. Relevant order confirmations, payment or refund records, agreements, safety matters, and audit records may need to be retained after ordinary access ends. Ending access does not itself cancel an event, complete a refund, or remove another party’s records.
You may request access to retained information through the contact process below. We will assess the request against your identity, the records we hold, and other people’s rights. A transfer or another person’s connection to the same event does not give them access to your private purchase records.
Deletion requests are reviewed rather than treated as an automatic erasure of every related record. Where information must be retained, its use remains limited to the reason for retention and subject to access restrictions. Backups, legal holds, and records involving other people may require separate handling. We will explain relevant limits when responding; a technical deletion restriction is not, by itself, a reason to retain information indefinitely.
Make a privacy request
You can edit supported profile fields, manage profile publication and account connections, and review available security settings in Turnstile. For other requests, email legal@turnstileos.com with the subject Privacy request, a way to reply, and enough context to identify the account, organization, event, or record. You do not need an active account to contact us. Do not send a password, authentication code, or identity document in your initial message.
Depending on applicable law, you may have rights to access, correct, delete, obtain a portable copy, learn about disclosures, restrict or object to processing, or opt out of specified advertising, sales, or significant automated decisions. A parent, guardian, or authorized representative may contact us on someone’s behalf where permitted. We may request proportionate identity or authority checks when appropriate; requirements differ for some opt-out requests.
We review requests manually when a self-service option is unavailable, coordinate with the responsible organizer where needed, and respond within the period required by applicable law. If we cannot fulfill a request in whole or part, we will explain the outcome and applicable review options. We do not require you to waive privacy rights to make a request.
Appeals and complaints
To challenge our response to a privacy request, reply to that response or email legal@turnstileos.com with Privacy appeal in the subject and identify the decision and your concern. We will review it and provide the outcome and reasons within any applicable legal period.
You may also contact the privacy regulator or other authority available in your jurisdiction. Where Delaware privacy law applies, information about the Delaware Department of Justice is available at https://attorneygeneral.delaware.gov/. This process does not limit other rights or remedies.
Updates to this notice
We will update the version and effective date when this notice changes and give appropriate additional notice of material changes. If a new use requires consent or another legal step, posting an updated notice alone does not supply it. Contact legal@turnstileos.com with questions about a change or the practices relevant to your information.