LEGAL · PRIVACY

Privacy Policy

This policy explains what Yalla Event collects about you, why, who sees it, and how you control it. In short: we collect only what you need to book and get in, we never sell your data, and we never give your number to an organizer.

Last updated: 2026-11-06

1. 01

   Who we are

   • Yalla Event (yalla-event.net) is a platform for discovering events in Iraq and booking their tickets. We are responsible for the data collected on the website and the app.
   • For any question or request about your data: info@yalla-event.net, or the Contact us page.
2. 02

   What we collect

   • Your account: your username, the name you choose, and your password, stored with one-way hashing that nobody can read, us included.
   • Your phone number, if you add it: encrypted by a key service kept separate from the database, and looked up by an encrypted fingerprint, not the number itself.
   • What you do here: your bookings and tickets, the events you save, set reminders for or join a waitlist for, the organizers you follow, your interests, your ratings and reviews, and the reports you send.
   • If you organize: your organizer page and the events you submit, so we can review and publish them.
   • Your messages to us: what you write through Contact us or a complaint, with the name and contact you give us.
   • Technical data: your IP address and the country Cloudflare detects, and your device and browser type, used for security and to protect accounts. Event view counts are kept as encrypted fingerprints that are not tied to your account.
   • Payment: we never store your card number. When online payment goes live, you enter card or wallet details on the payment provider's own page and we receive only the result and its reference. Today the payment step is a demo and charges nothing.
3. 03

   Why we use it

   • To run your account and booking: we issue the ticket, show it in My tickets, and check it at the door.
   • To remind and notify you: the reminders you set yourself, and changes to events you booked or saved.
   • To protect the platform: we stop fraud, fake accounts and floods of requests, and ask visitors from outside Iraq to pass a human check before signing in or booking.
   • To improve the platform: we look at totals (how many views, what people search for) without linking them to a person.
   • To answer you: we read your messages and complaints and follow them up until they are resolved.
   • We build no advertising profile of you and run no third-party ad trackers. Ads on the platform are sponsored events shown the same way to everyone.
4. 04

   Who sees your data

   • The organizer of an event you book sees only your display name, your ticket type and the last 4 characters of its code, so they can let you in. They never see your phone number, and we never give them your data for their ads or offers.
   • The companies that run the platform for us, and only as much as they need: Cloudflare (hosting and protection), Supabase (database and sign-in), the messaging provider for verification codes, the email provider if you subscribe to the newsletter, and payment providers once payment goes live.
   • Your followers: if you turn on «Let my followers see my events», they see the events you are going to. You can turn it off any time in Settings.
   • Authorities: when Iraqi law or a court order requires it, and only what is required.
   • We never sell or rent your data to anyone.
5. 05

   Cookies and storage on your device

   • We use only what the platform cannot work without: your sign-in session, your language, your theme (light or dark), whether you have seen the introduction, and a Cloudflare Turnstile pass for visitors outside Iraq.
   • On your device itself we keep things that are yours: the app lock (PIN) if you turn it on, your city, and the organizers you follow. These never leave your device.
   • We have no advertising cookies and no third-party analytics cookies.
6. 06

   How long we keep it

   • Your account data stays until you delete your account from Account → Settings → Delete account.
   • Booking and payment records may be kept after an account is deleted, as far as the law or accounting and dispute handling require, then deleted or reduced to numbers that identify nobody.
   • Verification and password-recovery codes expire within minutes.
   • Your messages and complaints are kept until they are resolved, and for a reasonable time after in case the problem comes back.
7. 07

   Your rights

   • You can see and edit your data from Account at any time.
   • You can delete your account yourself. Deletion is final.
   • You can stop reminders, and unsubscribe from the newsletter with the link in every email.
   • You can ask for a copy of your data, or object to a particular use, through Contact us or at info@yalla-event.net. We check the request is yours and reply within 30 days.
8. 08

   Children

   • Accounts are for people aged 16 and over. Anyone younger books through a parent or guardian.
   • If we learn an account belongs to a child under 16 without a guardian's consent, we delete it.
9. 09

   Security

   • Every connection to the platform is encrypted (HTTPS), and passwords are stored in a form nobody can read.
   • Phone numbers are encrypted with a key held on a separate server, so someone who reaches the database alone cannot read them.
   • The admin dashboard sits behind an extra sign-in, and data is accessed only as needed.
   • We never ask for your password, a verification code or a card PIN by message or call. If someone asks in our name, report it.
   • No system is 100% secure, but if a breach affects you, we will tell you as soon as we can.
10. 10

    Where it is stored

    • The database is in a data centre in Germany (Frankfurt), and the platform runs on Cloudflare's global network. Your data may be processed outside Iraq, by providers bound to protect it.
11. 11

    Changes

    • If we change this policy, we update the date above. If the change matters, we tell you on the platform before it takes effect.