Privacy Policy

1. Who We Are

Punchup is operated by PunchUp Technologies ("we", "us", "our"). We provide a B2B tool for comedy promoters, managers, and clubs to generate trackable landing pages for comedian tour dates. For privacy enquiries, contact us at [email protected].

2. Data We Collect

We collect the following categories of personal data:

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area or United Kingdom, we process your data under the following legal bases:

• Contractual necessity — your email address and session token are required to provide the Service (authentication and account access).
• Legitimate interests — IP address, device metadata, and analytics events are processed to ensure security and to provide click-through statistics to account holders. These interests do not override your rights and freedoms.

4. How We Use Your Data

We use your email address solely to send authentication magic links and, if you have opted in, product updates. We do not sell your personal data to third parties. We do not use your data for advertising or profiling. Analytics events on comedian landing pages are aggregated and associated with the link, not with the identity of individual page visitors.

5. Data Retention

Account data (including your email address) is retained for as long as your account is active, plus 30 days following account deletion. Analytics event data may be retained in aggregate or anonymised form indefinitely. You may request deletion of your account and associated personal data at any time by contacting us.

6. Third-Party Processors

We share data with the following categories of sub-processors who act on our behalf:

• Email delivery (Resend) — your email address is passed to Resend solely to deliver authentication magic links.
• Hosting and infrastructure (Manus) — our server, database, and application are hosted on Manus infrastructure. Your data is stored on servers within this environment.

All sub-processors are bound by data processing agreements and are required to process data only as instructed by us.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Right to access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate data.
• Right to erasure — request deletion of your data ("right to be forgotten").
• Right to restriction — request that we stop using your data while a dispute is resolved.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.
• California residents (CCPA) — right to know, delete, and opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

8. Cookies

The Service uses a session cookie solely to maintain your login state. This is a strictly necessary cookie and does not require consent. We do not currently use any third-party tracking cookies or advertising pixels. If this changes, we will update this policy and add a cookie consent mechanism.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, or destruction. Authentication uses time-limited, single-use magic links. Session tokens are signed and stored securely.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email. Continued use of the Service after changes constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions or to exercise your rights, contact us at [email protected].