Privacy Policy

HayatHub (“we”, “our”, “us”) respects your privacy. This policy explains what personal information we collect, how we use and share it, and the choices you have. It applies to our websites, apps, and related services.

We collect information you give us and information created as you use the platform:

• Account and profile: name, username, email, phone, password hash, profile image and information you choose to provide. Passwords are hashed, not stored as readable passwords.
• Events and communications: event descriptions, registrations, attendance, messages, reviews, support tickets and attachments you submit.
• Financial records: top-ups, credit reservations, refunds, platform charges, host settlements and payout references, together with the accepted pricing and agreement records.
• Billing and payout verification, when provided or required: legal name, buyer type, invoice email, national/company identifier, economic number, address, postal code, mobile, Sheba and ownership-check results. These are not required merely to browse events.
• Technical data: IP address, browser/device, security logs and platform interactions. Optional location features use device permission; an IP address may still indicate approximate location.

• Provide and operate the Services, including registrations, tickets, and the Hayat wallet.
• Process top-ups, purchases, host earnings, and payouts.
• Send transactional messages: confirmations, reminders, receipts, and security alerts.
• Keep the platform safe: detect and prevent fraud, abuse, and unauthorized access.
• Personalize your experience, such as recommending relevant events.
• Send marketing messages where you have consented; you can opt out at any time.
• Comply with legal obligations and enforce our Terms.

We process information needed to perform your requested service, protect accounts and keep required financial/legal evidence. Optional marketing and permission-based features require the appropriate separate choice; acceptance of this policy is not blanket consent for unrelated uses.

For Iranian users, personal-data handling is subject to applicable Iranian law, including the Electronic Commerce Law’s personal-data protections. We limit collection to the stated purpose and provide a route to request access, correction or deletion subject to legal exceptions.

We do not sell your personal information. We share it only as needed:

• Event organizers receive the registration and contact information needed to deliver their event. They must use it for event administration and related support, protect it, and obtain any separate permission needed for unrelated marketing.
• The selected payment gateway, bank and identity-verification provider receive the information needed for your payment or payout check. Available providers depend on the transaction; displaying an option is not a claim that all listed gateways receive your data.
• Authorized hosting, storage, email and operational providers process information needed for their service. Staff access to financial identity evidence is restricted and sensitive access/exports are audited.
• Where legally required, necessary identity, transaction and invoice data may be disclosed to the Iranian tax authority, Samaneh Moadian, competent courts or other legally authorized authorities. A request does not justify unrelated public disclosure.
• If the business is transferred, access to personal data must remain subject to applicable protections and required notice.

Full card credentials, CVV and banking passwords belong only in the selected bank/gateway’s secure flow. Do not send them in messages, uploads or support tickets. We retain transaction references, amounts, currency/quote evidence, status and wallet movements.

Unlike card secrets, billing identity, Sheba and payout-verification evidence may be stored by HayatHub for settlement, receipts, reconciliation and disputes. Sensitive billing/bank identity records are encrypted in the relevant verification/accounting workflows; authorized staff may access necessary evidence for a documented task. Hosts do not receive another payer’s full billing or banking identity through accounting exports.

We use appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit and of sensitive data at rest.
• Access controls, authentication, and least-privilege practices.
• Monitoring, logging, and regular security reviews.

Account and operational data is kept for the service and the stated purposes. Financial identity snapshots, accepted agreements, payments, refunds, settlements and bank evidence may need to remain available for accounting, tax, fraud or legal claims after account closure.

A deletion or consent-withdrawal request does not erase records we must lawfully retain. Ask support which records are held, why and for how long; unnecessary data should be deleted or anonymized when its purpose and applicable retention obligations end. No single automatic deletion deadline is promised for every record type.

Contact support using the address below to request access to your information, correction, a copy of available records, account closure or deletion. Identify the relevant account and request; we may verify ownership before releasing or changing data. Financial/legal retention and other applicable limits may restrict what can be deleted.

• Use account controls to update available profile, billing and notification preferences; use Wallet for your available transaction downloads.
• Withdraw optional marketing consent or disable permission-based features without using them. This does not cancel necessary service messages or lawful financial record-keeping.
• Provide only information relevant to the event. Sensitive personal information such as health or beliefs needs specific, informed consent where required; a public profile or event registration is not blanket permission to publish it.
• If an organizer holds a separate copy of your registration data, contact them as well. You may complain to a competent authority without giving up other legal remedies.

We use cookies and similar technologies for essential functions (keeping you signed in), preferences (language and theme), and analytics. You can control non-essential cookies through your browser or in-app settings.

An account does not establish a minor’s legal capacity. Paid registrations, hosting and financial activity require the necessary parent/guardian approval where applicable. If you believe a child’s data was collected without the necessary authority, contact support; we will review protection, deletion and any mandatory record-keeping requirements.

Hosting, email or other selected providers may process information outside your country. This policy does not promise Iran-only storage or a particular international certification. Contact support for information relevant to your service; applicable transfer, confidentiality and security requirements still apply.

Material changes are published with an updated date and suitable notice. A new purpose requiring separate consent must be presented separately; continued use does not replace that consent or remove existing rights.