Privacy Policy

This is the privacy policy of the Amanita Experience app (App Store and Google Play) and of your Amanita Festival account, which is the same account you use in "My ticket" at www.amanitafestival.com. It explains what personal data we process, how we obtain it, what we use it for, who we share it with, how long we keep it, and how you can exercise your rights.

The controller of your data is Amanita Experience S.R.L. ("Amanita"), the Argentine company that organizes Amanita Festival. The app is published on the App Store and Google Play from the developer account of Muvinai LLC.

For any question about your data, write to us at info@amanitafestival.com.

The app works without an account: to see the lineup, schedule, map, announcements and FAQs we don't ask for your name, email or anything that identifies you. To make it work we only process:

• An installation identifier generated by the app and, if you allow notifications, your device's notification token. We use them to send you festival announcements (schedule changes, news) and the reminders you set on your favorites.

• Your favorites, your agenda and the interests you choose. They are stored on your phone and copied to our servers, linked to that installation identifier and not to your name or your account, so we can send you the announcements and reminders you care about.

• Technical usage and diagnostic data: device model and operating system, app version, language, IP address, screens you visit and crash reports. We look at them in aggregate, to keep the app working well and to improve it. Our servers also use the IP address to prevent abuse, without storing it in the database, and it stays in their technical logs.

We don't use your data for advertising, we don't show ads, and we don't track you across other companies' apps or websites.

The app only asks for a permission when a feature needs it. You can decline it, or remove it later in your phone settings, and keep using the app:

• Notifications: festival announcements and reminders for your favorites.

• Location, only while you use the app: to show you where you are on the venue map. It's used on your phone and we don't send it to our servers.

• Calendar: only to add the activities you choose. We don't read your calendar.

• Camera and photos: only if you upload a profile picture, once that feature is available.

The app doesn't access your contacts, your microphone or your location in the background, and it doesn't take payments: purchases are made on the website.

If you sign in (with a code we email you, or with Apple or Google), you use the same account as in "My ticket". In that case we also process:

• Your email and, if you sign in with Apple or Google, the data that platform shares with us: your name and email. If you choose to hide your email with Apple, we receive an Apple relay address.

• The details you fill in for check-in: first and last name, ID or passport number, date of birth, mobile number, and whether you want us to contact you on WhatsApp.

• Your tickets and purchases: which tickets you have, for which edition, their status, and the history of transfers between people. Purchases are made in our checkout and are governed by the Terms & Conditions published at www.amanitafestival.com/en/terminos.

• The QR code of each ticket and the record of its use at the entrance: day, time and check-in point.

• If you have children's tickets under your care, their name and date of birth, which you enter as the responsible adult.

Your tickets are linked to the email you bought them with. If you sign in with Apple hiding your email, or with a Google account that uses a different email, you won't see the tickets from that purchase: sign in with the same email you used to buy.

• From you: when you sign in, fill in your profile or a ticket’s details, or write to us.

• From the app and your device, automatically: the installation identifier, the notification token, your favorites, your interests, and technical and diagnostic data.

• From your purchases: when you buy in our checkout, we receive the purchase and ticket data.

• From Apple or Google, only if you choose to sign in with them.

• From festival entry: when the check-in team scans your ticket’s QR code.

• Providing the service: showing you the festival content, your favorites, your agenda and your tickets, and letting you send or accept them.

• Check-in and entry: identifying you at the gate, validating your ticket’s QR code, preventing duplicate entries and complying with the event insurance. The check-in team sees your name and ID number to verify your identity.

• Service communications: sign-in codes, notices about your tickets and festival notifications.

• Security and support: preventing fraud or misuse and answering your questions.

• Improving the app: aggregated usage statistics and crash reports.

• Meeting our legal, accounting and tax obligations and keeping the festival's sales history.

We process your data with your consent and to fulfil what corresponds to your ticket, under Argentina's Personal Data Protection Law No. 25,326. We only send you marketing communications if you gave us your consent, and you can unsubscribe from any of them.

We don't sell your data. We only share it with providers that process it on our behalf so the service works, and with authorities when the law requires it:

• Supabase (database, accounts and tickets; servers in São Paulo, Brazil) and Vercel (website).

• The app servers, on Railway and MongoDB Atlas (United States): festival content, favorites, interests, installation identifiers and sending notifications.

• Expo, Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging): delivering notifications. Expo also delivers app updates: each time you open the app, it asks Expo whether there is a new version and sends technical data (platform, version and a random installation identifier).

• Postmark: sending sign-in emails and notices about your tickets.

• Apple and Google, if you sign in with them.

• Sentry and PostHog: crash reports and app usage statistics.

• EdgeOS and the payment processors (SimpleFi, Mercado Pago, Stripe): purchases.

We require all of them to use your data only to provide their service to us and to protect it with the same level of protection described in this policy, or an equivalent one. Some are outside Argentina (in Brazil and the United States): by using the app you accept this international transfer, which we only make with providers that meet those conditions.

Third-party content inside the app: if you tap play on an artist's page, the player loads from YouTube, Spotify or SoundCloud, and the venue map requests satellite imagery from Esri. Your phone connects directly to those services, which receive your IP address as when you visit their websites and handle it under their own privacy policies.

• App data without an account, while you use it. What's stored on your phone is deleted when you uninstall the app.

• Your account sign-in data, while your account is active.

• Purchase and ticket records (who bought, which ticket, in whose name, with which check-in details, its history and its use at the entrance) are kept as the festival’s history and to meet accounting, tax and consumer protection obligations. They are not deleted even if you delete your account.

• Technical and crash reports, for a limited period.

You can delete your account at any time, in any of these ways:

1. From the Amanita Experience app: go to your account and tap "Delete my account".

2. From the website: sign in at www.amanitafestival.com/en/mi-entrada with your email and, at the bottom of the page, choose "Delete my account".

3. By email, even if you no longer have the app: write to info@amanitafestival.com from your account’s email address, with the subject "Delete my account", and we will delete it within the time limits set by Law No. 25,326.

What is deleted: your user, your sign-in data (the sign-in email and any linked Apple or Google accounts) and your open sessions. The app is no longer linked to your account.

What is kept: the records of your purchases and tickets described in "How long we keep it", for the same reasons. If you sign in again later with the same email, you will see your tickets again.

If you use the app without an account, uninstalling it deletes what is stored on your phone. If you also want us to delete the data linked to your installation (favorites, interests and notification identifier), write to us at the same address.

You can withdraw your consent at any time:

• For notifications, location, calendar or camera: remove the permission in your phone settings.

• For marketing emails: use the unsubscribe link included in each one.

• For everything linked to your account: delete it as explained above, or write to us at info@amanitafestival.com.

Withdrawing your consent doesn't affect what was done before, or the records we keep for the reasons explained in this policy.

As the owner of your data you can access it free of charge (at intervals of no less than six months, unless you show a legitimate interest), ask us to correct, update or delete it, and withdraw your consent, under sections 14, 15 and 16 of Law No. 25,326. You can also ask us at any time to remove you from our databases used for advertising (section 27, subsection 3).

You can see and correct much of your data yourself from your profile. For everything else, write to us at info@amanitafestival.com.

Argentina's Agency for Access to Public Information (Agencia de Acceso a la Información Pública), as the Supervisory Authority of Law No. 25,326, has the power to handle complaints and claims filed by anyone whose rights are affected by non-compliance with the personal data protection rules in force.

All information travels encrypted (HTTPS). Access to data is limited by permissions in the database itself: each person only sees their own data and the team only accesses what they need for their task. We don't use passwords: you sign in with a one-time code or with Apple or Google. Each ticket's QR code is unique and cannot be derived from other data.

No system is infallible. If we detect an incident affecting your data, we'll let you know.

The app is not directed at children under 13 and we don't ask them for data through it. The data of the children who come to the festival (name and date of birth, for check-in) is entered by the responsible adult from their account. If you believe a minor has given us data, write to us and we'll look into it.

If we change this policy, we'll publish the new version on this page with its date. If the change is significant, we'll also let you know in the app.

Amanita Experience S.R.L. · info@amanitafestival.com · www.amanitafestival.com