Skip to main content

Privacy policy

This privacy policy describes how Audience Engage Oy processes personal data on the keino.io website and in the KEiNO service. The KEiNO service means the KEiNO app, the KEiNO web shop (a shop’s own address under keino.io or a merchant’s own domain), the KEiNO Console at console.keino.io, the KEiNO Scanner app used by merchant staff, and the ticket and booking links at app.keino.io. Last updated: 15 September 2026.

Data controller

Audience Engage Oy (business ID 2786950-7)
Linnankatu 3, 20100 Turku, Finland
Email: info@keino.io
Phone: +358 20 741 1100

Requests concerning your personal data can be sent to support@keino.io.

A merchant that sells tickets, products or bookable times through KEiNO is a separate data controller for its own customer relationship. Section 6 explains which data the merchant receives.

1. The keino.io website

Server logs and security

The web server records the IP address, time, requested page, referring page and browser of each visit. The site’s security software (Wordfence) uses the same information to detect and block attacks and shares data about attack attempts with the software vendor, Defiant Inc. (USA). Logs are used only for security and troubleshooting and are kept for a limited time. The website is hosted by Hetzner Online GmbH on a server located in Finland.

Cookies and analytics

The site sets cookies that are necessary for it to work, such as the language choice and your cookie preferences. With your consent, the site also uses Google Analytics and Google Tag Manager for visitor statistics and Meta Pixel and Meta’s Conversions API for measuring advertising. Statistics and marketing cookies are set only after you accept them in the cookie banner. The cookies, their lifetimes and a control for changing your choices are described on the cookie policy page.

The site’s fonts are loaded from Google Fonts, so your browser sends your IP address to Google when a page loads. Pages that contain a form load Google reCAPTCHA, which sends your IP address and information about your browser and how you interact with the page to Google to tell people apart from bots.

The site has no comments and no visitor registration, and it embeds no content from other websites. Links to app stores, maps and other external sites take you to those services, whose own privacy policies apply.

Contact forms

The order, trial and support request forms ask for your name, email address, phone number, the name of your organisation or venue, and your message. The support form also lets you attach a screenshot or a file. Submissions are delivered by email to our sales and support team and are not stored in the website’s database. We use the information to answer you, to set up the service you ordered and to resolve your support request. The processing is based on the steps needed before entering into a contract and on our legitimate interest in answering enquiries.

Logging in from keino.io

The login dialog on keino.io signs you in to the KEiNO Console. Your email address and password are sent from your browser directly to Firebase Authentication (Google), not to the keino.io server. Opening the dialog loads the Firebase software and Google reCAPTCHA Enterprise, which checks that the login is made by a person. After a successful login your browser is directed to console.keino.io with a single-use login token. The website itself stores no login details.

2. Buying and booking in the KEiNO service

Account and phone number

When you open the KEiNO app, an account is created for you automatically without any registration form. To see your tickets and bookings you verify your phone number with a code sent by text message. In the web shop you sign in with your phone number and a text message code sent by Firebase Authentication. The verified phone number is linked to your account and your purchases, so a ticket bought with a text message link or in the web shop can be shown in the app. We store your language choice, your favourite shops and your notification choices.

Purchases and bookings

At checkout we ask for your name, email address and phone number and, for business customers, the company name and VAT ID. We store these together with the items you bought, the prices, the payment status, the booking time, the number of participants, any notes you add to a booking, and the confirmations, reminders and receipts we sent you. You can choose to save your details on your own device for the next purchase.

Payments are processed by Stripe. Your card number and other payment details go directly to Stripe and never reach our systems. We store Stripe’s references to the payment and the customer, the type of the payment method, the last four digits of the card and its expiry date. Apple Pay, Google Pay and Pay by Bank payments also go through Stripe. Stripe may automatically assess a payment for fraud and decline it.

Technical data and location

With every purchase and booking we record information about your device and connection: the app or browser version, device model and operating system, a device identifier, language, time zone, country, mobile operator, IP address and, in a browser, the browser’s user agent string. The app also records the same device information in your account while you use it. If you have given the app or your browser permission to use your location, the location at the time of the purchase is stored with the purchase. We use this data to prevent fraud and misuse, to handle payment disputes and to troubleshoot problems. When a payment is disputed, we pass the purchase details, including this technical data, to Stripe as evidence. The processing is based on our legitimate interest in preventing fraud and defending against disputed payments.

The KEiNO app asks for location permission to show how far away each shop is. Location is used only while the app is open. The web shop asks for your location in the browser for the same purpose. You can decline the permission and still make purchases.

Text messages, email and notifications

We send verification codes, order and booking confirmations, booking reminders and ticket links by text message through GatewayAPI ApS (Denmark), and confirmations and refund notices by email through Twilio SendGrid. The message content, the recipient number or address and the delivery status are stored so that we can show you your messages and resolve delivery problems.

If you allow notifications in the KEiNO app, we store a notification token for your device (Firebase Cloud Messaging). Your favourite shops can send you messages through the app, and you can turn these on or off for each shop in the app’s favourite menu or in your device settings. We record whether a message was delivered, opened and which links in it were opened, so that the merchant can see how many recipients read the message. The merchant sees counts only, not who received it.

We do not send marketing emails or marketing text messages.

Forwarding a ticket

When you forward a ticket to someone else, you enter the recipient’s phone number. The app can open your contacts so that you can pick the number; the contact list stays on your device and is not uploaded. We store the recipient’s number together with the forwarded ticket and send the recipient a text message with a link for claiming the ticket. If a merchant gives you a ticket or a booking, the merchant enters your phone number and we send you the same kind of link.

Camera

The KEiNO app uses the camera, with your permission, to read QR codes and to scan a payment card in the Stripe payment view. QR codes are read on the device and no images are stored.

Usage statistics and crash reports

The KEiNO app collects usage statistics with Firebase Analytics (which screens are viewed, items added to the cart and completed purchases) and crash reports with Firebase Crashlytics. Crash reports are linked to your account identifier so that we can investigate a problem you report. The web shop and the KEiNO Console collect the same usage statistics only if you accept them in their cookie banner. The processing is based on our legitimate interest in keeping the service working and developing it.

3. Merchants and their staff

A merchant’s account in the KEiNO Console and the KEiNO Scanner holds the name, email address and optional profile picture of the user, and the sign-in method (email and password, Google or Apple). For each shop we store the company name, business ID, VAT ID, billing address, contact person, electronic invoicing details and the bank account used for settlements. Staff invitations store the invited person’s email address and the inviter’s name. The KEiNO Scanner keeps the customer names it shows only for the duration of the session and does not save them on the device.

When a merchant uses the AI assistant to write an event or product description, the text the merchant enters (for example the event name, place, date, performers and highlights) is sent to Google’s Gemini model, and the same keywords are sent to Google Custom Search and to the image services Unsplash, Pexels, Pixabay and Wikimedia Commons to find pictures. The Gemini requests may be processed outside the EU. When a merchant sets the shop’s location, the address search uses Google Maps. The Console’s text editor is loaded from Tiny Technologies’ servers.

4. Purposes and legal bases

  • Delivering the service: creating your account, selling and delivering tickets, products and bookings, sending confirmations and reminders, and providing the merchant tools. Legal basis: performance of a contract.
  • Payments, refunds and payment disputes. Legal basis: performance of a contract and legal obligations.
  • Preventing fraud and misuse, securing the service, and troubleshooting. Legal basis: legitimate interest.
  • Customer support and answering enquiries. Legal basis: performance of a contract and legitimate interest.
  • Usage statistics and developing the service. Legal basis: legitimate interest in the app; consent on the website, in the web shop and in the Console.
  • Messages from your favourite shops and location-based distances. Legal basis: consent, which you give through the notification and location permissions and can withdraw at any time.
  • Accounting and other legal obligations. Legal basis: legal obligation.

We do not make decisions based solely on automated processing that would have legal or similarly significant effects on you.

5. Recipients and service providers

We use the following service providers, which process personal data on our behalf and under our instructions:

  • Google (Google Ireland Ltd and Google LLC): Firebase Authentication, the Cloud Firestore database, Cloud Storage, Cloud Functions, Cloud Messaging, Firebase Analytics, Crashlytics, App Check and reCAPTCHA, Google Fonts, Google Analytics and Tag Manager on the website, Google Maps in the Console, and the Gemini AI model.
  • Stripe Payments Europe Ltd (Ireland): payment processing, payment methods, receipts and disputes.
  • Twilio SendGrid (USA): email delivery for the website’s forms and the service’s emails.
  • GatewayAPI ApS (Denmark): text message delivery.
  • Apple and Google: Sign in with Apple and Google sign-in for merchant accounts, and delivery of push notifications to iOS and Android devices.
  • Expo (USA): update checks for the KEiNO app.
  • Meta Platforms Ireland: advertising measurement on the website, only with your consent.
  • Defiant Inc. (USA): the Wordfence security software on the website.
  • Hetzner Online GmbH (Germany): hosting of the keino.io website on a server in Finland.
  • Tiny Technologies, Unsplash, Pexels, Pixabay and Wikimedia Commons: the Console’s text editor and image search, as described in section 3.

We may also disclose data to authorities when the law requires it, and data may be transferred to a buyer if the business is sold. We do not sell personal data.

6. What the merchant sees

The merchant whose shop you buy from, and the staff the merchant has added to the shop, can see your orders and bookings in the KEiNO Console: your name, email address and phone number, the company details you gave, the items bought, the booking times and the notes you added, together with the technical purchase data described in section 2. The merchant can export order and booking lists that contain your name, email address and phone number, can associate a phone number with an order at your request, and can send you a ticket or a booking by text message. Merchant staff scan your ticket or booking at the venue and see the ticket details and the time it was used. The merchant uses this data as an independent controller for its own customer relationship; contact the merchant for questions about that use.

7. Where data is stored and transfers outside the EU

The service’s database is stored in Google Cloud’s European multi-region and its files in Finland; the backend functions run in Finland and Belgium. The keino.io website is hosted in Finland. Stripe, SendGrid, Google, Meta, Expo and Defiant may process data in the United States or elsewhere outside the EU, and the Gemini AI requests are served from a global endpoint. Such transfers rely on the EU-US Data Privacy Framework or on the European Commission’s standard contractual clauses.

8. How long we keep data

  • Account data: until you ask us to delete your account.
  • Purchases, bookings, payments, refunds and the related messages: for the period required by accounting legislation, six years from the end of the financial year in which the transaction took place. These records are kept even if the account is deleted.
  • Phone number verification records: 180 days from the last verification.
  • Notification tokens of devices that are no longer in use: deleted after one year.
  • Contact form submissions and support emails: as long as handling the request requires.
  • Server logs: a limited time for security and troubleshooting.

9. Your rights

You have the right to access the personal data we hold about you, to have inaccurate data corrected, to have your data erased, to restrict or object to the processing, to receive the data you have provided in a machine-readable format, and to withdraw a consent at any time. Erasure does not cover data we must keep under accounting or other legislation. To exercise your rights, email support@keino.io from the address or phone number connected to your account; we may ask you to verify your identity. We respond within one month. You also have the right to lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi).

10. Children

The service is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.

11. Security

Connections to the website and the service are encrypted. Access to personal data is limited to the staff who need it and is controlled with access rules in the database. Payment details are handled only by Stripe. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes

We update this policy when our processing changes. The current version is always published on this page, and the date at the top shows when it was last updated.