Karsenics Platform Participant Privacy Notice
Effective Date: September 27, 2026 · Last Updated: September 27, 2026
The short version. You are registering for an event run by an independent organization. That organization decides what to ask you and what to do with your answers. Karsenics makes the software and handles your information on the organization's instructions. We do not sell your information, we do not use it for our own marketing, and we do not use it to train machine learning models. If you want your information changed or deleted, ask the organization first, because it controls the record.
This notice covers the Karsenics platform. It is different from the Karsenics website privacy policy, which covers karsenics.com only.
1. Who is responsible for your information
| Role | Who | What it means |
|---|---|---|
| Controller (the "business" under California law) | The organization running the event | Decides what to collect, why, who sees it, and how long to keep it. Its own privacy notice applies to you. |
| Processor (the "service provider") | Karsenics PBC | Stores and processes your information on the organization's instructions. Does not decide what to collect or what it is used for. |
Karsenics is a separate controller for a narrow set of its own records: security and access logs, and de-identified aggregate statistics about how the platform is used. Those are described in Section 6.
Being the processor does not mean Karsenics has no responsibilities of its own. Karsenics is responsible for securing the platform, responding to security incidents, keeping its own access logs, following the organization's instructions, using your information only as its contract with the organization allows, and passing along the privacy requests it receives.
2. What the platform collects
Exactly which of these applies depends on what the organization asks for. The organization can add its own questions, and Karsenics does not control them.
Always or almost always:
- Your name, and the name of the business, group, contingent, or organization you represent
- Email address and telephone number
- Mailing address
- What you registered for, the options you chose, and the amounts you were charged
- When you accept an agreement or these platform terms: the name you typed, whether you registered for yourself, for an organization, or for a minor, the version of each document you accepted, and the date and time
- Technical data: IP address, browser and device type, and timestamps of your visits
Often, depending on the registration type:
- Emergency contact name and telephone number, particularly for volunteers and parade participants
- Documents you upload: certificates of insurance, health permits, food handler certifications, business licences, parade insurance riders, and their expiration dates
- Photo and media release preference
- Accessibility or accommodation requests, and dietary information, where the organization asks
- Vehicle, trailer, tent, or equipment details
- Booth, space, zone, or lineup position assigned to you
- Answers to the organization's own custom questions
Payment information. When you pay by card, the card details go directly to the payment processor. Karsenics never receives or stores your full card number. When you pay from a bank account, your bank login and account details go to the payment processor to verify and debit the account, and Karsenics never receives your full account number. We receive and store the payment method type, the last four digits, the amount, and a transaction reference so the organization can reconcile it.
What the platform is not designed to collect. Government identification numbers, financial account numbers, health or medical records, and information about your race, religion, political views, sexual orientation, or union membership. If an organization asks you for any of that through a custom question, it is doing so on its own initiative and against Karsenics' guidance. Tell us at privacy@karsenics.com and we will raise it with them.
3. Why it is used
- To create and manage your registration and issue your confirmation and receipt
- To assign your booth, space, zone, or lineup position
- To collect and track required documents and warn the organization when one is expiring
- To take payment through the organization's payment account and to process refunds the organization approves
- To send you transactional messages about your registration and operational messages about the event, including schedule, load-in, weather, and safety notices
- To let the organization run its event, produce its rosters and reports, and reconcile its money
- To keep the platform secure, detect fraud, and diagnose problems
- To meet legal obligations
Not used for: advertising, cross-site tracking, profiling, sale, or model training.
4. Who your information is shared with
4.1 The organization running the event, and its staff and volunteers who need it. This is the point of the platform.
4.2 Other participants and the public, only where the organization publishes it. Some organizations publish a public vendor directory, a lineup order, or a map showing booth names. Business or booth names and space assignments may be public. Your personal email address, telephone number, emergency contact, and uploaded documents are not published by the platform.
4.3 Karsenics service providers, listed in full in our published Subprocessor Register:
| Provider | What it does |
|---|---|
| Render Services, Inc. | Hosts the platform and its database |
| Stripe, Inc. | Processes payments through the organization's own account |
| Postmark (ActiveCampaign, LLC) | Sends confirmations, receipts, and reminders |
| BoldSign (Syncfusion, Inc.) | Handles electronic signatures, where the organization uses it |
| Anthropic, PBC | Powers Milton AI, the assistant the organization's staff can use inside the platform. It can read the records a staff member's question needs, which can include names and contact details. It does not use them to train its models, and it receives nothing from an organization that has turned Milton AI off |
Each is bound by contract to use your information only to provide its service and not for its own purposes.
4.4 When the law requires it, in response to a valid legal demand, or to protect someone's safety.
4.5 If Karsenics is acquired or merges, your information may transfer as part of that transaction, and the organization remains the controller of it.
4.6 We do not sell your personal information and do not share it for cross-context behavioral advertising. No money or other value is exchanged for it.
5. How long it is kept
The organization decides. In general:
| Record | Typical retention |
|---|---|
| Registration records and answers | Kept by the organization for as long as it wants them, often across multiple years so you do not have to re-enter everything next season |
| Uploaded compliance documents | Usually kept until expiry plus the organization's own retention period |
| Agreement acceptance records | Kept for at least six years after the registration ends, so that Karsenics or the organization can show what was accepted and when. Kept longer only where a dispute, audit, or legal hold requires it |
| Payment records | Kept as long as the organization's tax and accounting obligations require, typically several years |
| Karsenics security and access logs | 12 months |
| Backups | Overwritten on a rolling schedule described in the Karsenics Records Retention and Deletion Policy |
When an organization stops using Karsenics, its data is available to it for 30 days and is then deleted or de-identified within 90 days, except where the law requires longer.
6. Karsenics' own records
Independent of the organization, Karsenics keeps: security, audit, and access logs; records of support requests you send us directly; and de-identified aggregate statistics such as how many registrations a platform feature handled. Aggregate statistics do not identify you, the organization, or any individual, and we may use them to operate, secure, and improve the platform and to describe our work publicly.
7. Your choices and rights
7.1 Ask the organization first. It controls your record and can view, correct, export, or delete it directly.
7.2 If you contact us, at privacy@karsenics.com with the subject line "Privacy Request," we will acknowledge you within five business days, direct you to the organization, and forward your request to it. We do not change or delete an organization's records without its instruction, except where the law requires us to.
7.3 What you can ask for, wherever you live: a copy of what is held about you, correction of anything wrong, deletion, a portable copy, and to stop receiving non-transactional messages.
7.4 What you cannot opt out of. Transactional messages, meaning your registration confirmation, your receipt, a refund confirmation, and notices required to deliver what you registered for. These are records of a transaction you entered into.
7.5 California, Texas, and other state rights. California residents have the rights described in the Karsenics website Privacy Policy at Section 7.2, and Texas residents the rights described at Section 7.3, including the right to appeal a denial and then complain to the Texas Attorney General. Because the organization is the business or controller, those requests are directed to it, and we assist.
7.6 Photo and media. Where the platform collects a photo or media release preference, your choice is recorded and shown to the organization. Whether the organization honors it at the event is the organization's responsibility.
8. Security
Karsenics protects your information with encryption in transit and at rest, role-based access controls with multi-factor authentication for administrative access, separation between organizations so one cannot see another's records, logging of administrative access, and managed hosting with regular patching. Full card numbers never touch Karsenics systems.
Karsenics does not currently hold a SOC 2 Type II report or an ISO 27001 certification. We say so rather than implying otherwise. No system is perfectly secure. If you believe your information has been compromised, contact privacy@karsenics.com immediately.
If a data breach affects your information, Karsenics notifies the organization within 48 hours of confirming it, and the organization is responsible for notifying you where the law requires.
9. Minors
Registrations are completed by adults. You must be 18 or older to register for yourself or for a business, nonprofit, or group. Where an organization allows minors to take part, for example as volunteers or in a parade contingent, a parent, legal guardian, or other legally authorized adult completes the registration and gives any consent. The platform records that adult, their relationship to the minor, and the minor's name only where the organization requires it. The platform is not designed to collect information directly from children under 13 and must not be used that way. If you believe a child has submitted information directly, contact privacy@karsenics.com and we will work with the organization to remove it.
10. Where your information is held
In the United States. If you are outside the United States and register through the platform, your information is transferred to and processed in the United States, which may have different data protection laws than your country. Karsenics does not claim compliance with the EU or UK General Data Protection Regulation.
11. Changes
We may update this notice. The date at the top changes when we do, and we will tell organizations about material changes so they can tell their participants.
12. Contact
Karsenics PBC · privacy@karsenics.com · 3120 Southwest Fwy, Ste 101, PMB #803188, Houston, TX 77098-4520
For anything about the event, or to change or delete your registration, contact the organization running it.
© 2026 Karsenics PBC. All rights reserved.