Privacy Policy

GoOutside is operated by Soro Technologies ("we", "us", "our"), a company incorporated in Ghana. GoOutside is a social-first event discovery platform that helps people in Ghana discover, attend, and share events.

We are registered with (or in the process of registering with) the Data Protection Commission of Ghana as required under the Data Protection Act, 2012 (Act 843).

This policy applies to the GoOutside web application (gooutside.club), associated subdomains, and the mobile app when available.

It does not apply to: third-party websites GoOutside links to, event organisers' own data practices (they are independent data controllers), or third-party payment processors.

Where we rely on legitimate interests, we have carried out a balancing test and concluded our interests do not override your rights. You may object to any such processing — see Section 12.

GoOutside has social features, so some information is designed to be visible to other people. The visibility depends on the feature you use and the choices you make.

GoOutside relies on specialist vendors to provide authentication, storage, payments, messaging, email, hosting, maps, and AI features. These vendors process data for the specific service they provide to GoOutside, subject to their own security and privacy commitments.

We may add, replace, or remove vendors as GoOutside grows. When a new vendor materially changes how your personal data is processed, we will update this policy.

GoOutside is a Ghanaian company, but several key service providers operate primarily in the United States. Your personal data is therefore transferred outside Ghana.

By creating a GoOutside account and accepting this Privacy Policy, you consent to your personal data being transferred to and processed in the United States by the service providers listed above. If you object, contact us at privacy@gooutside.club or delete your account.

Your Pulse Score is calculated algorithmically from your behavior on GoOutside. This constitutes automated profiling under Act 843 and GDPR.

Your lifetime Pulse Points determine your tier (Newcomer → Regular → Plugged In → Scene King → Legend), visible on your public profile and determining reward eligibility.

Your rights regarding profiling: View your full ledger at Dashboard → Rewards → Activity. Request a human review of any calculation you believe is inaccurate by emailing privacy@gooutside.club. You may object to profiling, though this may limit your access to rewards.

GoOutside may notify you about account security, ticket purchases, event changes, direct messages, follows, friend activity, organizer updates, rewards, and product announcements.

Some communications are transactional and cannot be fully disabled while your account is active, such as security alerts, payment receipts, critical ticket updates, and legal notices.

Direct messages are stored and delivered by Stream Chat. They are private to conversation participants, but they are not end-to-end encrypted. GoOutside or Stream may access message content where required for abuse prevention, support, legal compliance, or security.

No advertising cookies. GoOutside does not use Google Analytics, Facebook Pixel, Hotjar, or any advertising network tracking technologies.

Shopping cart data is stored in browser localStorage until you checkout or clear browser storage.

See our Cookie Policy for full details on managing cookies.

• All data in transit is encrypted via HTTPS/TLS
• Database access is protected by Supabase Row Level Security (RLS)
• Server-side database client uses a service-role key never exposed to the browser
• Authentication (passwords, sessions) managed by Clerk using industry-standard security
• Payment card data is never stored on our systems — Paystack's PCI-DSS infrastructure handles this
• Ticket QR codes are cryptographically signed JWTs with bcrypt-hashed secrets

Breach notification: In the event of a breach posing risk to your rights, we will notify the Data Protection Commission of Ghana within 72 hours and notify affected users as soon as practicable.

We acknowledge all requests within 5 business days and respond fully within 30 days.

You can manage much of your information directly inside GoOutside. Some changes may take effect immediately in the app but remain in backups for a limited period.

Deleting your account does not automatically delete records we must keep for legal, tax, fraud prevention, dispute resolution, payment reconciliation, or security reasons.

We may access, preserve, use, or disclose information if we believe in good faith that doing so is reasonably necessary to:

• Comply with Ghanaian law, court orders, subpoenas, production orders, or valid requests from government authorities
• Enforce our Terms of Service, event rules, payment rules, or organizer obligations
• Detect, prevent, or investigate fraud, spam, account takeover, bot activity, platform abuse, or security incidents
• Protect the rights, property, safety, and integrity of GoOutside, Soro Technologies, users, event attendees, organizers, vendors, or the public
• Respond to emergency situations involving risk of death, serious injury, or imminent harm

Where legally permitted and appropriate, we try to limit disclosures to the minimum information necessary for the request or safety purpose.

GoOutside is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has created an account, contact privacy@gooutside.club and we will delete it promptly.

Note: Ghana's Data Protection Bill 2025 (pending enactment) is expected to introduce parental consent requirements. We will update this policy when it comes into force.

When you collect attendee data through the GoOutside ticket flow, you become an independent data controller for that data. You are responsible for having your own privacy notice, using attendee data only for event management, and complying with Ghana's Data Protection Act 2012.

What GoOutside provides to organizers: Attendee name, email, ticket type, and order reference. Aggregate analytics (total sales, revenue, check-in rates). Not provided: payment card details, Pulse Scores, private messages, or precise GPS location.

A Data Processing Agreement (DPA) is available on request at privacy@gooutside.club.

GoOutside (operated by Soro Technologies) is registered with or registering with the Data Protection Commission of Ghana. Our DPC Registration Number will be published here upon receipt.

Complaints: Data Protection Commission of Ghana — dataprotection.org.gh · P.O. Box CT 1719, Cantonments, Accra

If you are in the EEA, Switzerland, or the United Kingdom, you have additional rights under the GDPR: right to restriction of processing, right to object to automated decision-making (see Section 8), and the right to lodge a complaint with the supervisory authority in your country of residence.

For transfers of EEA user data to the United States, we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission.

When we make material changes, we will: (1) post the updated policy at gooutside.club/privacy, (2) update the "Last updated" date, and (3) send email notification at least 14 days before changes take effect. Previous versions are available on request.