Privacy Policy

Stratus Services ("we", "our" or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share and protect your information when you use Salgo: the mobile app for iOS and Android and the website salgo.app.

We may collect information about you in several ways:

• Personal Data: Name, email address and other contact information that you provide.
• Authentication Data: When you sign in using Google OAuth, we receive your basic profile information (name, email address, profile picture).
• Usage Data: Information about how you interact with our services, for example the screens and events you view and the searches you make.
• Device Data: Browser type, operating system, IP address and device identifiers.
• Purchase Data: When you buy tickets on Salgo, the order identifier, the amount, the currency and the corresponding event.
• Email Communications Data: To manage newsletters and event updates by email, we process your phone number, city, department and country (when you provide them), how you joined our contact list, your subscription status and your notification preferences, and data about your interaction with the messages we send, as explained in section 6.
• Analytics and Advertising Identifiers: Cookies and identifiers that Google and Meta use to measure usage and advertising campaigns, as explained in section 5.

We use the information we collect to:

• Provide, maintain and improve our services
• Authenticate your identity and manage your account
• Communicate with you about updates and support
• Send you newsletters and event updates by email, and measure interaction with those messages, as explained in section 6
• Understand how our services are used and measure the performance of our advertising campaigns
• Show you more relevant events and promotions, including through audiences on Meta and Google
• Ensure the security and integrity of our services
• Comply with legal obligations

Salgo uses Google OAuth for authentication. When you sign in with Google, we only request access to your basic profile information (name and email address). We do not access your Google Drive, Gmail or other Google services unless explicitly indicated and consented to by you.

Salgo uses Google and Meta services to understand how the service is used and to measure the performance of its advertising campaigns.

• Website (salgo.app): Google Analytics and the Meta Pixel are loaded through Google Tag Manager only after you accept the cookie notice, which distinguishes between analytics (Google Analytics) and advertising (Meta and Google). You can change your choice at any time from "Configurar cookies" (cookie settings), in the footer of the home page or in your profile on the web version. The cookies involved are _ga (Google Analytics) and _fbp and _fbc (Meta).
• Mobile app: Using the app includes analytics (Google Analytics for Firebase) and advertising measurement (Google Ads through Firebase, and Meta through Salgo's servers) to measure app installs and campaign performance. The app does not include the Meta SDK: when you install or open the app, and only if your advertising choice allows it, Salgo's servers send that event to Meta (Conversions API) with the app installation identifier, the device advertising identifier when permitted, technical device data (operating system and version, model, language, time zone and screen), the IP address and the user agent. You can turn off ad personalization at any time from Profile → "Personalizar publicidad" (personalize advertising), which is on by default.
• iOS: The device advertising identifier (IDFA) is only used if you accept Apple's "Allow tracking" prompt (App Tracking Transparency). If you do not accept it, installs are measured in aggregate through SKAdNetwork.
• Android: You can reset your advertising identifier or turn off ad personalization from your device settings.
• Purchases: When a ticket purchase is confirmed, and only if your advertising choice allows it, Salgo's servers send that event to Meta (Conversions API) and to Google (Google Analytics Measurement Protocol) to measure ads. We send the order identifier, the amount and the currency, the reference to the event, the analytics and advertising identifiers mentioned above and a SHA-256 hash of your email address, never the email address in plain text. For purchases made from the browser, the IP address and the user agent may also be sent.

We send email communications, including newsletters and event updates, only to registered Salgo users, who can turn categories of communications (news, recommendations, promotions and advertising) on or off from Profile → Notificaciones (notifications). Sending is based on your consent.

To manage these communications we process: your email address, first and last name, phone number, city, department and country (when you provide them), how you joined our contact list, your subscription status and your preferences, and the interaction data described below.

• Open and click measurement: Every marketing communication includes a tracking image that records whether it was opened and when, and the links it contains redirect through our own domain (salgo.app/r/…), which records the click before redirecting you. This information is associated with you as the recipient and is used to measure interaction with our communications, keep our contact list up to date by no longer sending to inactive or invalid addresses, and improve the content and timing of our messages. Email clients that preload images (for example, Apple Mail Privacy Protection) or block them affect this measurement. Transactional notices (for example, purchase confirmations tied to your account) do not include the open-tracking image.
• How to unsubscribe: Every marketing email includes a one-click unsubscribe link (in addition to the standard List-Unsubscribe header); registered users can also turn off categories from their profile, and turning off remote images in your email client prevents open measurement. Unsubscribing from marketing communications does not interrupt transactional notices tied to your account, which are managed separately in your notification preferences.

Salgo offers a connector, based on the Model Context Protocol (MCP) standard, that allows an artificial intelligence assistant such as ChatGPT or Claude to query Salgo and act on your behalf. Its address is https://salgo.app/mcp and it only works if you add it in your assistant and authorize it by signing in with your Salgo account. The steps are on the AI Connectors page.

• What is accessed, and only with your authorization: with your authorization, the assistant can access the same things you can see and do with your account, according to your role: the public catalog (events, venues, producers and artists); your own data (for example your tickets, orders, saved events, venues and producers you follow, notifications and reviews); and, if you are part of a venue, a producer or an artist, the management information and actions that your role allows. The connector does not grant more permissions than your account already has.
• What Salgo stores and for how long: to maintain the connection we store temporary technical authorization records, which are deleted when they expire: the registration of the assistant as a client (up to 7 days), the state of a sign-in in progress (up to 10 minutes), a single-use authorization code (60 seconds) and a refresh token tied to your account, which includes the access credential needed to renew it (up to 30 days, and it is replaced each time it is used). Connector sessions on our server are closed after 2 hours without use or 24 hours after they are opened. In addition, as with any sign-in to Salgo, a connector-type session tied to your account is recorded, with its last-used date and the client's user agent. Salgo does not keep a copy in the connector of the information returned to the assistant.
• Server logs: the connector server records, in a technical format, the date, the requested path, the response code and the IP address of each request and, for each tool that is invoked, its name, the time, the duration and the result status (success or error); we do not log the content of the parameters the assistant sends or of the responses returned to it, and access tokens are masked in the logs. We use these logs only to operate, protect and debug the service, and they are deleted automatically within 30 days at most.
• What the AI provider you chose receives: the information the connector returns (for example your tickets or the details of an event) is sent to the assistant you chose and, from there, is subject to the terms and privacy policy of the AI provider you chose (for example OpenAI or Anthropic), over which Salgo has no control. Keep this in mind when deciding what to ask.
• No model training: Salgo does not use the data accessed through the connector to train artificial intelligence models, and does not sell it.
• No purchases or payments: the connector does not complete purchases or payments; tickets are bought in the app or on salgo.app.
• How to disconnect it or revoke access: you can remove the connector in your assistant's settings at any time, and it stops requesting data on your behalf. To also revoke the access already granted to your account, write to [email protected] and we will close the connector sessions tied to your account; any remaining refresh tokens expire on their own, after 30 days at most.

To exercise your rights over this data, see section 11.

We do not sell or rent your personal information. We may share your information only in the following circumstances:

• With your consent
• To comply with legal requirements
• To protect our rights and prevent fraud
• With service providers that assist our operations (under strict confidentiality)
• With Oracle Cloud Infrastructure (sending our emails), Cloudflare (content delivery network and storage of the images used in emails and in the app) and Amazon Web Services (hosting of our servers and databases), which act as data processors on our behalf under confidentiality and security obligations
• With Google and Meta, as analytics and advertising measurement providers, on the terms of section 5 and subject to their own terms
• With the AI assistant you choose to connect (for example ChatGPT or Claude), only when you authorize it and on the terms of section 7

Google and Meta may process your data outside Uruguay, for example in the United States. Oracle Cloud Infrastructure processes data in the São Paulo, Brazil region to send our emails; Cloudflare operates a global content delivery and storage network that may process data outside Uruguay; and Amazon Web Services hosts our servers and databases in the United States (us-east-1 region). These providers act as data processors on our behalf, under confidentiality and security obligations, and the transfer is necessary to provide you with the service.

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure or destruction. However, no method of transmission over the Internet is 100% secure.

In accordance with Uruguay's Law No. 18,331 on Personal Data Protection and its implementing decree, you have the right to:

• Access and receive a copy of your personal data
• Rectify and update inaccurate personal data
• Request the inclusion or deletion of your personal data
• Withdraw your consent at any time
• Turn off advertising measurement with the options described in section 5
• Unsubscribe from marketing email communications at any time, as explained in section 6
• File a complaint with the Personal Data Regulatory and Control Unit (URCDP)

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations. Analytics and advertising measurement data are retained under that same criterion and according to each provider's retention settings. Contact data and email communication preferences are retained while your Salgo account is active; if you unsubscribe, your email address is kept only on a suppression list to respect your decision and is not used to send you marketing communications. Data on interaction with the messages we send (opens and clicks) is retained for up to 24 months and then deleted or anonymized. The temporary records of the AI connector are retained for the periods in section 7.

We may update this Privacy Policy from time to time. We will notify you of any change by posting the new Privacy Policy on this page and updating the "Last updated" date.

If you have any questions about this Privacy Policy or want to exercise your rights, please contact us at:

Email: [email protected]