Account & Security Settings

Account & Security

Managing Your Profile

Your profile is the central hub for your identity on the platform. You can:

• Update your personal details, company info, and avatar.
• Manage your Contact Details (email, phone, WhatsApp, social media).
• View and manage your active roles via Feature Access.
• Choose how and what we contact you about via Communication Preferences.

Communication Preferences

From Dashboard → Profile → Communication Preferences, you control:

• Delivery methods – Email, SMS, WhatsApp, and Push Notifications. Turn off any method you don't want us reaching you on.
• Content – Marketing & Promotions, Event Updates, Booking Updates, and Platform Announcements. Turn off any category you'd rather not receive.

Every marketing email also has an Unsubscribe from marketing emails link in its footer — clicking it turns off Marketing & Promotions for your account with one click, no login required. Account and booking security messages (password resets, new-device login alerts, booking confirmations) are always sent regardless of these settings, since they're essential to using the platform safely.

Browser Notifications

From Dashboard → Notifications, click Enable to receive push notifications straight to your browser (ticket, booking, and event updates) even when the tab isn't open — the same notifications the mobile app sends. Turn it off again at any time from the same page, or by blocking notifications for the site in your browser's own settings. On the mobile app, this is its own opt-in toggle — More → Privacy & Permissions → In-App Notifications — off by default, with an in-app explanation shown before your device asks for permission.

The notification bell in the top bar also updates live while you have a page open — the unread count bumps, the bell rings, and a popup names the new notification, with no need to refresh the page.

Informativ also works as an installable app — most browsers will offer to add it to your home screen or desktop for quicker access, without needing to download anything from an app store.

Password & Login Security

You can change your password at any time. If you forget it, use the Forgot Password link on the login page to receive a reset email via the Laravel password broker.

We also support Google OAuth login for quick and secure access. Login, registration, and password reset are all protected by reCAPTCHA to keep bots out.

If you signed up with Google and have never set a password, the Password tab shows an Email me a link to set a password button instead of a current-password field — click it and follow the link we send to your account email to set one, useful if you ever want to sign in without Google.

Dashboard → Profile → Security also lists every browser/app that has signed in to your account, with the location and last-seen time for each — we'll email you whenever a new one shows up. Don't recognise one? Press Sign out next to it: everything signed in from that device ends at once, and it needs your password and a sign-in code to get back in. Change your password too.

If you signed in without checking Remember me and then leave the site idle for 5 minutes, an Are-you-still-there warning pops up with a 30-second countdown — click Stay signed in to keep going, otherwise you are signed out automatically and asked to sign in again. Checking Remember me (or signing in with Google, which is always remembered) keeps you signed in through idle periods with no warning — though if a remembered login goes a full 7 days with no activity at all, it is retired behind the scenes, so an old remember-me cookie can never wake it back up.

The mobile app keeps you signed in for as long as you keep using it. If the app goes 90 days without being used on a phone, that phone is signed out and you just sign in again. Lost a phone? Dashboard → Profile → Security → Signed In to the App (or Profile → Security → Signed-in Devices in the app) lists every phone signed in to your account by its model, and lets you sign any one of them out.

Sign-In Codes by Email

Every account has a second step at sign-in. The first time you sign in on a browser or in the app — with your password, Google, Apple or Facebook — we email a 6-digit code to your account's email address. Enter it to finish signing in. The code expires after 10 minutes, works once, and stops working after 5 wrong tries. Didn't get it? Check your spam folder, or tap Send me a new code (once a minute).

Once a device has passed the code check it's trusted for 30 days (7 days for Root, Sire, Manager, Admin and Partner accounts), so you won't be asked again on that browser or app until then. Trust belongs to that one browser or app only: another device is still asked for a code, even with your password. If you get a code you didn't ask for, someone has your password — change it right away and never share the code with anyone.

Signed out everywhere else. Changing your password (or resetting it), or changing your two-factor settings (turning it on or off, replacing your authenticator app, or getting new recovery codes), signs you out on every other browser and app straight away, and they have to pass the code check again. The device you made the change on stays signed in. You can also do this yourself any time: Dashboard → Profile → Security → Sign Out of All Other Devices.

Two-Factor Authentication with an Authenticator App

For stronger protection, from Dashboard → Profile → Security you can switch to an authenticator app: scan the QR code with Google Authenticator, Authy, 1Password, etc., then enter the 6-digit code it shows to confirm. From then on, signing in on a new browser or app asks for the app's code instead of an emailed one.

• You're given 8 one-time-use recovery codes when you enable 2FA — save them somewhere safe. Each one can sign you in once if you lose access to your authenticator app. You can regenerate a fresh set at any time (this invalidates the old ones).
• A device that's already passed the code check once is remembered for 30 days (7 days for the accounts that must use an authenticator app) — you won't be asked again on that same browser/app until then, or until you change your password or two-factor settings.
• New phone, or think someone else has your codes? Choose Replace Authenticator App and confirm your password. Your old codes and recovery codes stop working at once, every other device is signed out, and you scan a new QR code to finish. This works for every account, including the ones that must keep two-factor on.
• Root, Sire, Manager, and Admin accounts are required to use an authenticator app to keep dashboard access — everyone else can turn it on or off freely (with it off, emailed codes protect your sign-ins).
• Lost your authenticator app and all your recovery codes? You can't disable 2FA yourself in that case — contact an administrator, who can reset it for your account from Dashboard → Users so you can set it up again.

How We Protect Your Information

Your personal details — name, email, phone and WhatsApp numbers, ID number, date of birth, addresses, and sign-in IP addresses — are encrypted in our database, as are the details of guests, buyers and bookers. Private documents you upload (proofs of payment, ownership and verification documents, bank letters, support attachments, tech riders, incident photos and voice notes, credit-book photos) are stored encrypted too, and only open for the people allowed to see them.

One thing you'll notice: because names, emails and phone numbers are encrypted, search boxes in the dashboard find people by their exact name, email address or number (capital letters don't matter) rather than by part of it. Business names, stage names and usernames can still be searched by part of the name.

Account Deletion

If you wish to delete your account, go to Dashboard → Profile → Delete Account on the web, or More → Profile → Security → Delete Account in the mobile app.

Note: We first check for any blockers (an outstanding balance, a pending payout, an active or pending equipment rental, a published equipment listing, a venue you own that's still available for booking, or an event that isn't completed or cancelled yet). You cannot delete your account until all obligations are resolved.

Archived instead of deleted: if your account has sales/booking history (as a buyer or an earner) or has ever had a business profile attached (artist, vendor, provider, fleet provider, or an owned/added venue), we archive it rather than fully deleting it, so those records stay available for accounting and legal audits. Your login is disabled either way, and your account email is freed up so you're welcome to sign up again with the same one. The page tells you upfront which outcome to expect before you confirm.

Otherwise, deletion is permanent and will remove your user account, person record, and associated data (cascading as defined by the service).

Request Data Deletion (reviewed by our team)

Prefer not to delete your account yourself right away? From Dashboard → Profile → Danger Zone → Request Data Deletion, submit a request with an optional reason instead. Your account stays active while it's pending — our team reviews it (checking the same requirements listed above) and either confirms the deletion or lets you know what needs resolving first. You can withdraw a pending request at any time from the same page.

Can't sign in? Use the public Delete My Data page (linked in the site footer, or go directly to /data-deletion-request) — enter your account's email address and we'll send a confirmation link to it. Clicking the link lets you add an optional reason and submit the exact same request, reviewed the same way.

Privacy & Data

We take your data seriously. Please refer to our Privacy Policy and Terms of Service (available via the legal routes) for detailed information on how we handle your personal information.