1. Payment responsibilities

Ticket sales and host software billing are intentionally separate.

• Hosts are the merchant of record for guest ticket purchases. Stripe processes those payments on the host’s connected Stripe account (Stripe Connect).
• Mythic Innovations LLC bills hosts for Mythic Experiences software subscriptions on Mythic Innovations LLC’s own Stripe platform account—separate from guest ticket revenue.
• Guests enter card details in Stripe’s payment fields. Mythic Experiences is designed so full card numbers are not visible in the Mythic Experiences application; we receive confirmation status and amount metadata (including disclosed fees and host-configured tax when present), not full card numbers.
• Stripe’s security programs and certifications apply to Stripe as the payment processor. They are not Mythic Innovations LLC certifications. Using Stripe’s payment fields does not by itself mean Mythic Innovations LLC is outside all payment-related obligations.

Details on SaaS renewals, ticket fees, and refunds live in the Terms of Service.

2. Accounts and access

Access controls focus on signed-in identity and organization membership—only where the product already enforces them.

• People sign in with authenticated accounts (including password reset when configured). Host dashboard features require a signed-in session.
• Host data is organized by organization. Staff access depends on membership in that organization—not a shared venue password.
• Built-in staff roles (and custom roles on Mythic Operations) map to capabilities such as inventory, door check-in, refunds, or settings. Teammates only receive the capabilities their role allows.
• We design host tools around least privilege: door staff should not need owner-level billing or settings access to check guests in.

3. Data handling

• Public surfaces (discovery, location pages, booking embeds) are meant to show what guests need to browse and book. Private operational details stay in the host dashboard.
• Application and database services run with encryption and access controls provided by our infrastructure providers (including transport security on the public site and provider-managed encrypted backups described in our Privacy Policy).
• Retention, deletion, account deletion requests, and what remains after deletion (including backups and Stripe’s independent records) are described in the Privacy Policy.

We do not sell personal information to data brokers. For the full picture—categories, processors, cookies, and deletion—see the Privacy Policy.

4. Public booking and widgets

Public booking pages and website widgets are built to share schedule and purchase flows with guests while keeping host-only operational data off those surfaces.

• Embeds and checkout handoffs include checks intended to reduce misuse of public booking entry points.
• Automated abuse of checkout is limited with protective controls on the server side.
• We do not publish detailed defensive configurations, thresholds, headers, schemas, or attack guidance on this page.

5. Availability and continuity

Mythic Experiences relies on infrastructure providers for hosting and database services. We maintain provider database backups and documented recovery procedures for platform operators.

• This page does not promise guaranteed uptime, zero downtime, or a specific recovery time.
• Backups are not instant physical deletion when someone requests account removal; backup copies expire on the provider’s schedule, and restored databases re-apply recorded deletions as described in the Privacy Policy.
• Hosts remain responsible for on-site continuity (for example paper guest lists) if the internet or door tools are unavailable.

6. Responsible disclosure

If you believe you have found a security issue in Mythic Experiences, email support@mythicexperiences.com. Please include enough detail for us to reproduce the issue, and do not access data that is not yours or disrupt service for others.

This is the same monitored support address used for privacy and account requests. We do not currently publish a separate security@ mailbox on this site.

7. Compliance status

Our current controls are designed to protect Mythic Experiences, but this page is not a claim that Mythic Innovations LLC has completed a penetration test or holds SOC 2, ISO 27001, PCI DSS, or another independent certification unless explicitly stated.

Vendor certifications (for example programs published by Stripe, Supabase, or our hosting provider) belong to those vendors. Mythic Innovations LLC does not inherit them as its own certifications.