Privacy Policy

1. Data we collect

• Account: name, email, password hash (bcrypt), roles.
• Orders: buyer and ticket-holder name and email.
• Payments: provider references only - no card numbers or CVV are stored.
• Security: refresh-token hashes, IP, and user-agent; an immutable audit log.
• Notifications: recipient email, phone, or push tokens.
• Location: the city we estimate from your network address, to show what is on near you. We do not use GPS or your device's precise location.

2. How we use data

To provide the service (accounts, ticketing, payments, entry), for security and fraud prevention, support, legal compliance, and - where permitted - service communications.

3. Sharing

Organizers receive attendee data needed to run their events; payment providers process payments; sub-processors (email/SMS/push, hosting, monitoring) operate under contract. We disclose data where legally required.

4. Retention

We keep personal data for as long as we need it to provide the service and to meet our legal, tax and accounting obligations, and then delete or anonymise it. To ask for a copy of your data, write to us through the contact page.

You can delete your account yourself at any time: in the ETicketsGo app under Account, then Delete account. Without the app, follow the steps on Delete your account. Deleting your account signs you out everywhere and removes your name, email address, phone number and preferences. Tickets you already bought stay valid. The record of each purchase is kept for tax and dispute purposes, with your name and email address removed.

5. Your rights

Access, rectification, erasure, portability, and objection - scoped by your jurisdiction. Requests via the contact page.

6. Security

Encryption in transit (TLS), hashed passwords, least-privilege authorization, audit logging, secret management, and fail-closed production configuration.

7. Mobile numbers and text messages

If you give us your mobile number, we use it to send you messages about your account and your tickets, and - only if you have separately agreed - messages about other events. You can withdraw agreement at any time by replying STOP to a message or from your notification settings. See the text message programme.

We do not sell your mobile number, and we do not share it with third parties or affiliates for their own marketing. It is shared only with the messaging providers that deliver messages for us, who may use it only for that purpose and under contract, and where the law requires disclosure. Agreeing to text messages is never a condition of buying a ticket.

8. Your country

Data may be processed in a country other than your own, including the United States and India, by us and by the service providers named above.

9. The ETicketsGo app

The Android app uses the same account, booking and payment details as the website, and the city estimate described in section 1. It does not use GPS, your contacts, your photos or your files.

Payments in the app are made on the payment provider's own screens: Razorpay for bookings in India and, where we take payment in other countries, Stripe. The provider collects your payment details, and some information about your device to prevent fraud and to find payment apps installed on your phone, under its own privacy policy. We never receive your card number or CVV.

Three features are built into the app but are not switched on at the date of this policy. If we switch one on, the app's data safety information on Google Play will say so first:

• Notifications. If you allow notifications, we store a push token for your device so we can tell you about your bookings, for example a changed or cancelled show. Signing out or deleting your account removes it.
• Crash reports. If the app crashes, a report goes to our error monitoring provider. It identifies your account by its number only: never your name, email address, phone number or payment details.
• Abuse protection. To protect sign-in, sign-up and sign-in codes from automated abuse, the app may ask Google Play to confirm that it is the genuine ETicketsGo app on a genuine device. Google Play handles that check under its own terms; we receive only the result, and we do not keep it.

10. Children

The service is not directed to children; we do not knowingly collect their data.

11. Changes & contact

We may update this policy; material changes will be communicated. Reach us through the contact page.