Privacy Policy

1. Information we collect

We collect the minimum we need to run a ticket marketplace:

• Order and contact details — your name, email address, and phone number when you place an order.
• Payment information — handled directly by our payment processor, Stripe. Your card number never touches our servers; we receive only a payment reference, the card brand, and the last four digits.
• Ticket delivery information — the delivery status of your tickets and, where sellers use transfer links or mobile ticketing, the details needed to route those to you.
• Usage and advertising-attribution information — pages and URLs viewed, searches and interactions, approximate location derived from your IP address, device and browser type, language preference, and feature-flag or experiment assignment. We also receive advertising values included in landing-page URLs, such as Google click IDs (including gclid), UTM campaign parameters (including utm_term, which may contain the matched keyword), and src=gads. We may record sessions and create heatmaps from page interactions.
• Communications — messages you send to our support team, and delivery/open records for transactional emails we send you.

We do not ask for, and you should not send us, sensitive personal information such as government ID numbers or health data.

2. How we use your information

We use personal information to:

• process your orders: hold tickets, authorize and capture payment, and confirm your purchase;
• deliver your tickets and send transactional emails — order confirmations and tickets-ready notifications — in your chosen language;
• provide customer support and honor our buyer guarantee;
• detect and prevent fraud, abuse, and security incidents;
• operate the Services, analyze site performance, understand how people use our pages, improve the product, and test feature variants;
• measure our paid-search advertising and attribute checkout and completed-purchase conversions, including through Google Ads;
• comply with legal obligations, such as tax and accounting requirements.

We do not sell your personal information or use it to serve third-party ads on the Services. We do use advertising technology to measure our own campaigns and conversions.

3. Legal bases

Where laws such as the GDPR apply, we process your information: to perform our contract with you (processing orders, delivering tickets); for our legitimate interests (securing and improving the Services, preventing fraud); to comply with legal obligations; and, where required, with your consent — which you can withdraw at any time.

4. How we share information

We share personal information only with parties who need it to fulfill your order or run the Services:

• Ticket sellers and suppliers — the details needed to secure and deliver the specific tickets you ordered (for example, the name and email the tickets should be issued or transferred to).
• Payment processing — Stripe processes payments and screens for fraud under its own privacy policy.
• Product analytics and experiments — our product analytics providers receive usage events, page URLs, device and browser information, and feature-flag assignments so we can understand site performance and improve the product.
• Site analytics and advertising measurement — Google Analytics 4 receives site-usage information. Google Ads receives advertising-attribution values and checkout and completed-purchase events for paid-search and conversion measurement. For completed orders, Google also receives a one-way SHA-256 hash of the normalized email address entered at checkout for conversion matching.
• Session analytics — our session analytics providers receive page and interaction information to provide session recordings and heatmaps that help us understand how the site is used.
• Other service providers — email delivery, cloud hosting, and infrastructure providers that process data on our behalf under contractual confidentiality and data-protection obligations.
• Legal and safety — authorities or other parties where required by law, or where necessary to protect our rights, prevent fraud, or ensure the safety of users.
• Business transfers — if we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy.

5. Cookies

We use cookies, pixels, scripts, and similar technologies to operate the Services, analyze site performance, improve the product, and measure advertising and conversions. We do not use them to sell your information:

• Essential cookies — required for checkout and site security to work; they cannot be switched off.
• Preference cookies — for example, a cookie that remembers the language you chose (English or Spanish) so we don't redirect you to the wrong one.
• Payment cookies — set by Stripe to process payments securely and prevent fraud.
• Product analytics and experimentation — our product analytics tools assign an anonymous identifier and receive usage events, URLs, device information, and feature-flag assignments so we can understand page usage, measure checkout starts, and consistently show a feature-test variant. We do not link this analytics identifier to your TicketFanatico account or payment details.
• Site analytics and advertising measurement — Google Analytics 4 and Google Ads may use cookies, pixels, and similar technologies to measure visits, paid-search performance, checkout activity, and completed-purchase conversions. They may receive Google click IDs such as gclid and campaign parameters such as UTM values (including utm_term) and src=gads from the page URL.
• Session analytics — our session analytics tools use cookies and similar technologies to provide session recordings and heatmaps based on how visitors interact with pages.

Our product analytics and session-recording providers, and Google, may receive this information and process it under their own privacy policies.

You can block or delete cookies in your browser settings; if you block essential cookies, parts of the Services (such as checkout) may stop working.

6. Data retention

We keep order records for as long as needed to provide the Services and to meet legal obligations — typically for the period required by tax and accounting law. Ticket files themselves are not stored on our servers: when your tickets are ready, we pass them through to you from the seller's delivery system. Usage logs are kept for shorter periods appropriate to security and diagnostics. When information is no longer needed, we delete or anonymize it.

7. Your rights

Depending on where you live, you may have the right to:

• access a copy of the personal information we hold about you;
• correct inaccurate information;
• delete your information, subject to records we must keep by law;
• object to or restrict certain processing, and receive your data in a portable format;
• complain to your local data-protection authority.

To exercise any of these rights, email us at [email protected]. We will verify your request and respond within the time required by applicable law.

8. Security

We protect your information with encryption in transit, access controls, and least-privilege practices, and we rely on PCI-DSS-compliant payment processing so that card details never reach our systems. No online service can guarantee absolute security, but we design ours so that a problem in one place exposes as little as possible.

9. International transfers

We serve fans in multiple countries, and the providers we rely on may process data in countries other than yours, including the United States. Where required, we use recognized safeguards — such as standard contractual clauses — for those transfers.

10. Children

The Services are not directed to children, and you must be at least 18 to purchase tickets. We do not knowingly collect personal information from children under 16; if you believe a child has provided us information, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date at the top shows when the current version took effect, and material changes will be highlighted on the Services or communicated by email where appropriate.

12. Contact us

For any privacy question or request, contact us at [email protected].