Draft. This document is not final and is not yet in effect.
Privacy Policy
Effective date: [EFFECTIVE DATE]
This policy explains what information Cutthroat Tickets, Inc. (“cutthroat”, “we”, “us”) handles when you buy or hold a ticket sold through cutthroat, visit cutthroat.tickets or an organiser’s ticket site that runs on it, join a mailing list, or use cutthroat as an organiser.
The short version:
- We collect what is needed to sell you a ticket and get you through the door: your name, your email address, and a phone number only if you give one.
- We never see or store your full card number.
- We do not sell your personal information, and we do not use it to advertise to you on other sites.
- The organiser of the event you bought a ticket for receives your order details, because they are the seller.
- You can ask for a copy of your information or ask us to delete it. See section 9.
1. Who is responsible for your information
There are two situations.
When you buy or hold a ticket, the organiser of that event is the seller and decides how your information is used. We handle it for the organiser as its service provider, under a contract that limits what we may do with it. The organiser may have its own privacy notice; ask them if you want to see it.
When you deal with cutthroat directly, we are responsible. That covers: visiting cutthroat.tickets; joining one of cutthroat’s own mailing lists (for example a city’s events list); asking us for support; and having an organiser or team account.
Either way, this policy describes what actually happens to your information on the platform, and you can use section 9 to make a request.
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Contact details | First and last name, email address, phone number (optional), ZIP or postal code and country where the payment method supplies them | You, at checkout or on a sign-up form |
| Order and ticket records | What you bought, when, the price, fees, discounts or codes used, refunds, transfers, the ticket holder’s name, answers to any questions the organiser asks at checkout | You, and the order itself |
| Payment details | The card brand and last four digits, the payment processor’s reference for the payment. Never the full card number, expiry date or security code: you type those into the payment processor’s own fields and they go straight to the processor | The payment processor |
| Entry records | Which ticket was scanned, when, at which door and by which device | The door app |
| Message records | Which emails were sent to you, when, and whether sending failed | Our email system |
| Marketing choices | Whether you agreed to marketing email, the exact words you agreed to, when, on which form, the internet address (IP) the choice came from, and when you unsubscribed | You |
| Unfinished checkout | The email address you typed and the tickets you had chosen, if you start an order and do not finish it | You |
| How you arrived | The link or campaign that brought you to an event page (for example a promoter’s link), and when | A first-party cookie |
| Technical data | IP address, browser type, pages requested, and security signals used to stop bots and fraud | Your browser and device |
| Waiting list and guest list | Your email address or name, if you join a waiting list or are put on a guest list | You, or the organiser |
| Organiser accounts | For organisers and their teams: name, email address, phone number if used to sign in, role, sign-in sessions, and a log of actions taken in the dashboard | The organiser and its team |
We do not ask for your date of birth, government ID numbers or precise location. If an event has an age limit, ID is checked at the door by the organiser’s staff, not by us.
3. What we use it for
- To sell and deliver tickets: take your order, send your confirmation and tickets, show your order page, and let you send a ticket to someone else.
- To admit you: let door staff scan your ticket and look up your order.
- To handle refunds, payment disputes and changes to an event.
- To send messages about your order. These are part of the service.
- To send marketing email, only if you agreed to it.
- To send one reminder about an unfinished order, where the organiser uses that feature. If you have not agreed to marketing email, the reminder is a single plain notice and nothing more.
- To give organisers their sales reports, including which link or promoter a sale came from.
- To keep the platform secure and fair: stop bots, enforce purchase limits, prevent fraud, and investigate abuse.
- To fix problems and give support.
- To meet legal duties, such as tax and accounting records.
4. Sensitive information
We do not ask for sensitive personal information such as health data, government ID numbers or precise location.
Some events are aimed at particular communities, so the fact that you bought a ticket could suggest something about you. We treat order records with that in mind: we use them only to provide the service described here, we do not use them to infer anything about you, and we do not use or disclose them for advertising.
5. Who sees your information
The organiser. The organiser of an event you buy a ticket for receives your order: your name, contact details, what you bought and whether you agreed to their marketing. If someone sends you a ticket, the organiser sees your name and email address as the new holder. Each organiser sees only its own orders. An organiser can export its order and contact records and can connect its own systems to them (for example its accounting, mailing or guest-list tools). What the organiser then does with them is the organiser’s responsibility.
The payment processor. Your payment is taken by the organiser’s payment processor (Square or Stripe). The processor receives your card details directly from you and handles them under its own privacy policy.
Companies that help us run the service. They are listed in section 7. They may use your information only to do their job for us.
The person you send a ticket to, or who sent one to you. They see your name and that the ticket was sent or accepted.
The authorities, or others, where the law requires it, or where it is needed to protect someone’s safety, to investigate fraud or abuse of ticket sales, or to defend legal claims.
A buyer of our business. If cutthroat is merged or sold, your information may pass to the new owner under this policy.
6. Selling, sharing and advertising
We do not sell your personal information. We do not share it for cross-context behavioural advertising. We have not done so in the past 12 months. We do not run advertising trackers of our own on cutthroat.tickets.
Organisers’ own tools. An organiser can choose to add its own Google Analytics tag or Meta Pixel to its event and checkout pages, to measure its advertising. These are off unless the organiser turns them on. When they are on:
- the tag loads in your browser only after you first interact with the page, and it can set its own cookies and tell Google or Meta that you viewed the page or completed a purchase; and
- the organiser can also have a record of your purchase sent from our servers to Google or Meta. For Meta this includes your email address, phone number, name and ZIP code in hashed (scrambled) form, along with the order value.
California law may treat an organiser’s use of these tools as “sharing” your information for advertising. You can opt out:
- Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as an opt-out: we do not load organisers’ advertising or analytics tags in your browser and we do not send your purchase to those companies. You do not need to do anything else.
- By asking. Tell the organiser, or write to legal@cutthroat.tickets naming the organiser, and we will pass your opt-out to them.
We do not knowingly sell or share the personal information of anyone under 16.
7. Companies that help us run the service
| Company | What it does for us |
|---|---|
| Square | Payment processing on the organiser’s account |
| Stripe | Payment processing on the organiser’s account, where the organiser uses Stripe |
| Postmark (ActiveCampaign) | Sending email |
| Cloudflare | Network delivery and security, bot protection (Turnstile), and storage of images and files |
| Fly.io | Hosting the application |
| Neon | Hosting the database |
| Sentry | Error reports, with email addresses and phone numbers removed |
| Apple and Google | Wallet passes, if you add a ticket to Apple Wallet or Google Wallet |
If we start sending text messages, we will add the messaging provider (Twilio) to this list before we do.
8. How long we keep it
| Information | How long |
|---|---|
| Orders, payments, refunds and the related money records | At least 7 years, as tax and accounting rules require. The money records themselves are not deleted. |
| Your name and contact details on an order | Until the organiser’s chosen retention period ends, which cannot be shorter than 3 years after the event. They are then replaced with a placeholder. If the organiser has not chosen a period, they are kept while the organiser’s account is open. You can ask for deletion sooner (section 9). |
| Marketing contact records and consent history | Until you ask for deletion, or the organiser removes them. A record that you unsubscribed is kept so we do not email you again. |
| Tickets held at checkout and never paid for | Deleted 30 days after the hold ran out |
| One-time sign-in codes and links | Deleted 1 day after they expire |
| The content of emails we sent you | Removed after 1 year. The fact that a message was sent is kept. |
| Door scan logs | Deleted after 2 years. The record that a ticket was used is kept with the order. |
| The link or campaign that brought you (cookie) | 30 days |
| Organiser dashboard audit logs | 7 years |
| Privacy requests | The request and what was done are kept as a record. For a deletion request, we keep only a scrambled fingerprint of the email address, not the address itself. A data export file is deleted when its download link expires. |
9. Your choices and rights
California residents have the rights below under the California Consumer Privacy Act. We extend them to everyone.
A copy of your information. You can ask for a copy of what is held about you. You get a file listing your orders, tickets, marketing contact records and consent history across every organiser on the platform. Other people’s details are left out.
Deletion. You can ask us to delete your information. When we do, your name, email address and phone number are removed from contact lists, waiting lists, guest lists, ticket holder fields and message records across the platform, and you are unsubscribed everywhere. Two limits apply:
- Upcoming events. We cannot delete your information while you hold a valid ticket to an event that has not finished, because the ticket still has to work at the door. Ask again after the event, or once the ticket has been refunded.
- Recent purchase records. Orders from the last 7 years keep the buyer’s name and contact details, because they are the tax and payment-dispute record. They are stripped of your identity automatically once they are 7 years old.
Correction. If your details are wrong, ask the organiser or write to us.
Knowing what is collected and disclosed. That is what this policy is for. Ask us if anything is unclear.
Opting out of selling and sharing. See section 6.
Limiting the use of sensitive information. We do not use sensitive information for anything beyond providing the service, so there is nothing further to limit.
No retaliation. You will not be treated differently for using these rights.
How to make a request. Email legal@cutthroat.tickets from the address your tickets were sent to, and say whether you want a copy or deletion. We will send a confirmation link to that address. This is how we check the request is really from you: open the link within 72 hours to confirm. We then carry out the request and email you the result. For a copy, the download link works for 72 hours. We answer within 45 days. We never tell anyone whether a particular email address is known to us.
Someone acting for you. An authorised agent can make a request for you. We will still confirm it with you at your own email address.
Marketing email. Use the unsubscribe link in any marketing email, at any time. Unsubscribing does not stop emails about tickets you have bought.
10. Cookies and similar technology
We keep these to a minimum. We do not show a cookie banner because we set no advertising cookies of our own.
| Name | What it is for | How long |
|---|---|---|
ct_attr | Remembers which link or campaign brought you to an event page, so the organiser can see where a sale came from | 30 days |
ct_buyer | Keeps you signed in after you use an emailed sign-in link to see your orders | Until it expires or you sign out |
| Promoter sign-in cookie | Keeps a promoter signed in to their portal | Until it expires or they sign out |
| Theme setting (browser storage) | Remembers light or dark mode | Until you clear it |
| Checkout cart (browser storage) | Keeps your place in checkout | Until you close the tab |
| Cloudflare Turnstile | Checks that checkout is being used by a person, not a bot | Set by Cloudflare for the check |
| Payment processor fields | The card fields are run by the payment processor, which may set its own cookies to prevent fraud | Set by the processor |
| Organiser’s Google Analytics or Meta Pixel | Only if the organiser has turned them on, only after you interact with the page, and not if your browser sends a Global Privacy Control signal (section 6) | Set by Google or Meta |
We do not use session-replay tools.
11. Security
We protect your information with measures that include: encryption in transit; encrypted storage of payment-account credentials and ticket secrets; access limited to people who need it; separation of each organiser’s data; removal of personal details from application logs and error reports; and encrypted backups.
No system is perfectly secure. If a security incident affects your information, we will notify you and the relevant organiser as California law requires.
12. Children
The service is not directed to children under 13 and we do not knowingly collect their information. Many events on cutthroat are for adults only. If you believe a child has given us information, write to us and we will delete it.
13. Where your information is processed
We and the companies in section 7 process information in the United States. If you use the service from elsewhere, your information is transferred to the United States.
14. Changes to this policy
We may update this policy. The date at the top shows when it last changed. If a change is significant, we will say so on this page before it takes effect.
15. Contact
- Privacy questions and requests: legal@cutthroat.tickets
- General help: support@cutthroat.tickets
- Post: Cutthroat Tickets, Inc., [MAILING ADDRESS]