Privacy policy

1. What we collect

When you buy tickets: your name, email address, what you bought and when, and your answers to any questions the organizer asks at checkout. When you create an account: your name, email address, a securely hashed password (we can’t read it) and, if you add one, a profile photo.

When you sell tickets: your host name and profile, city and postal code, links you add, tax registration numbers you enter, and the information Stripe needs to verify you and pay you (Stripe collects that directly; we only learn whether payouts are enabled, and an anonymous fingerprint of the bank account, which we use to spot one person running several organizer accounts).

We never see or store your card number: payments are entered on Stripe’s secure page. To keep accounts safe we record the IP address and browser of each sign-in, and the IP address each order was placed from (to spot stolen cards and fake events), and count recent attempts from each address to stop password guessing and ticket-grabbing bots.

Messages you send to an organizer or to us, reports about events, the events you save and the organizers you follow are stored so the features work.

2. Why we use it

To sell you tickets and get you in the door (including the QR codes and the emails with your tickets), to process payments and refunds, to show your orders in your account, to send event reminders, to send announcements from organizers you follow only if you ticked the box asking for them (we record when), to prevent fraud and abuse, and to meet our legal and tax obligations. We don’t sell your information and we don’t show ads.

3. Who we share it with

The organizer of an event you buy tickets for gets your name, email address, the tickets you bought and your checkout answers, so they can run the event and contact you about it. They must use it only for that.

Service providers that run parts of the site for us, under contracts that limit them to that: Stripe (payments, refunds, organizer identity checks and payouts), Cloudflare (the bot check on sign-in, sign-up and checkout, which sees your IP address and browser details), our email provider (sending tickets and notices), and our hosting and database providers. Some of them store data outside Canada, including in the United States, where it may be accessible to authorities under local law.

We may also disclose information when the law requires it, or to protect people from fraud or harm.

4. Cookies and storage

We use one essential cookie to keep you signed in. Your light or dark theme choice is saved in your browser. We don’t use advertising or cross-site tracking cookies.

5. How long we keep it

Account information is kept until you delete your account. Order records (who bought what, for how much, and refunds) are kept for at least six years after the sale, because tax law requires it; when you delete your account, they’re detached from it.

When you delete your account we keep a restricted record of it until the end of that tax year plus seven years: your name and email address, when the account was opened and closed, your recent sign-ins (date, IP address and browser) and, if you sold tickets, your organizer profile and the identity details you gave to be verified. It’s stored encrypted, used only to investigate fraud and chargebacks and to answer legal, tax or law-enforcement requests, only our team can see it, every look at it is logged, and it’s deleted automatically at the end of that period. The only exception is a record under a legal hold (an open investigation, dispute or legal request), which is kept until the hold ends.

Messages you sent to organizers or to us, and reports you made, stay with the people who received them, but your name and email address are removed from them. Your waitlist places are deleted. We keep a note of your email preferences, so that unsubscribed addresses stay unsubscribed.

Deleted information leaves our database backups within days, and our server logs within a month.

6. Your choices and rights

You can see and correct your details in account settings, turn off optional emails there or from the link in any email, and delete your account from the same page. Deleting it removes your profile, photo, saved events, follows and sign-ins straight away, apart from the restricted record described above.

You can ask us for a copy of the personal information we hold about you, or ask us to correct it, by writing to hello@fesacticket.com. We answer within 30 days. If you’re not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

7. Security

The site is served only over HTTPS, passwords are hashed, ticket and order links use long random codes, and access to our admin tools is limited to our team. No system is perfectly secure; if a breach puts you at real risk, we’ll tell you and the Privacy Commissioner as the law requires.

8. Contact and changes

Our privacy contact is reachable at hello@fesacticket.com. If we change this policy in a way that matters, we’ll update the date at the top and, for big changes, email account holders.