Privacy policy

1. Data we collect

• Account and authentication data: first and last name, email address, phone number, country, city, avatar, notification preferences, account status, and authentication or session records. Passwords are handled by our authentication service and are not stored by SuperTickets in readable form.
• Commerce and ticket data: events and tiers viewed or purchased, quantities, prices, discounts, service and payment fees, currency, order and payment references, payment status and channel, ticket and QR identifiers, ticket status, transfers, refunds, and reviews.
• Organiser and event data: organiser name and contact details, event listings and media, payout route details, and identity-verification (KYC) documents submitted to sell tickets.
• Support, waitlist, and communications data: support messages, waitlist contact details, notification settings, consent records, device or push tokens, and web-push subscription metadata.
• Technical and security data: app or browser version, device platform, crash and error diagnostics, bot-protection signals, and browser storage or consent choices. Optional analytics and marketing tracking remain off unless you select them.

2. Why we process it

• To create and secure accounts and provide browsing, waitlists, ticket purchases, transfers, and organiser tools.
• To issue tickets, maintain the ticket wallet, and verify tickets at event entry.
• To process, verify, and refund payments, and to route eligible organiser payouts.
• To review organiser identity before paid events can be published and reduce fraud, abuse, and payment risk.
• To send service messages such as order, payment, refund, transfer, event, and account notices. Marketing messages use the consent and preference choices available in the Service.
• To provide support, protect the Service, investigate disputes, and meet applicable legal and financial obligations.

Depending on the context, processing is based on taking steps to provide the Service or perform a contract, consent, a legal obligation, or a legitimate interest in security and service operations, subject to applicable law.

3. Payment processing

For the Nigeria launch, Paystack is the current payment provider. We use the provider shown at checkout for payment initiation, verification, refunds, and eligible organiser payout routing. SuperTickets does not store your full card number, CVV, or bank PIN. We store the payment reference, amount, currency, channel, status, and payment details needed to issue tickets, confirm payments, process refunds, prevent fraud, and handle disputes. A result shown by your browser or app alone does not confirm a payment; we confirm successful payment with the payment provider before issuing a ticket.

4. Processors and sharing

• Paystack: payment initiation, verification, refunds, and eligible organiser payout routing.
• Supabase: account sign-in, data storage, private KYC document storage, and service operations.
• Cloudinary: event media delivery and storage for uploaded event assets.
• Sentry: application error and crash diagnostics with the privacy settings configured for the Service.
• Cloudflare (including Turnstile): web hosting or delivery and bot protection on sensitive authentication forms. Automatic security checks are subject to the Cloudflare Turnstile Privacy Addendum.
• Expo and Web Push services: delivery of push notifications when you enable them and register a device or browser.
• Resend: delivery of account and service emails.
• Termii: delivery of SMS verification and service messages when SMS is enabled.
• Authorised event organisers and event-team members: attendee name, ticket tier, ticket status, check-in status, and buyer email where the event-operations tools make that information available.

We may disclose data when required by law, to protect users or the Service, or to investigate fraud, abuse, payment disputes, or security incidents. We do not sell your personal data to advertisers.

5. KYC documents (organisers)

If you register as an organiser, we may ask for a government-issued ID and proof of business address before you can publish paid events. These documents are stored in a private Supabase Storage bucket with access restricted to the organiser and authorised verification staff. We retain them only for as long as they are needed for verification, fraud prevention, dispute handling, or applicable legal obligations, then delete or irreversibly anonymise them.

6. International transfers

Some processors may process data outside Nigeria. We transfer personal data only where the NDPA and other applicable law permit it, use the safeguards required by those laws, and limit each transfer to the data needed for the purposes above.

7. Your rights

Subject to applicable law, the NDPA gives you rights to:

• Be informed about how your data is used and access a copy of it.
• Correct inaccurate or incomplete data.
• Object to or restrict processing in circumstances provided by law.
• Receive portable data where the NDPA requires it.
• Request safeguards against decisions based solely on automated processing where the NDPA provides that right.
• Withdraw consent where processing relies on consent, including optional marketing or tracking choices.
• Request erasure, subject to records that must be retained for legal, financial, security, or dispute purposes.
• Lodge a complaint with the Nigeria Data Protection Commission.

Send a privacy request through Support. We may need to verify your identity before responding.

8. Retention and account deletion

We keep each category of personal data only as long as needed for the purposes in this policy, including financial record-keeping, dispute resolution, fraud prevention, security, and applicable legal obligations. We delete or irreversibly anonymise data when those purposes and obligations no longer require it.

Account deletion removes or anonymises profile and authentication identifiers, removes device notification registrations and pending contact details, and redacts personal or card-related parts of stored payment payloads. Orders, tickets, payment references, statuses, and other records needed to confirm payments or meet legal obligations may remain in anonymised or redacted form. An organiser owner must transfer or close an organiser account before deletion can complete.

9. Cookies and optional tracking

The web Service uses essential browser storage and session technologies to operate. Optional analytics and marketing tracking are disabled unless you choose them in the consent controls. You can review or withdraw those choices from Privacy & cookies in your account.

10. Policy updates

We may update this policy as the Service evolves or legal requirements change. Changes will be reflected on this page with a new "Last updated" date. Where a change materially affects your rights or choices, we will provide any notice required by law.

11. Contact

Privacy questions or NDPA requests can be sent through Support or by email to contact@supertickets.io.