1. Data we collect

• Account data: name, email, phone number, city preference, and authentication credentials (passwords are hashed; we never store them in plain text).
• Order and ticket data: events purchased, tiers, quantities, fees, payment status, and QR ticket identifiers.
• Organiser data: business or trading name, payout bank details, and identity-verification (KYC) documents when you sell tickets.
• Support data: messages you send through Support, email, or WhatsApp.
• Device and diagnostics data: app or browser version, push notification tokens, crash and error diagnostics via Sentry, and bot-protection signals via Cloudflare Turnstile on sign-in and signup.

2. Why we process it

• To create and secure your account, and to let you browse, buy, transfer, or sell tickets.
• To issue QR tickets and verify them at the event gate.
• To process payments, refunds, and organiser payouts through Paystack.
• To verify organiser identity before paid events can be published (fraud and AML risk reduction).
• To send transactional notices (order confirmations, refund updates, event reminders) and — only if you opt in — marketing updates.
• To protect the Service against abuse, investigate disputes, and meet applicable Nigerian legal obligations.

3. Payment processing

For the Nigeria investor beta, payments run through Paystack in TEST mode on staging. SuperTickets never stores your full card number, CVV, or bank PIN — that data goes directly to Paystack over an encrypted connection. We store the transaction reference and outcome (paid, failed, refunded) needed to issue tickets and handle disputes. The Paystack webhook (server-verified) is the source of truth for payment success.

4. Processors and sharing

• Paystack — payment initiation, verification, refunds, and organiser payouts.
• Supabase — authentication, database, private KYC document storage, and edge functions acting on our instructions.
• Cloudinary — event and profile image hosting.
• Sentry — application error and crash diagnostics.
• Cloudflare (including Turnstile) — hosting/delivery of the web app and bot protection on sensitive auth forms.
• Event organisers — your name and ticket tier for gate check-in. We do not share your email or phone with organisers unless you contact them directly or a refund/dispute requires it.

We do not sell your personal data to advertisers or unrelated third parties.

5. KYC documents (organisers)

If you register as an organiser, we may ask for a government-issued ID and proof of business address before you can publish paid events. These documents are stored in a private Supabase Storage bucket accessible only to you and SuperTickets verification staff. We keep them while your organiser account is active and for as long afterwards as Nigerian AML, tax, or dispute obligations reasonably require — then delete or irreversibly anonymise them.

6. International transfers

Some processors (for example Supabase, Cloudinary, Sentry, or Cloudflare) may process data outside Nigeria. Where that happens, we rely on contractual processor terms and appropriate safeguards consistent with the NDPA, and we only transfer what is needed for the purposes above.

7. Your rights

Under the NDPA, you can ask us to:

• Provide a copy of the personal data we hold about you.
• Correct inaccurate data (via Edit profile in the app or website).
• Delete your account — Account settings include a deletion flow that anonymises your profile while preserving order and ticket records required for financial audit.
• Withdraw marketing consent at any time (Notification settings).
• Lodge a complaint with the Nigeria Data Protection Commission if you believe your rights have been infringed.

8. Retention and account deletion

We keep personal data only as long as needed for the purposes in this policy, including financial audit, dispute resolution, and applicable Nigerian legal obligations. When you delete your account, profile identifiers are removed or anonymised promptly; remaining order, ticket, and payment records stay in anonymised form so they can no longer be linked back to you except as required for that audit trail.

9. Policy updates

We may update this policy as the Service evolves. Material changes for the beta will be reflected on this page with a new "Last updated" date. Continued use after an update means you acknowledge the revised policy.

10. Contact

Privacy questions or NDPA requests can be sent through Support or the support email listed there.