Privacy
Privacy Policy
A plain-English starter policy for early TicketSquad users: what we collect, why we collect it, who can see it, and how to ask for help.
Who we are
TicketSquad is an early access event coordination product for groups trying to prepare for high-demand ticket sales.
TicketSquad is owned and operated by PaaS Technology Services Ltd, a company registered in England and Wales under company number 17126836, with its registered office at 167-169 Great Portland Street, London, W1W 5PF, United Kingdom. PaaS Technology Services Ltd is the data controller for the personal data processed through TicketSquad. The data controller contact is reachable at team@ticket-squad.io - see "How to contact us" below.
What information we collect
We collect the account and event details needed to coordinate a buying group. That can include your name, email address, profile details, event membership, group assignment, ticket outcome, and any event-specific fields the coordinator asks for.
Event-specific fields may include registration numbers, postcodes, preferences, access needs, ticket-type choices, notes, uploaded event images, or other details that help the group prepare for a sale.
Why we use it
We use this information to let coordinators set up events, invite members, check readiness, form buying groups, prepare sale-day views, export buyer-ready details, send relevant reminders, and track outcomes after the sale.
We also use limited technical and usage information to keep TicketSquad reliable, understand which public pages help people, diagnose errors, and protect the service from misuse.
Lawful basis
Most coordination data is processed because it is needed to provide the TicketSquad service you asked to use. Some reminders, operational messages, reliability logs, and privacy-friendly analytics rely on legitimate interests in running, improving, and securing the service.
Where a coordinator asks for optional details, you can decide what to provide.
Access needs are different. An answer about access facilities, a PA or companion ticket, or medical needs can reveal a disability or a health condition, which the law treats as special category data. We only store an access-needs answer with your explicit consent (Article 9(2)(a) of the UK and EU GDPR), which you give by ticking the box on that question (a switch in the iPhone app). You can withdraw it at any time: turn it off and save while the event is still open for changes, which deletes your answer, or email team@ticket-squad.io and we will delete it for you.
Who can see event details
Event coordinators can manage readiness, member data, groups, and sale-day preparation for their event. Events can be Open, where everyone in the event can see everyone's event details, or Closed, where personal details stay inside the buying group you are actually in. Assigned buyers can see the details they need for their buying group, so they can help the squad attempt the purchase.
TicketSquad does not sell personal data. We do not make submitted event details public, and we do not use them for unrelated marketing profiles.
Who we share data with
TicketSquad uses infrastructure and product services for hosting, database and sign-in, email delivery, error monitoring, payments, and privacy-friendly analytics. They process data only so TicketSquad can operate the service, under contracts that limit what they may do with it. Each one is listed, with where it processes data, under "Where your data goes" below.
We may share information if required by law, to protect the service, or to respond to a valid rights request. We do not sell personal data to advertisers or ticketing platforms.
Where your data goes
These are the services that receive personal data from TicketSquad, what each one gets, where it handles it, and how your data is protected when it leaves the UK and the EEA. Except where we say a service acts as its own controller, each one works for us under a data processing agreement.
Vercel
Hosts the TicketSquad website and app API, so every request passes through it: your IP address, browser details and whatever you send us.
Where: Our server code runs in Dublin, Ireland. Vercel Inc. is a US company, and its logs and support can be handled in the United States.
Safeguard: The EU-US Data Privacy Framework and its UK Extension, with the EU Standard Contractual Clauses and the UK Addendum to them as well.
Vercel Web Analytics
Counts visits to our pages: the page, the referring site, rough location, and device and browser type. It sets no cookies, and the hash that recognises a visit is discarded after 24 hours.
Where: Vercel, as above. Vercel does not say where this data is stored, so we treat it as the United States.
Safeguard: The EU-US Data Privacy Framework and its UK Extension, with the EU Standard Contractual Clauses and the UK Addendum to them as well.
Supabase
Our database, sign-in and file storage: your account, your events and squads, everything you enter for an event, and photos you upload.
Where: Stored in Ireland (AWS eu-west-1). Supabase is based in Singapore, and its support staff and some of its subprocessors can reach the data from outside the UK and EEA.
Safeguard: The EU Standard Contractual Clauses and the UK Addendum to them.
Resend
Sends our emails: your email address, your name where an email uses it, and the content of the email.
Where: Our emails are sent from Ireland. Resend is a US company and keeps account data, email logs and delivery records in the United States.
Safeguard: The EU-US Data Privacy Framework and its UK Extension, with the EU Standard Contractual Clauses and the UK Addendum to them as well.
Sentry
Error monitoring. An error report can carry your TicketSquad user ID, but we strip your name, email address, IP address and anything you typed before it is sent.
Where: Error data is stored in the EU, in Frankfurt, Germany. Sentry is a US company and keeps its own account settings in the United States.
Safeguard: The EU-US Data Privacy Framework and its UK Extension, with the EU Standard Contractual Clauses and the UK Addendum to them as well.
Stripe
Takes payment if you upgrade to Squad Crew: your email address, billing address and card details. You enter your card on Stripe’s own page, so we never see it.
Where: Stripe Payments Europe in Ireland, with processing by Stripe in the United States. Stripe is also a controller for its own legal duties as a payment provider, under its own privacy policy.
Safeguard: The EU-US Data Privacy Framework and its UK Extension, with the EU Standard Contractual Clauses and the UK Addendum to them as well.
Plausible
Counts visits to our pages without cookies. Your IP address is turned into a hash that changes every day and is never stored.
Where: The EU (Germany). Plausible is an Estonian company.
Safeguard: None needed: the data stays in the EU, which UK law recognises as adequate.
Google Ads
Only if you accept advertising cookies. Google’s tag in your browser sees your IP address and browser details, sets its own cookies, and tells Google when one of our ads led to a signup or a new event. Google acts as its own controller for this.
Where: Google Ireland for EU visitors and Google LLC in the United States for UK visitors, on Google’s servers worldwide.
Safeguard: The EU-US Data Privacy Framework and its UK Extension, with the EU Standard Contractual Clauses as a fallback.
Meta
Only if you accept advertising cookies. The Meta Pixel in your browser sees your IP address and browser details, sets its own cookies, and tells Meta which pages you view and when one of our ads led to a signup.
Where: Meta Platforms Ireland for EU visitors, and Meta Platforms, Inc. in the United States for UK visitors.
Safeguard: For UK visitors, the UK Addendum to the EU Standard Contractual Clauses. Meta moves EU data to the United States under its own safeguards.
Google sign-in
Only if you choose to sign in with Google. Google confirms who you are and shares your name, email address and profile photo with us.
Where: Google, under its own privacy policy, on its servers worldwide.
Safeguard: The EU-US Data Privacy Framework and its UK Extension.
Apple
Sign in with Apple, if you choose it (Apple may give us a private relay email address instead of yours), and notifications to the TicketSquad iPhone app, where Apple delivers the alert text to your device.
Where: Apple Distribution International in Ireland controls Apple’s handling of UK and EU data, with processing by Apple Inc. in the United States.
Safeguard: The EU Standard Contractual Clauses, under Apple’s privacy policy.
Browser push services
Only if you turn on browser notifications. Your browser’s push service delivers each notification to your device: it sees your device’s push address and when a notification is sent, but the message is encrypted so it cannot read it.
Where: The service belongs to whoever makes your browser (Apple, Google, Microsoft or Mozilla) and runs under their own privacy terms, which can include the United States.
Safeguard: The notification is encrypted end to end before it leaves us, so only your device can read it.
YouTube
Event pages can show YouTube video thumbnails, which your browser loads from Google, so Google sees your IP address and browser details. The video itself only loads, from youtube-nocookie.com, when you press play.
Where: Google, under its own privacy policy, on its servers worldwide.
Safeguard: The EU-US Data Privacy Framework and its UK Extension.
Backups
Once a day an automated job copies our database and the photos people upload, so we can recover from a failure. The database copy is encrypted before it is stored.
Where: The job runs on GitHub’s servers in the United States, and the copy is stored with Amazon Web Services in London.
Safeguard: The EU-US Data Privacy Framework and its UK Extension, with the EU Standard Contractual Clauses and the UK Addendum to them as well. The stored copy stays in the UK.
We use AI to research public event information, and it never receives your personal data.
How long we keep data
We keep event coordination data while the event is active and for a reasonable period afterwards so coordinators and members can review outcomes, resolve questions, and reuse useful setup context.
You can permanently delete your account and all the personal data you have shared with TicketSquad yourself, at any time, from your account settings. Automated time-based retention is still being refined; contact us for correction requests.
Cookies and analytics
TicketSquad uses essential cookies or similar storage for sign-in, session security, and core app behaviour. That includes remembering, on your device only, which sign-in method you used last (Apple, Google or email, never your email address), so the sign-in screen can mark it for you. We also use Plausible and Vercel Web Analytics to count visits to our pages. Neither sets cookies: each recognises a visit by a short-lived hash that is thrown away within a day, and we only ever see totals, never who you are.
If you opt in through our cookie banner, we additionally set advertising-measurement cookies (Google Ads and Meta) that tell us when our own ads lead to a signup or a created event. They load only after you accept, we never sell or share personal profiles through them, and you can withdraw at any time via Cookie settings in the page footer.
Security
TicketSquad is built with authenticated access, database row-level security, role-aware event views, and provider-managed infrastructure. We limit access to the people and systems that need it for the service to work.
No online service can promise absolute security, but we design the product around keeping sensitive coordination details in the right places and fixing issues quickly when they are found.
Children
TicketSquad is not intended to be used by children under 13, and our terms require you to be at least 13 to hold an account or to submit your own details to an event. We do not knowingly collect personal data directly from anyone under 13.
Families are welcome. Where a child is too young for an account of their own, we suggest a parent or guardian holds the account and manages it on the child’s behalf; they can supply the child’s details where an event needs them, and in doing so they are giving that permission for the child. Those details are handled the same way as any other member data on this page.
We do not ask for a date of birth when you sign up, and we do not use one to screen your age. Some events do ask members for a date of birth, because the event organiser sets age-based ticket rules; where an event asks, that answer is treated as sensitive and is shown only to the people who need it for the sale. A date of birth showing that a child is under 13 is expected where a parent or guardian has supplied it for a family booking, and we do not treat that as something to undo.
What we do act on is a child using TicketSquad themselves, or a child’s details reaching us without a parent or guardian having agreed. Where a child under 13 has their own account, we delete that account and the data held with it. Where a child’s details were submitted through someone else’s account without that authority, we remove those details and leave that person’s account alone. We work through those individually rather than automatically, so tell us which event the details appear in and we will confirm once they have gone. Details a parent or guardian has supplied for their own child are not affected.
If you are a parent or guardian and believe your child’s information is on TicketSquad, email team@ticket-squad.io and we will remove it - you do not need an account of your own to make that request.
Your rights
Depending on where you live, you may have rights to access, correct, delete, restrict, export, or object to some uses of your personal data. You also have the right to complain to a data protection regulator. In the UK that is the Information Commissioner’s Office (ICO), at ico.org.uk. If you live in the EU, you can complain to your local data protection authority. We would welcome the chance to put things right first, so please contact us too.
You can delete your account and personal data, manage which sign-in methods are linked to your account, and pause non-essential emails yourself from your account settings. Per-event invite opt-out is still under development - until it ships, contact us and we will help with those requests.
How to contact us
You can delete your account and personal data yourself from your account settings. For privacy questions, data corrections, or any other queries, email our team at team@ticket-squad.io.
If you arrived through a coordinator invite, you can also ask the coordinator what event-specific fields they requested and why those details are needed for the sale.