Privacy policy

At TicketRobin, we take your privacy seriously. This policy explains how we collect, use, store, and protect your personal information.

1. Information we collect

Account information

When you create an account, we collect your name, email address, and password. If you upgrade to a plan with WhatsApp alerts, we also collect your mobile phone number.

Tracking preferences

We store the event tracking preferences you configure, including event names, dates, price ceilings, notification preferences, and filter settings.

Payment information

Payment processing is handled by our secure payment partner (Stripe). We do not store your full payment details on our servers. Stripe processes payment data on our behalf, and we retain limited billing data (such as last 4 digits, card brand, expiration date, and payment status) for account management, invoicing, and support.

Usage data

We collect information about how you use TicketRobin, including login timestamps, features accessed, alerts delivered, and interaction events on our website and product. This helps us improve our service and troubleshoot issues.

Device and browser information

We automatically collect technical information including IP address, browser type, operating system, and device identifiers for security and analytics purposes.

Advertising identifiers

If you reach us by clicking an advert, the advertising platform adds a click identifier to the link you followed. We store that identifier with your sign-up so we can later tell the platform that its advert led to an account, a checkout, or a purchase. The advertising platform does not tell us who you are, and we do not use the identifier to build a profile of you on our own site.

2. How we use your information

We use your information to:

• Provide and maintain the TicketRobin service
• Monitor ticket sites based on your preferences
• Send you alerts via email or WhatsApp when matching tickets appear
• Process payments and manage your plan or pass access
• Respond to your support requests
• Send important service updates and security notices
• Improve our service and develop new features
• Measure advertising performance and, where permitted by law, avoid showing acquisition adverts to existing customers
• Prevent fraud and abuse

3. Legal basis for processing (GDPR)

For users in the UK and EU, we process your data based on:

• Contract: Processing necessary to provide the service you've purchased or enrolled in
• Consent: Where you've explicitly opted in (e.g., marketing emails)
• Legitimate interests: For security, fraud prevention, service improvement, advertising measurement, and avoiding showing acquisition adverts to existing customers, where our interests are not overridden by your rights and choices
• Legal obligation: Where required by law (e.g., tax records)

4. Data sharing and disclosure

We do not sell your personal information. We share data only in these circumstances:

Service providers

We use trusted third-party providers to deliver our services. These providers process personal data under contractual terms and only for defined business purposes.

• Stripe: Payment processing, fraud prevention, billing, and transaction records
• Amazon Web Services (AWS): Cloud infrastructure and data storage (including service data and operational logs)
• Cloudflare: Website delivery, performance, and security services
• Google Analytics: Website analytics and performance measurement
• Cloudflare Web Analytics: Website analytics and traffic insights
• PostHog: Product and website analytics, including session replay, to help us understand usage patterns, improve journeys, and troubleshoot issues
• Reddit: Advertising measurement and conversion tracking via the Reddit Pixel and Reddit Conversions API, to measure the effectiveness of our advertising on Reddit
• Google Ads: Advertising measurement and conversion tracking via the Google tag, so we can measure the effectiveness of our advertising on Google. We do not enable personalised advertising or remarketing audiences through it
• Meta: Advertising measurement and conversion tracking via the Meta Pixel and the Meta Conversions API, and customer-list matching for advertising suppression or exclusion audiences, so we can measure the effectiveness of our advertising and avoid showing acquisition adverts to existing customers on Meta platforms such as Facebook and Instagram
• AWS SES: Transactional email delivery
• Twilio: WhatsApp alert delivery

Conversion measurement

We measure whether our advertising leads to sign-ups and purchases. Some of that measurement happens from our servers rather than from your browser, using the Meta Conversions API and the Reddit Conversions API. When you register an account, start a checkout, complete a purchase, start a subscription, or search for an event, we may send a record of that action to the relevant advertising platform.

Those records can include a securely hashed version of your email address, your first name, and your account identifier, together with your IP address, your browser user agent, and, where one is present, the click identifier from the advert you followed. Hashing helps protect identifiers in transit, but hashed identifiers remain personal data.

Because this measurement runs on our servers, it does not use cookies and is not switched off by your browser's cookie settings. If you would prefer us not to include your account in advertising conversion measurement, email [email protected] and we will exclude you.

Advertising audiences and suppression lists

Where permitted by law, we may use customer-list matching with advertising platforms to create suppression or exclusion audiences. This helps us avoid showing acquisition adverts to existing customers. For example, we may share securely hashed identifiers such as email addresses or phone numbers with Meta so it can check whether they match Facebook or Instagram users and include matched accounts in an exclusion audience.

Hashing helps protect identifiers during matching, but hashed identifiers remain personal data. We do not use these customer lists to build lookalike audiences or to target existing customers with acquisition adverts unless we update this policy and assess the lawful basis first. You can object to this use of your personal data by emailing [email protected].

Legal requirements

We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety.

Business transfers

If TicketRobin is acquired or merged with another company, your data may be transferred as part of that transaction.

5. Data retention

We retain your account data for as long as your account is active. If you cancel your account, we will delete your personal information within 30 days, except where we must retain it for legal or accounting purposes.

Alert history and usage logs are retained for 90 days for troubleshooting purposes.

Advertising click identifiers stored with your account are kept for as long as your account is active, and are removed along with the rest of your personal information when the account is deleted. Conversion records that have already been sent to an advertising platform are held by that platform under its own retention policy and cannot be recalled by us.

6. Your rights

Under GDPR and UK data protection law, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a machine-readable format
• Object: Object to processing based on legitimate interests, including advertising audience matching
• Withdraw consent: Opt out of marketing or other consent-based processing

To exercise these rights, email us at [email protected].

7. Security

We implement industry-standard security measures including encryption in transit (TLS/SSL), encrypted data at rest, secure password hashing, and regular security audits.

However, no system is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Cookies and tracking

We use essential cookies for authentication and site functionality. We also use analytics technologies, including Google Analytics, Cloudflare Web Analytics, and PostHog, to understand traffic patterns, measure usage, improve the site, and troubleshoot problems. These analytics tools may use cookies and similar identifiers to collect information such as page views, clicks, navigation patterns, browser and device information, and approximate location derived from IP address.

We also use PostHog session replay to help us understand how users navigate and interact with our website and product, for example clicks, taps, scrolling, and page navigation. Session replay is used for product improvement, debugging, and troubleshooting.

If you accept analytics cookies, we also use advertising measurement technologies to understand which adverts bring people to us: the Reddit Pixel, the Meta Pixel, and the Google tag with its Google Ads measurement destination. These may process identifiers such as cookies, a click identifier from the advert you came through, your IP address, and browser and device information, and may involve sharing that data with Reddit, Meta and Google as described in their respective privacy policies. We ask Google to measure our adverts only: we do not enable personalised advertising or remarketing audiences through the Google tag. These three technologies run in your browser and do not load until you have accepted analytics cookies, or, in regions that do not require prior consent, until the regional default applies. The Conversions API measurement described in section 4 is separate: it runs on our servers and is not controlled by your cookie choice.

If you reach us by clicking a Meta, Reddit or Google advert, and you have accepted analytics cookies, we store the click identifier from that advert in your browser's local storage for up to 30 days. It is added to links you follow into our app, and sent with the sign-up form on our advert landing pages, so that a sign-up made later in the same browser can still be attributed to the advert. Separately, where the Google tag is active it sets its own first-party cookies, which can record a Google click identifier for up to 90 days for the same purpose.

Separately from cookies, we send conversion records to advertising platforms from our servers, as described in section 4. That server-side measurement does not depend on cookies and is not turned off by cookie settings; see section 4 for how to opt out of it.

Where required by law, we will ask for your consent before setting non-essential analytics or advertising cookies or enabling session replay. In regions that do not require prior consent, these technologies may be active by default and you can opt out at any time. You can manage cookies through your browser controls and the Cookie settings link in our website footer.

US state privacy rights. If you are a US resident, the advertising measurement and advertising audience matching described in this policy may be considered "sharing" of personal information under laws such as the California Consumer Privacy Act. You can opt out of browser-based advertising cookies and measurement by choosing "Only Required" in the cookie banner or using the "Your Privacy Choices" link in our website footer, and we honour the Global Privacy Control browser signal as a valid opt-out of sale and sharing for browser-based tracking. Those browser controls do not cover the server-side conversion measurement or the customer-list matching described in section 4, because neither depends on cookies. To opt out of those, email [email protected].

9. Children's privacy

TicketRobin is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us immediately.

10. International data transfers

Your data may be processed in countries outside the UK/EU. Where required, we use appropriate safeguards for international transfers, including adequacy regulations and contractual transfer mechanisms (such as standard contractual clauses with UK addendum or equivalent safeguards).

11. Changes to this policy

We may update this privacy policy from time to time. We'll notify you of significant changes via email or a prominent notice on our website.

12. Contact us

If you have questions about this privacy policy or how we handle your data, please contact us:

• Email: [email protected]
• General inquiries: [email protected]

TicketRobin Limited (Company No. 16987459) is incorporated in England and Wales.

For GDPR-related concerns, you may also lodge a complaint with the UK Information Commissioner's Office (ICO) or your local data protection authority.