Privacy policy

At TicketRobin, we take your privacy seriously. This policy explains how we collect, use, store, and protect your personal information.

1. Information we collect

Account information

When you create an account, we collect your name, email address, and password. If you upgrade to a plan with WhatsApp alerts, we also collect your mobile phone number.

Tracking preferences

We store the event tracking preferences you configure, including event names, dates, price ceilings, notification preferences, and filter settings.

Payment information

Payment processing is handled by our secure payment partner (Stripe). We do not store your full payment details on our servers. Stripe processes payment data on our behalf, and we retain limited billing data (such as last 4 digits, card brand, expiration date, and payment status) for account management, invoicing, and support.

Usage data

We collect information about how you use TicketRobin, including login timestamps, features accessed, alerts delivered, and interaction events on our website and product. This helps us improve our service and troubleshoot issues.

Device and browser information

We automatically collect technical information including IP address, browser type, operating system, and device identifiers for security and analytics purposes.

Advertising identifiers

If you reach us by clicking an advert, the advertising platform adds a click identifier to the link you followed. We store that identifier with your sign-up so we can later tell the platform that its advert led to an account, a checkout, or a purchase. The advertising platform does not tell us who you are, and we do not use the identifier to build a profile of you on our own site.

2. How we use your information

We use your information to:

• Provide and maintain the TicketRobin service
• Monitor ticket sites based on your preferences
• Send you alerts via email or WhatsApp when matching tickets appear
• Process payments and manage your plan or pass access
• Respond to your support requests
• Send important service updates and security notices
• Improve our service and develop new features
• Measure advertising performance and, where permitted by law, avoid showing acquisition adverts to existing customers
• Prevent fraud and abuse

3. Legal basis for processing (GDPR)

For users in the UK and EU, we process your data based on:

• Contract: Processing necessary to provide the service you've purchased or enrolled in
• Consent: Where you've explicitly opted in (e.g., marketing emails)
• Legitimate interests: For security, fraud prevention, service improvement, advertising measurement, and avoiding showing acquisition adverts to existing customers, where our interests are not overridden by your rights and choices
• Legal obligation: Where required by law (e.g., tax records)

4. Data sharing and disclosure

We do not sell your personal information. We share data only in these circumstances:

Service providers

We use trusted third-party providers to deliver our services. These providers process personal data under contractual terms and only for defined business purposes.

• Stripe: Payment processing, fraud prevention, billing, and transaction records
• Amazon Web Services (AWS): Cloud infrastructure and data storage (including service data and operational logs)
• Cloudflare: Website delivery, performance, and security services
• Google Analytics: Website analytics and performance measurement
• Cloudflare Web Analytics: Website analytics and traffic insights
• PostHog: Product and website analytics, including session replay, to help us understand usage patterns, improve journeys, and troubleshoot issues
• Reddit: Advertising measurement and conversion tracking via the Reddit Pixel and Reddit Conversions API, to measure the effectiveness of our advertising on Reddit
• Google Ads: Advertising measurement and conversion tracking via the Google tag, so we can measure the effectiveness of our advertising on Google. We do not enable personalised advertising or remarketing audiences through it
• Meta: Advertising measurement and conversion tracking via the Meta Pixel and the Meta Conversions API, and customer-list matching for advertising suppression or exclusion audiences, so we can measure the effectiveness of our advertising and avoid showing acquisition adverts to existing customers on Meta platforms such as Facebook and Instagram
• AWS SES: Transactional email delivery
• Twilio: WhatsApp alert delivery
• Affiliate networks (Impact, Partnerize, Awin): Attribution of ticket purchases made through affiliate links in our alerts, app and articles, so the ticket platform can pay us a commission. See "Affiliate links" below
• PromoteKit: Attribution for our own affiliate programme, so we can pay the creators and partners whose links bring people to TicketRobin. If you supply a creator code in our mobile app, we share your email address and the creator identifier with PromoteKit after you verify your account to register the referral. Creators cannot see your email address. PromoteKit is also connected to our Stripe account, so for a payment made after an affiliate referral it receives the payment details it needs to credit the partner (the amount, currency and your email address). See section 8

If you open the creator programme in our app, we check your verified TicketRobin email address with PromoteKit to find your creator account and load its share links, commissions and payouts. Customer email addresses and payout contact details are not included in the app's creator dashboard.

Conversion measurement

We measure whether our advertising leads to sign-ups and purchases. Some of that measurement happens from our servers rather than from your browser, using the Meta Conversions API and the Reddit Conversions API. When you register an account, start a checkout, complete a purchase, start a subscription, or search for an event, we may send a record of that action to the relevant advertising platform.

Those records can include a securely hashed version of your email address, your first name, your mobile phone number (where you have provided one for WhatsApp alerts), and your account identifier, together with your IP address and your browser user agent. Where they exist, they can also include the browser identifier that the advertising platform's pixel stores in your browser and the click identifier from the advert you followed. Hashing helps protect identifiers in transit, but hashed identifiers remain personal data.

Because this measurement runs on our servers, it does not use cookies and is not switched off by your browser's cookie settings. If you would prefer us not to include your account in advertising conversion measurement, email [email protected] and we will exclude you.

Advertising audiences and suppression lists

Where permitted by law, we may use customer-list matching with advertising platforms to create suppression or exclusion audiences. This helps us avoid showing acquisition adverts to existing customers. For example, we may share securely hashed identifiers such as email addresses or phone numbers with Meta so it can check whether they match Facebook or Instagram users and include matched accounts in an exclusion audience.

Hashing helps protect identifiers during matching, but hashed identifiers remain personal data. We do not use these customer lists to build lookalike audiences or to target existing customers with acquisition adverts unless we update this policy and assess the lawful basis first. You can object to this use of your personal data by emailing [email protected].

Affiliate links

Some ticket links in our alerts, in the app and in our articles are affiliate links. When you follow one, it passes through an affiliate network's tracking address (Impact, Partnerize or Awin, depending on the platform) before reaching the ticket platform's page. The network receives the click: your IP address, browser and device information, the time, the page you are being sent to, and a reference we attach that identifies the alert, tracker or article the link came from. We do not send your name, email address or phone number. We can connect the reference to your account on our side when we reconcile commissions.

The network and the ticket platform then use cookies or similar identifiers on their own sites, typically for up to 30 days, to work out whether a purchase followed the click. If it did, the platform may pay TicketRobin a commission. This costs you nothing extra and does not change which tickets we alert you to, the order we show them in, or the price you pay. We rely on our legitimate interests in funding the service for this processing. Every alert, page and article that carries an affiliate link says so, and you can always reach the platform without the tracking hop by going to its site directly. The networks describe their own processing in their privacy notices at impact.com, partnerize.com and awin.com.

Legal requirements

We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety.

Business transfers

If TicketRobin is acquired or merged with another company, your data may be transferred as part of that transaction.

5. Data retention

We retain your account data for as long as your account is active. If you cancel your account, we will delete your personal information within 30 days, except where we must retain it for legal or accounting purposes.

Alert history and usage logs are retained for 90 days for troubleshooting purposes.

Advertising click identifiers stored with your account are kept for as long as your account is active, and are removed along with the rest of your personal information when the account is deleted. Conversion records that have already been sent to an advertising platform are held by that platform under its own retention policy and cannot be recalled by us.

If you joined through one of our affiliate partners' links, we use referral identifiers on your account to associate eligible purchases with that partner. These account associations are removed when your account is deleted. Minimal transaction and commission reconciliation records are retained for accounting and reconciliation, including reference identifiers, amounts, currencies and refund history. These retained records do not contain your account email or raw store purchase tokens.

6. Your rights

Under GDPR and UK data protection law, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a machine-readable format
• Object: Object to processing based on legitimate interests, including advertising audience matching
• Withdraw consent: Opt out of marketing or other consent-based processing

To exercise these rights, email us at [email protected].

7. Security

We implement industry-standard security measures including encryption in transit (TLS/SSL), encrypted data at rest, secure password hashing, and regular security audits.

However, no system is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

8. Cookies and tracking

We use essential cookies for authentication and site functionality. We also use analytics technologies, including Google Analytics, Cloudflare Web Analytics, and PostHog, to understand traffic patterns, measure usage, improve the site, and troubleshoot problems. These analytics tools may use cookies and similar identifiers to collect information such as page views, clicks, navigation patterns, browser and device information, and approximate location derived from IP address.

We also use PostHog session replay to help us understand how users navigate and interact with our website and product, for example clicks, taps, scrolling, and page navigation. Session replay is used for product improvement, debugging, and troubleshooting.

If you accept analytics cookies, we also use advertising measurement technologies to understand which adverts bring people to us: the Reddit Pixel, the Meta Pixel, and the Google tag with its Google Ads measurement destination. These may process identifiers such as cookies, a click identifier from the advert you came through, your IP address, and browser and device information, and may involve sharing that data with Reddit, Meta and Google as described in their respective privacy policies. We ask Google to measure our adverts only: we do not enable personalised advertising or remarketing audiences through the Google tag. These three technologies run in your browser and do not load until you have accepted analytics cookies, or, in regions that do not require prior consent, until the regional default applies. The Conversions API measurement described in section 4 is separate: it runs on our servers and is not controlled by your cookie choice.

If you reach us by clicking a Meta, Reddit or Google advert, and you have accepted analytics cookies, we store the click identifier from that advert in your browser's local storage for up to 30 days. It is added to links you follow into our app, and sent with the sign-up form on our advert landing pages, so that a sign-up made later in the same browser can still be attributed to the advert. Separately, where the Google tag is active it sets its own first-party cookies, which can record a Google click identifier for up to 90 days for the same purpose.

Separately from cookies, we send conversion records to advertising platforms from our servers, as described in section 4. That server-side measurement does not depend on cookies and is not turned off by cookie settings; see section 4 for how to opt out of it.

Affiliate links work differently again. When you follow an affiliate link from an alert, the app or an article, the affiliate network and the ticket platform set cookies on their own sites, not on ours, to attribute any purchase to the click, as described in section 4. Our cookie banner does not control those cookies; the platform's own privacy controls do.

We also run our own affiliate programme through PromoteKit, so creators and partners who send people to TicketRobin can be paid a commission. If you arrive from one of their links and you have accepted advertising cookies (or, in regions that do not require prior consent, the regional default applies), PromoteKit records the click and sets a cookie called promotekit_referral on ticketrobin.com for 60 days. It holds a referral identifier, not your name or contact details, and is read when you sign up or pay so the right partner gets the credit. It is never set without that consent, and never while your browser sends the Global Privacy Control signal. If you reject cookies in our cookie settings, the promotekit_referral cookie is removed from your browser. When you pay, we attach the referral identifier to your payment in Stripe so PromoteKit, which is connected to our Stripe account, can credit the partner; PromoteKit therefore receives the payment details it needs for that (the amount, currency and your email address). We keep the referral identifier on your account for up to 12 months so renewals in that time are credited to the same partner. PromoteKit describes its own processing in its privacy notice at promotekit.com.

Where required by law, we will ask for your consent before setting non-essential analytics or advertising cookies or enabling session replay. In regions that do not require prior consent, these technologies may be active by default and you can opt out at any time. You can manage cookies through your browser controls and the Cookie settings link in our website footer.

US state privacy rights. If you are a US resident, the advertising measurement and advertising audience matching described in this policy may be considered "sharing" of personal information under laws such as the California Consumer Privacy Act. You can opt out of browser-based advertising cookies and measurement by choosing "Only Required" in the cookie banner or using the "Your Privacy Choices" link in our website footer, and we honour the Global Privacy Control browser signal as a valid opt-out of sale and sharing for browser-based tracking. Those browser controls do not cover the server-side conversion measurement or the customer-list matching described in section 4, because neither depends on cookies. To opt out of those, email [email protected].

9. Children's privacy

TicketRobin is not intended for children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us immediately.

10. International data transfers

Your data may be processed in countries outside the UK/EU. Where required, we use appropriate safeguards for international transfers, including adequacy regulations and contractual transfer mechanisms (such as standard contractual clauses with UK addendum or equivalent safeguards).

11. Changes to this policy

We may update this privacy policy from time to time. We'll notify you of significant changes via email or a prominent notice on our website.

12. Contact us

If you have questions about this privacy policy or how we handle your data, please contact us:

• Email: [email protected]
• General inquiries: [email protected]

TicketRobin Limited (Company No. 16987459) is incorporated in England and Wales.

For GDPR-related concerns, you may also lodge a complaint with the UK Information Commissioner's Office (ICO) or your local data protection authority.