Stubservant (“we”, “us”) provides event ticketing software. We are the data controller for account and analytics data described below, and act as a data processor on behalf of event organizers for the ticket-buyer data they collect through their events.

Registered name: [add legal entity name]
Registered address: [add registered address]
Contact: via our privacy request form — we don’t publish a direct email address to keep it out of spam and scraper lists.

If you run events with us (organizer accounts): your name, email address, and a securely hashed password — we never store your password in plain text. Billing details are collected and stored directly by Stripe, our payment processor; we don’t hold your card details ourselves.

If you buy a ticket: your name and email address, attached to your order and tickets, so we can send your tickets and let door staff verify them. Payment is handled entirely by Stripe — we don’t receive or store your card details.

Site analytics: with your consent (see Cookies below), we record which pages are viewed, roughly how long for, a coarse device type (mobile/tablet/desktop), and the referring page. This is not tied to your name or account, and we do not store your IP address.

Support messages: if you contact us for help, we keep the message thread (your name, email, and what you wrote) so we can respond and keep a record of the conversation.

• Contract: account data and ticket-order data, because we can’t provide the service (issuing and verifying tickets, running your dashboard) without it.
• Consent: analytics tracking, which only runs after you accept it via the cookie banner.
• Legitimate interest: responding to support messages, and keeping minimal fraud/abuse-prevention logs (e.g. rate-limiting).
• Legal obligation: retaining financial records of completed transactions for accounting and tax purposes.

We use a small number of processors to run the service, each only for the purpose described:

• Stripe — payment processing and billing. Stripe handles and stores your card details; we don’t.
• Resend — delivering transactional emails (ticket confirmations, receipts, replies to support messages, password resets).
• Our hosting provider — runs the servers and database that store the data described above.

We do not sell personal data, and we do not share it with anyone for their own marketing purposes.

Account data is kept while your account is active. Completed order records are kept as anonymized transaction history for as long as we’re required to for accounting purposes, but with your name and email removed once you ask us to (see below). Analytics events are kept for a rolling window and are not linked to your identity in the first place.

Under UK/EU GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data
• Restrict or object to certain processing
• Receive your data in a portable format

To exercise any of these, use our privacy request form — it’s not just for erasure, tell us what you need in the message and we’ll action it. You also have the right to complain to your local data protection authority — in the UK, the Information Commissioner’s Office (ICO).

We use strictly necessary cookies to keep you signed in, and — only with your consent — cookies and similar local storage for basic analytics. See our Cookie Notice for the full detail and to change your preference.

Passwords are hashed, never stored in plain text. Data is transmitted over encrypted connections (HTTPS). Access to organizer and buyer data is restricted to the relevant organization’s own staff accounts.

If this policy changes materially, we’ll update the date at the top of this page.