FoundTix Privacy Policy
Last updated: 2026-10-25
1. Who we are and how to contact us
1.1 This Privacy Policy describes how FoundTix Ltd (“FoundTix”, “we”, “us”, “our”) collects, uses, and protects personal data when you use the FoundTix platform at foundtix.com or buy a Ticket through it. FoundTix Ltd is registered in England and Wales (Company No: 17238343), registered office 128 City Road, London EC1V 2NX, United Kingdom.
1.2 For any privacy question, data-rights request, or to report a concern, contact info@foundtix.com. We aim to respond within one month, as required by UK GDPR.
1.3 If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.
2. Our role under data-protection law
2.1 For most of the personal data we handle, FoundTix is the controller - we decide what data is collected, for what purpose, and how it is used. This includes platform accounts, ticket purchases, and the marketing channels we operate ourselves.
2.2 Where we pass a buyer’s data to the Organiser of an Event they have a Ticket for (for example, an attendee list the Organiser asks us to email to the venue), FoundTix and the Organiser are independent controllers. Each is responsible for its own use of that data, and the Organiser is responsible for publishing their own privacy information. Separately, where the Organiser has connected their own Meta, TikTok or Reddit advertising account, records of your activity on their Event pages, including your purchase, also go to that account (clauses 5.4 and 11). This is shared controller to controller: the Organiser, as the advertiser, is an independent controller for how they use it in their advertising account.
2.3 For limited functions - for example, transactional email delivery or hosting - we use third-party processors that act on our written instructions and only for the purposes we set. The processors we rely on are listed in clause 7.
3. The personal data we collect from buyers
3.1 When you buy a Ticket, FoundTix collects the following from you:
(a) Account / contact details - first name, last name, email address, postcode, country (from your payment details or, if they don't include it, worked out from your IP address), and (optionally) mobile phone number.
(b) Scrambled contact details - your email address and (if you give it) your mobile number, each turned into a scrambled code. The code can’t be turned back into your details, but an advertising platform can compare it with codes made from its own users’ details to find a match. We keep these codes with your record and use them to match activity with the ads that led to it (clause 5.4) and, if you opt in, to build FoundTix Marketing audiences with Meta, including audiences of people with similar interests (clause 6).
(c) Purchase details - the Events you bought Tickets for, how many, the price paid, when you bought, and the Stripe or PayPal payment reference. We do not see or store your full card number or card security code, or your PayPal login; Stripe and PayPal collect those directly from you (clause 7). If you pay with PayPal, PayPal also gives us your name, email address and country.
(d) Consent records - for each marketing choice (email marketing, SMS marketing and FoundTix Marketing audiences) we keep a full history of every consent you give or withdraw, which cannot be changed afterwards, with the time, the IP address used, your browser type and the version of the wording you agreed to. We need this to show that we have a lawful basis under UK GDPR.
(e) Interest tags - if you have agreed to marketing from us, we may work out tags from your purchase record, such as the kinds of event or genres, artists or performers, venues or region you seem to like. We use these only for the audience purposes in clause 6.
(f) Technical data - your IP address, browser type and the times of important actions, recorded in our own system logs and our hosting provider’s logs (clause 7) for security, fixing faults and preventing abuse. If you arrive by clicking an ad, we also record the reference code the ad added to the link, with a scrambled version of your IP address and browser type, for up to fourteen (14) days, to measure which ads lead to ticket sales (legitimate interest, clause 5.4). This stores nothing on your device. When you place an order, we also keep your IP address, browser type and any ad reference codes with it, as part of the order record. If you use the referral scheme (Buyer Terms clause 6.11), we create a personal link for your Order and record which link a referred Order came through, so we can count the Tickets bought through your link and pay any referral refund. The person who shared the link sees only how many Tickets were bought through it, never who bought them. The Organiser can see which Order a referred Order came through.
(g) Other details you give us - the names of anyone you buy Tickets for, waitlist sign-ups, ratings and comments you leave after an Event, messages you send to our support team, Tickets you list for resale, every email address linked to your orders and, if you add a Ticket to Apple Wallet, a device code Apple gives us so that we can update the pass.
3.2 You do not need to create an account to buy a Ticket, and buyers do not sign in. We recognise you by your email address.
4. The personal data we collect from promoters
4.1 When you create a promoter account on FoundTix, we collect:
(a) Account details - display name, contact email, optional contact phone, and (where you choose to register one) a business name and country.
(b) Sign-in data - our sign-in provider (Supabase) keeps you signed in with a secure session code, and stores your password, if you set one, only in scrambled form. If you sign in with a link sent by email, it stores a short-lived, single-use code.
(c) Stripe account details - your Stripe account reference and the basic status of your Stripe set-up (whether you can take payments, whether payouts are switched on, and whether your details are complete). Stripe collects your identity and business checks directly, on its own pages; we never see them.
(d) Advertising account connections - when you connect a Meta, TikTok or Reddit account, we store the access codes it issues to us in encrypted form, and the encryption key is held only in our hosting environment. The access codes are never written to our logs in readable form and never sent to your browser. You can remove a connection at any time in your FoundTix Settings or in that platform’s own settings. For Meta, you can also remove FoundTix under Settings, then Business Integrations, in your Facebook account, or ask us to delete all the Meta data we hold; any of these deletes the stored Meta access codes. Deletion requests made through Facebook are confirmed at foundtix.com/data-deletion, and you can always email us at info@foundtix.com.
(e) PayPal account details - your PayPal merchant reference and the basic status of your PayPal set-up (whether you can receive payments, whether your email address is confirmed and whether FoundTix has the access it needs). PayPal collects your identity and business checks directly; we never see them.
5. How we use your data and our lawful bases
5.1 To deliver your purchase (Article 6(1)(b) - contract). We use your name, email, phone, postcode, and purchase details to issue your Ticket(s) (PDF attachment and, where available, Apple Wallet / Google Wallet passes), to email you the order-confirmation, to process refunds, and to send any change-of-event notifications the Organiser triggers under our Terms.
5.2 To run the platform (Article 6(1)(f) - legitimate interest). We use technical data (IP address, browser type and logs) for security, fraud detection, debugging, and abuse prevention. Our interests in keeping the platform secure are balanced against the limited intrusiveness of these logs.
5.3 For marketing recommendations (Article 6(1)(a) - consent). We send promotional emails about other Events only to buyers who have explicitly granted email-marketing consent at checkout. The same applies to SMS alerts (separate consent) and to the FoundTix Marketing audience sharing described in clause 6. You may withdraw consent for any channel at any time without affecting the lawfulness of processing before withdrawal.
5.4 To measure and improve advertising (Article 6(1)(f) - legitimate interest).
(a) When you view an Event page, start a checkout, buy a Ticket or take a similar step, we send a record of it to Meta, TikTok and Reddit. The record goes to the Organiser’s own advertising account on that platform (where the Organiser has connected one) and to FoundTix’s own advertising accounts. A record of your purchase can also go to the Meta account of another promoter who advertised the Event with the Organiser. This lets the Organiser and FoundTix see which ads lead to ticket sales and show ads to the right people.
(b) So that the platforms can match the record, it includes your IP address and browser type and, if you came from an ad, the code that ad added to its link. Once you have entered your details at checkout, it also includes, in scrambled form (clause 3.1(b)), your email address and phone number, a reference number we give you and, for Meta and TikTok, your name and postcode, and for Meta your country.
(c) When you arrive on FoundTix we note which website or app sent you (for example Google or Instagram) and keep it with your order, so the Organiser can see where their buyers come from.
(d) This does not add you to our email or text marketing lists, and it does not depend on your marketing consent.
(e) We do this on the basis of legitimate interests: FoundTix and the Organiser need to know which ads work and to show them to people likely to be interested. We have balanced this against your privacy and believe it is fair, because your contact details are only ever sent in scrambled form, and only for this purpose. You can object at any time (clause 10.1(f)).
5.5 To meet legal obligations (Article 6(1)(c)). We retain order and payment records as required by HMRC and other applicable law (see clause 9).
5.6 We do not sell personal data, and we do not share it with anyone outside the recipients listed in clause 7.
6. Consent at checkout, marketing, and FoundTix Marketing audiences
6.1 We ask for your consent separately for each kind of marketing below. Each consent is optional and is recorded separately:
(a) Booking emails - we send these because we need them to deliver your booking under our contract with you, so they do not depend on your consent.
(b) Email marketing - optional, opt-in: occasional recommendations for similar events.
(c) FoundTix Marketing audiences - optional, opt-in: lets us include your scrambled details in Meta audiences, including audiences of people with similar taste (lookalike audiences), to show you and people like you relevant Events across FoundTix (see clause 6.2).
(d) SMS marketing - optional, opt-in, if you give us a mobile number: rare text alerts for last-minute drops or surprise announcements.
(e) Organiser marketing - optional, opt-in: lets the Organiser of an Event contact you about their own events. If you agree, we share your email address with that Organiser, who uses it as a separate controller under their own privacy notice. To stop hearing from them, use the unsubscribe link in their emails or contact them.
6.2 FoundTix Marketing audiences. If you give this consent, we may add your scrambled email address and mobile number (clause 3.1(b)) to an advertising audience on Meta, and use it to find people with similar interests, so we can show relevant Events on FoundTix to you and to people like you. The Organiser of the Event being advertised never receives your contact details through these audiences: Meta does the matching, and the Organiser only sees overall audience numbers that don’t identify anyone. Audiences of people with similar interests (lookalike audiences) are statistical models built by Meta and do not themselves contain your personal details.
6.3 These audiences are time-limited and you can leave them. If you withdraw consent, we stop using your details for new audiences and remove you from the audience lists we have uploaded the next time we update them. In any case, access ends thirty (30) days after the relevant Event ends, and we keep an internal record of every audience we upload.
6.4 Every marketing email we send carries a one-click unsubscribe link. You can revisit any consent at any time, free of charge, by contacting info@foundtix.com.
7. Third parties that process your data
7.1 We share personal data with the following service providers and partners. Each is bound by a contract requiring it to handle personal data in line with UK GDPR.
(a) Stripe Payments UK Ltd (and Stripe, Inc.) - takes card, Apple Pay and Google Pay payments and processes any refunds we issue. Stripe collects your card details directly on its own secure payment form; we never see or store your card number, expiry date or security code. Stripe is a separate controller for the data it collects to prevent fraud. stripe.com/gb/privacy
(b) Supabase, Inc. - runs our database, sign-in system and file storage, and holds the data described in clauses 3 and 4. supabase.com/privacy
(c) Vercel Inc. - hosts our website and measures visits to it without cookies. Vercel sees technical details of each visit, including your IP address, so it can show you our pages and keep technical logs. vercel.com/legal/privacy-policy
(d) The Rocket Science Group LLC (“Mailchimp”) - delivers the emails we send about your booking (through Mailchimp Transactional, formerly Mandrill) and, if you agree to email marketing, our marketing emails. We give it your email address, the message and (for ticket emails) the PDF attachment. mailchimp.com/legal/privacy
(e) Meta Platforms, Inc., TikTok (TikTok Technology Limited and TikTok Information Technologies UK Limited) and Reddit, Inc. (advertising platforms) - receive the activity records described in clause 5.4, both for the Organiser’s own advertising account (where the Organiser has connected one) and for FoundTix’s own, and, for purchases, for the Meta account of a promoter who advertised the Event with the Organiser; the data from their advertising cookies, if you accept them (clause 11.1(c)); and, for Meta only, the FoundTix Marketing audiences you opt in to (clause 6). Your email address and phone number (and, for Meta and TikTok, your name and postcode, and for Meta your country) are sent in scrambled form. Your IP address and browser type are also sent, because the platforms need them for matching, and may not be scrambled. facebook.com/privacy/policy, tiktok.com/legal/page/eea/privacy-policy/en, redditinc.com/policies/privacy-policy
(f) The Organiser of any Event you buy a Ticket for receives - only when you have purchased a Ticket from them - your name, contact details, ticket-type, and order number, so they can run the Event (door scans, guest lists, problem resolution). The Organiser is an independent controller for that data; their own privacy notice applies.
(g) PayPal UK Ltd - takes PayPal payments, including PayPal Pay in 3, and processes refunds on them. PayPal collects your PayPal login and payment details directly; we never see them. PayPal is a separate controller for the data it collects. paypal.com/uk/legalhub/paypal/privacy-full
(h) Anthropic, PBC - provides the optional AI features in the promoter dashboard and helps us read sales reports that promoters forward to us. It receives what promoters type or forward to those features, not our buyers’ contact details. anthropic.com/legal/privacy
7.2 Apple and Google (the wallet pass providers) do not process buyers’ personal data for us: by design, the wallet pass we create contains only the ticket code, the event details and the organiser’s display name, never your name, email or phone number.
8. International transfers
8.1 Some of the providers in clause 7 are based in the United States or send data there (for example Anthropic, Mailchimp, Meta, PayPal, Reddit, TikTok and Vercel). When personal data is sent outside the UK, we protect it with the UK’s approved contract terms for international transfers (the UK Addendum to the EU Standard Contractual Clauses, or the EU clauses themselves), together with each provider’s published assessment of the transfer risks and the extra safeguards it uses.
8.2 You can request a copy of the safeguards in place for any specific transfer by emailing info@foundtix.com.
9. Retention
9.1 Order and financial records. We keep order, refund and payment records for seven (7) years after the end of the tax year in which the order was made, in line with HMRC record-keeping requirements, and then remove your personal details from them.
9.2 Consent records. We keep the full history of your consents (given and withdrawn) for as long as we keep your account or order data, so that we can show the lawful basis for any past use of your data. Each change is added as a new entry; earlier entries are never overwritten.
9.3 Marketing-only data. Where we hold data about you only for marketing (for example the interest tags in clause 3.1(e)), we will delete it within a reasonable period after you withdraw all your marketing consents, unless we must keep it under clause 9.1.
9.4 Logs, copies of emails and backups.
(a) We keep our system and security logs for twelve (12) months. Logs about an order are kept with that order’s records, for the period in clause 9.1.
(b) We keep copies of the emails we send for twenty-four (24) months. The record that we sent an email is kept for the period in clause 9.1.
(c) Our hosting provider (Vercel) and database provider (Supabase) also keep their own logs and backups, for the periods set by their standard policies.
9.5 Unused promoter accounts. If a promoter account has no sales, published Events, campaigns or fee invoices and has not been used for ninety (90) days, we email a warning and then delete the account fourteen (14) days later unless you sign in.
10. Your rights under UK GDPR
10.1 You have the following rights in relation to the personal data we hold about you:
(a) Access - request a copy of the personal data we hold about you.
(b) Rectification - ask us to correct inaccurate or incomplete data.
(c) Erasure (“right to be forgotten”) - ask us to delete your data. We stop marketing to you and delete your marketing data straight away. We keep the details on your orders until the time for raising a payment dispute has passed (540 days after your last payment, or 120 days after your last Event if that is later), so that a dispute can still be answered, and then remove your personal details from them. The order and payment records themselves are kept as clause 9.1 requires.
(d) Restriction - ask us to limit processing in specific circumstances.
(e) Portability - ask us to provide your data in a structured, machine-readable format, or to transmit it to another controller where technically feasible.
(f) Objection - object to processing based on legitimate interest, including for direct marketing.
(g) Withdrawal of consent - withdraw any consent you have given, at any time, without explanation. Withdrawal does not affect the lawfulness of processing before the withdrawal.
(h) Complaint - lodge a complaint with the UK Information Commissioner’s Office (see clause 1.3).
10.2 To exercise any of these rights, email info@foundtix.com from the address associated with your account or purchase. We may ask for additional information to verify your identity before we can act. We respond within one month. If a request is complex, or you make several, this can be extended by up to two further months, in which case we will tell you within the first month.
11. Cookies and similar technologies
11.1 We always set the cookies the site needs to work, and a cookie that remembers your cookie choice. The only other cookies we use are the advertising cookies in 11.1(c). We show a cookie banner on your first visit and set advertising cookies only if you accept them. If you decline, or make no choice, they are never set. You can change your choice at any time with the Cookie settings link at the bottom of our pages.
(a) Strictly necessary. The sign-in cookies that keep promoters signed in to the dashboard (set by our provider Supabase), the cookies that hold your reservation while you check out, the cookies Stripe and PayPal set to provide their payment options, and a cookie named ft_activation_originthat remembers, for up to thirty (30) minutes, the event or dashboard page a promoter started setting up FoundTix Ticketing from, so we can return them there once they have connected Stripe. These do not need consent under PECR.
(b) Preference. A cookie named ft_consentthat records your accept/decline choice (so we don’t ask again for a year), and a cookie named ft_demo_banner_dismissedthat remembers when a promoter has dismissed the demo banner on the dashboard.
(c) Advertising (only with your consent). If you accept advertising cookies, Meta, TikTok and Reddit may place their own cookies on your device (such as _fbp and _fbc for Meta, _ttp for TikTok and _rdt_uuid for Reddit), for FoundTix’s own advertising accounts and for the Organiser’s. We also place our own cookie, ft_attr, which keeps a note of the ad or link that brought you to us for thirty (30) days. These cookies are used, with the records in clause 5.4, to measure how ads perform and to build advertising audiences, for example of people who visited, of people who have already bought and of people with similar interests. On the checkout and confirmation pages, the platforms also receive your contact details in scrambled form. If you do not accept advertising cookies, none of these cookies are set.
11.2 Separately from these cookies, when you view an Event page, start a checkout or buy a Ticket, we send a record of it from our own systems to Meta, TikTok and Reddit (clause 5.4). This puts nothing on your device, so it happens whether or not you accept advertising cookies. If you have accepted them, the record also includes the codes those cookies hold, so the platform can link it to your visit. The advertising cookies themselves are only ever set with your consent (clause 11.1(c)).
12. Children
12.1 FoundTix is intended for adults. We do not knowingly collect personal data from anyone under 13 years of age. If you believe we may have collected such data, contact us at info@foundtix.com and we will delete it.
12.2 Age restrictions for individual Events are set by the Organiser and are shown on the public Event page; tickets should not be purchased for attendees below the stated minimum age unless the listing explicitly allows it (e.g. “14+ with an adult”).
13. Security
13.1 We store personal data in our database (Supabase), which is set up so that each user can reach only the records they are allowed to see. Full-access credentials are used only by our own trusted systems (for example to process payment notifications, run scheduled tasks and issue Tickets after payment) and are never exposed to anything outside our control. The access codes for promoters’ Meta, TikTok and Reddit connections are stored encrypted, and the encryption key is kept only in our hosting environment.
13.2 Everything sent between you and FoundTix is encrypted in transit. Card details are collected by Stripe directly, on systems certified to the highest card-industry security standard (PCI-DSS Level 1), and never pass through or are stored on FoundTix’s systems.
13.3 No internet-connected system is perfectly secure. If we ever suffer a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify you directly without undue delay.
14. Changes to this Privacy Policy
14.1 We may update this Privacy Policy from time to time. The version in force when you provided personal data continues to govern that data unless we tell you otherwise; for material changes we will give reasonable notice (a dashboard banner for promoters, and an email for active marketing-consented buyers).
14.2 The current version is indicated by the “Last updated” date at the top of this page.
15. Governing law
15.1 This Privacy Policy and any dispute or claim arising out of or in connection with it is governed by the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction in relation to any dispute.