Privacy Policy

The short version

AmbushTix is a marketplace for verified ticket resale. We need a little bit of personal information to run it — your email and name to create an account, payment details to take you to checkout (handled by Stripe, not us), and ID verification before you can sell. We don’t sell your data to anyone, and we don’t use it for advertising. The long version below explains exactly what we collect, why, and who else sees it.

1. Who we are

AmbushTix (“we,” “us,” or “AmbushTix”) operates the website at https://ambushtix.com. If you have questions about this policy or about your data, email support@ambushtix.com.

2. What we collect

From you, when you create an account

• Email address
• Full name
• Password (stored as a one-way hash — even we can’t read it)
• Optional: profile photo URL
• Optional: a mobile phone number. If — and only if — you tick the separate opt-in box, we also record your consent (and the date) to receive marketing text messages. Message & data rates may apply; reply STOP to opt out at any time. You can add, change, or remove this any time on your account page.

If you sign in with Google or Facebook

We receive your email address and your name from the provider. We do not get access to your contacts, posts, friends list, or anything else. You can revoke our access at any time from your Google or Facebook account settings.

When you become a member or make a purchase

• Payment details are entered directly into Stripe’s secure payment fields. Card numbers, expiration dates, and CVCs never touch our servers. We store only a Stripe Customer ID and an Order ID so we can look up your transaction.
• Order metadata: which listing you bought, quantity, total paid, event details.
• If a payment fails, the reason Stripe gave (e.g., “card declined”).

Before you can sell tickets (identity verification)

Sellers must complete identity verification through Stripe Identity. Stripe collects a government-issued photo ID and a selfie. We receive only a verification status (approved, pending, or rejected) from Stripe — we never see the document image or the selfie.

When you use the site

• Server logs from Vercel (our hosting provider) with IP address, user agent, and timestamps.
• A login session cookie (so you stay signed in across pages).
• A small “beta access” cookie if you’ve been let into the beta.
• Watchlist entries, notification preferences, search history while signed in.

When you message other members

Messages between buyers and sellers are stored for 90 days, then archived. We read messages only when reviewing a flagged report or investigating a dispute.

3. How we use your information

• To run your account and let you buy or sell tickets.
• To process payments (via Stripe) and pay out sellers (via Stripe Connect).
• To deliver tickets to buyers (download links or mobile-transfer hand-off).
• To send transactional emails: order confirmations, ticket delivery, payment failures, refunds, dispute updates.
• To send membership-status emails (renewal, failed payment, win-back).
• To detect fraud and duplicate listings (we hash ticket barcodes to catch the same ticket listed twice).
• To investigate disputes between buyers and sellers.
• To improve the service (aggregate, non-identifying analytics).

We do not:

• Sell your personal information to advertisers or data brokers.
• Use your data to train AI models.
• Send marketing email to people who haven’t opted in.
• Use third-party advertising tracking (no Facebook Pixel, no Google Ads tags).

4. Who else sees your data

We use a small number of vendors to run AmbushTix. Each one only gets the data they need for their part of the job.

• Stripe (payment processing, identity verification, payouts). See stripe.com/privacy.
• Supabase (our database and file storage, hosted in the US). See supabase.com/privacy.
• Resend (sending transactional email). See resend.com/legal/privacy-policy.
• Vercel (web hosting and request logs). See vercel.com/legal/privacy-policy.
• Google and Facebook — only if you choose to sign in with one of them. They see that you used their button to sign in to AmbushTix.

We may also disclose information if required by law (subpoena, court order) or to investigate fraud or abuse. We’ll let you know when we’re legally allowed to.

5. Your rights

You can:

• See what we have on you — your account page already shows most of it.
• Correct your name, email, or password from your account page.
• Download a copy of your data — email support@ambushtix.com and we’ll send it within 30 days.
• Delete your account — same email address. We’ll remove your profile and listings; we keep order records for 7 years for tax and dispute reasons.
• Opt out of non-transactional emails from the link at the bottom of any email or in your account settings.

If you live in California (CCPA) or the EU/UK (GDPR), you have specific additional rights — the requests above are how to exercise them.

6. How long we keep your data

• Account profile: until you delete your account.
• Orders, payouts, and refunds: 7 years (tax + dispute records).
• Messages between members: 90 days active, then archived.
• Ticket files: until 30 days after the event, then deleted.
• Server access logs: 30 days.
• Stripe Identity verification results: as long as you have a seller account.

7. Security

We use industry-standard practices: HTTPS everywhere, hashed passwords, encrypted database at rest (Supabase), Stripe’s PCI-DSS-compliant infrastructure for payments, signed download URLs that expire in 15 minutes, and CSRF protection on social login. Nothing is 100% secure, but we treat your data like we’d want ours treated.

8. Children

AmbushTix is for adults. We don’t knowingly collect information from anyone under 18. If you believe a minor has created an account, email support@ambushtix.com and we’ll remove it.

9. Changes to this policy

If we make a material change (something that affects how your data is used or shared), we’ll email you and update the “Last updated” date at the top of this page. Small clarifications and typo fixes won’t trigger an email.

10. Contact

Questions, requests, or concerns — write to support@ambushtix.com. We respond to privacy requests within 30 days.