Privacy Policy

1. What we collect

We collect only what the platform needs to sell you a ticket and let you use it.

Account details. Your email address, and - if you choose to add them - your name, avatar, bio, banner image and social links.
Sign-in codes. We sign you in with a one-time code sent to your email. Codes are stored temporarily and expire.
Orders and tickets. The events you bought, ticket types, quantities, amounts, currency and the payment reference returned by our payment processor.
Activity you create. Saved events, waitlist entries, and - for organisers - the events and venues you publish.
Settlement account details. For organisers: business name, bank code, account number, settlement schedule, and a primary contact’s email, name and phone. Bank details are transmitted to Paystack and never stored by us — only the last four digits of the account number are retained.
Newsletter subscriptions. If you subscribe, your email address and a record of your consent.
Organiser verification. Verification status and history for organisers who apply to publish paid events.
Product analytics. Anonymous usage data collected via PostHog, when enabled, to help us understand and improve the platform.
Audit logs. Records of admin actions, settlement account changes, and ticket access events.

We never see or store your card details. Payment information is entered with our payment processor and never reaches our servers.

2. How we use it

To create your account and sign you in.
To process payments and issue tickets, including the QR code scanned at the door.
To email you receipts, ticket confirmations and changes to events you booked.
To show organisers attendance figures for their own events.
To detect abuse, prevent fraudulent purchases and keep the service running.

We do not sell your personal data, and we do not use it to build advertising profiles.

We share data only with the providers required to operate the platform:

Supabase - database hosting, authentication and file storage.
Google - only if you choose “Continue with Google” to sign in. Google confirms your identity to us and we receive your name and email address. If you sign in with an emailed code instead, Google receives nothing.
Paystack - payment processing. They receive the details needed to take payment and return a reference to us.
Resend - transactional email such as sign-in codes and receipts.
Sentry - error monitoring, so we can diagnose failures.
Tawk.to - live chat support, when you open a conversation with us.
PostHog - product analytics to understand how users interact with the platform. Data is anonymous and never includes card details.
Vercel Analytics - anonymous web traffic and visitor statistics (no cookies, no personal data).
Vercel Speed Insights - performance metrics (Core Web Vitals) to help us monitor and improve page load times.
Event organisers - the organiser of an event you buy from receives the information needed to admit you and manage their attendee list.

4. How long we keep it

OTP sign-in codes - deleted immediately after use, or after 10 minutes if unused.
Settlement audit logs - retained for 7 years as financial records.
Admin audit logs - retained indefinitely.
Ticket access events - retained for 90 days.
Newsletter subscriptions - retained until you unsubscribe.
Account and order records - kept while your account is open, and afterwards only as long as needed for financial and tax records.

5. Your rights

You can ask us to show you the data we hold about you, correct it, or delete your account and its data. You can edit most of your profile yourself from your account settings.

Deleting your account does not remove records we must retain for completed financial transactions.

Your data rights are protected under Ghana’s Data Protection Act 2012 (Act 843). You have the right to access, correct, delete, and request portability of your personal data.

6. Data Protection (Act 843)

Data controller. Ticket Wave Enterprise is the data controller responsible for the personal data you provide through the Platform, as defined under Ghana’s Data Protection Act, 2012 (Act 843). We determine the purposes and means of processing your personal data in accordance with Act 843 and any regulations made thereunder.

Breach notification. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, Ticket Wave Enterprise commits to notifying affected users without undue delay and in any case within 72 hours of becoming aware of the breach, in accordance with section 23 of Act 843. We will provide a description of the breach, the likely consequences, and the measures taken or proposed to address it and mitigate its effects.

International data transfers. Some of our service providers process data outside the Republic of Ghana. Supabase (database hosting), Resend (email delivery), Sentry (error monitoring), and PostHog (analytics) may store or process personal data in jurisdictions outside Ghana. Where personal data is transferred outside Ghana, Ticket Wave Enterprise ensures that appropriate safeguards are in place, including contractual commitments from recipients to provide a level of protection consistent with Act 843.

Children’s data. The Platform is not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us and we will take steps to delete such data promptly.

7. Cookies

We use cookies only where they are essential to the service:

Authentication cookies from Supabase — these keep you signed in and are essential. They cannot be disabled.
No advertising cookies. We do not run any advertising or ad-tracking cookies.
No third-party tracking cookies. When product analytics is enabled, PostHog uses first-party cookies only.

8. Contact

For any privacy question or request, reach us through the contact page. See also our Terms & Conditions and Refund Policy.