Data & security

Your data stays yours.

Equaticket is infrastructure. We process ticket sales and deliver transactional emails on your behalf. We don't monetize your attendee data, share it with advertisers, or use it to promote other events to your buyers.

Export anytime

Full attendee list as CSV, no restrictions, no expiry. Your data leaves with you.

No marketplace

Equaticket has no discovery platform. We don't cross-promote your attendees to other organizers.

Direct payments

Money flows straight to your Stripe account. Equaticket never holds organizer funds.

Audience ownership

Your attendees belong to you.

When a buyer purchases a ticket through Equaticket, their name and email become part of your audience, not a platform-wide audience. We do not:

Cross-sell your attendees' data to other organizers
Use your attendees' purchase history to build advertising profiles
Market other events to your buyers without your involvement

You can export your full attendee list as a CSV at any time, with no restrictions. You can also connect your Kit account to sync buyers to your own email list automatically. When you leave Equaticket, your data leaves with you.

Transparency

What we process and why.

When a buyer purchases a ticket, we collect only what's needed to deliver that ticket and operate the platform:

Name and email address

To deliver the ticket confirmation email and populate your audience dashboard

Payment details

Processed by Stripe directly. Equaticket never sees or stores raw card data.

Order and ticket records

Retained for the validity of the purchase, refunds, and organizer reporting

We do not build advertising profiles on buyers. We do not share buyer data with third parties for marketing purposes.

Payments

Money flows directly to you.

Equaticket uses Stripe Connect Standard. When a buyer checks out, payment goes directly to your connected Stripe account. Equaticket is not an intermediary in the money flow. We never hold organizer funds.

Your Stripe account is yours. Equaticket's access is limited to initiating charges on your behalf during checkout. You can disconnect at any time from your Stripe dashboard.

Buyer

pays at checkout

Stripe

processes the card

Your account

funds arrive directly

Equaticket is never in the money flow: no holding, no payouts.

Security

How we protect your account.

API keys hashed

Stored as SHA-256 hashes. The raw key is shown once at creation and never stored in recoverable form.

Webhook secrets encrypted

Signing secrets stored encrypted at rest using AES-256-GCM.

Scope-limited access

API keys are scoped to specific permissions (events:read, orders:read, etc.) and cannot exceed grants at creation.

Row-level security

Database hosted on Supabase PostgreSQL with RLS policies on all tables. Each organizer's data is isolated at the row level.

Edge hosting

Vercel edge network with serverless functions. Cloudflare for DNS and DDoS protection.

PCI by delegation

Payment data handled entirely by Stripe. Equaticket never sees raw card data; Stripe absorbs the PCI scope.

GDPR

Data erasure on request.

If one of your buyers requests deletion of their personal data under GDPR or a similar regulation, you can process the request directly from your audience dashboard. Erasure anonymizes the buyer's record across all their orders and tickets, permanently and immediately.

You are the data controller for your attendees. Equaticket does not accept data erasure requests directly from buyers.

For step-by-step instructions, see the GDPR Data Erasure guide →

Incidents

We communicate openly.

If there is a platform incident affecting service, we publish updates at equaticket.com/status. Organizers on paid plans receive email notifications for incidents that affect their account.

Infrastructure you can trust.

Flat subscription. No data monetization. Your audience stays yours.

Start free · No card required About Equaticket