Privacy Policy

SOS SEATS is a personal, non-commercial test project run by Michael Johnson, who is the data controller for the data described here. Contact: sosj001@duck.com.

• Attendees: your email or phone number, username, tickets, orders, the mobile money number you pay with, and ticket transfers.
• Organisers: the above, plus your events, event images, and the mobile money numbers you withdraw to (with the withdrawal amounts and fees).
• Door staff: login contact details and the tickets they scan.
• Guests added by organisers: the name and contact details the organiser enters.
• Wallet address: only if you linked a Solana wallet in the past. Wallet sign-in is currently switched off.
• Public information: event listings, including the organiser's name and event images, are visible to anyone.
• Transfers: when a ticket is transferred, the sender and recipient see each other's username.
• Technical logs: our hosting provider (Netlify) and Supabase record IP addresses, device and browser details, and sign-in events in their security logs. SOS SEATS does not store these itself.

We do not use analytics, ad tracking or profiling.

• Contract (GDPR Article 6(1)(b)): running your account, tickets, payments, payouts and ticket scanning.
• Legitimate interests (Article 6(1)(f)): keeping the service secure, preventing fraud and stopping ticket misuse.
• Legal obligation (Article 6(1)(c)): where the law requires us to keep or share data.
• Consent (Article 6(1)(a)): where we ask for it. You can withdraw it at any time.

• The organiser of each event you attend: your name or username, ticket and check-in details.
• That event's door staff: the result of scanning your ticket.
• Our service providers (processors): Supabase (database and login) and Netlify (website hosting).
• Payment providers: Monime and the mobile money operators process payments for us. They are also independent controllers for their own legal duties, such as anti-money-laundering checks, under their own privacy policies.
• The Solana network: nothing is sent while wallet features are off.
• Social sites: only when you click a share link.
• Authorities: if the law requires it.

We never sell your data and we don't use it for advertising.

Organisers are independent controllers for their guest lists, their staff contacts and any data they collect themselves. Sensitive data (GDPR Article 9, for example about health or religion) may only be added with the guest's explicit consent, and the organiser is responsible for getting it.

Our database is hosted by Supabase in West US (North California), and Netlify may serve the site from other countries. Where data leaves the EU or UK, both providers use Standard Contractual Clauses where they apply.

• Account data: while your account is active. If you ask us to delete it, we do so within 30 days.
• Order, payment and payout records: 24 months after the event, for disputes and accounting.
• Revoked door staff: deactivated straight away, and deleted with the event's records.
• Login cookie: up to 7 days. sessionStorage clears when you close the tab.
• Security logs: as long as each provider keeps them, usually days to weeks.
• When the pilot ends: everything is deleted within 90 days, except anything the law requires us to keep.

We take reasonable measures to protect your data, including hashed passwords, signed httpOnly login cookies, server-side checks on payments and withdrawals, and database access limited to our server. No system is perfectly secure, and this is a test project. If a breach affects you, we will tell you and the authorities where the law requires.

You need a contact (phone number or email) and a username to use SOS SEATS. Without them you can't buy, claim or scan tickets. We make no automated decisions about you and do no profiling.

Under the GDPR, the UK GDPR and any applicable local law, you have the right to:

• access the data we hold about you;
• correct it;
• have it erased;
• restrict how we use it;
• receive it in a portable format;
• object to how we use it;
• withdraw consent at any time, where we rely on consent.

SOS SEATS doesn't have in-app account deletion or data export yet, so email sosj001@duck.com. We answer within 30 days after verifying your identity. You can also complain to your data protection authority.

SOS SEATS only uses storage that is strictly necessary for the service to work. There are no tracking, analytics or third-party cookies, so no cookie banner is needed.

Wallet features are switched off. If you used them in the past, any records on the Solana blockchain are public and permanent, and we cannot erase them.

SOS SEATS is not for anyone under 18. If we find that data belongs to someone under 18, we delete it.

We will post any changes to this policy on this page and update the effective date. For material changes, we will also tell you on the site. Questions or requests: sosj001@duck.com.