Privacy

Last updated 5 October 2026. Operated by Needs your details — set entity in src/lib/legal.ts.

What Tikit stores

Tikit is a ticketing platform. It stores what it needs to sell a ticket and let someone through a door, in its own database:

• Buyers: your name, mobile number and email from checkout; your orders and tickets, including the seat on each ticket for a seated event; which tracking link, if any, you arrived from; and whether and when each ticket was scanned at the door. If you use Find my tickets, an account is created under your email with no password. If you pass a ticket to someone else, the name, email address and mobile number you give for them are stored with that ticket, together with the email address it came from.
• Answers an organiser asks for: when an organiser asks for them at checkout, answers to their questions, ticket holders' names and emails, dates of birth, ID or passport numbers (encrypted, and shown to the organiser only as the last four digits), your acceptance of their terms or waiver with the name you typed to sign it, team names, and registrations. ID and passport numbers, dates of birth and answers the organiser marks private are deleted 30 days after the event, and registrations that were not approved go then too.
• Promo codes: if you use one at checkout, the code is kept on your order so the organiser can see which codes were used and what they took off.
• Organisers: your name, email, mobile number and a password hash; your organiser profile and logo; your events, ticket tiers and cover images; your bank details (account number, holder and bank) for payouts; your entity type and company registration number; the name of the director signing and the last four digits of their ID number (never the full number); and the results of verification checks.
• Everyone with an account: a session cookie so you stay signed in, the device and IP address of each session (shown to you under Settings → Security), notification preferences, and an activity log of things you did.
• Door staff: a name, a hashed PIN, and a log of every scan they made.
• Team members: the email address an organiser invites, the role they were given, who invited them, and when they joined.
• Sign-in security: if you turn on two-step sign-in, a secret for your authenticator app (encrypted) and recovery codes (stored only as a one-way hash); if you add a passkey, its public key; and, if you add a mobile number to sign in with a texted code, that number. A record of each change to these is kept and emailed to you.
• Recycled mobile numbers: South African numbers are given to new people when they lapse. A tickets account that signed in with a texted code is tied to that number, so if you give up a number, move your tickets to an email address first. A new holder of the number who verifies it can see orders whose tickets were texted or sent on WhatsApp to it.
• Connected apps: which AI assistants you authorised, and a log of every call they made as you, reads included.
• Signing in with Google: if you choose Continue with Google, Tikit stores the name, email address and profile picture Google shares, together with the sign-in token Google issues for that link, and nothing else from your Google account. Google sees that you signed in to Tikit. You can disconnect Google under Settings → Security once you have a password.

What it does not store

Tikit never sees or stores your card number; payment happens on the payment provider's pages. The full ID number submitted for verification is passed to the verification partner and not kept.

Who else sees it

• The organiser of an event you buy tickets for sees your name, email and mobile number, so they can run the event and contact you about it, and the answers you give to their checkout questions. Door staff see only the answers the organiser marks for the door, and never an answer marked private.
• People an organiser adds to their team can see that organiser's events, orders and buyers' contact details according to their role: a manager sees orders and can refund them; door staff see only the attendee list and the scans.
• An organiser that co-hosts an event can see its buyers' names, email addresses and mobile numbers on the Orders and Attendees pages when the organiser that owns the event shares that access with them. They can't export the lists, refund, or see payouts.
• The person you pass a ticket to sees your first name in the email that brings them the ticket, and the organiser sees their name and contact details on the attendee list. If they pass it on again, the next person sees their name, not yours.
• Stitch or Paystack processes payments, refunds, organiser payouts and bank account verification — whichever the operator has connected. Resend delivers email. Meta (WhatsApp) and SMSPortal (SMS) deliver tickets to your phone. Inngest runs background work such as sending tickets and scheduling payouts. Smile ID checks company registrations against CIPC and verifies directors' identity numbers and, when an organiser sends identity documents, checks the document, a selfie and public screening lists. Each receives only what that job needs. Until a partner is connected, a built-in stand-in records the message or check instead of sending it anywhere.
• An organiser's email marketing tool. If an organiser connects Mailchimp, Brevo or ActiveCampaign, the name and email of people who agreed to hear from that organiser are sent there, and are unsubscribed there when they withdraw.
• Google receives the words an organiser writes to describe an event, along with its title, venue, city and dates, when they ask Tikit to draw a cover image for it. Nothing a buyer enters is ever sent there, and an organiser who uploads their own artwork sends nothing at all.
• An AI assistant you connect (such as Claude) can read your organiser data and add ticket tiers on your behalf, within the permissions you approved. You can see and revoke this under Settings → Connected apps.
• Sentry receives technical error reports, when the operator has switched error tracking on, with emails, phone numbers, ticket codes and sign-in links removed first.
• Hosting: the database and uploaded images live with the hosting provider the operator has chosen.

Tikit does not sell personal information and does not run advertising.

Cookies

Tikit sets a session cookie when you sign in or use Find my tickets. Choosing tickets sets one more, called tikit_hold, which holds them for you for fifteen minutes while you fill in your details; it carries a random reference and nothing about you, and it expires on its own. Your light or dark mode choice is kept in your browser's own storage, not in a cookie. Tikit itself loads no analytics or advertising tags. An organiser can add their own to their event pages; those load only if you allow them, and choosing sets one more cookie, named tikit_tc_ followed by a code for that organiser, which remembers your answer for 180 days (see Ad and analytics tags below).

If you open a rep’s or a friend’s share link, Tikit sets tikit_ref, which remembers the link’s code and when you clicked, for up to 90 days, so the right person is credited if you buy. Sharing your own link sets tikit_own_refs, so your own purchases are not credited to you. An organiser’s referral link sets tikit_oref for 30 days. None of them hold your name or contact details.

Ad and analytics tags

• Visit counts: Tikit counts visits to event pages itself, without cookies or anything stored on your device. Each visit is counted with a code made from your IP address, browser and the event that changes every day and can't be linked across days or events. The IP address itself is never stored. Visits are kept for 35 days, then only daily totals remain. With an order Tikit keeps the tracking link, campaign tags, the website you came from, your device type and province.
• Organisers' tags: an organiser may add Meta Pixel, TikTok Pixel, Google Analytics or Google Tag Manager. They load only after you choose Allow in the banner on that organiser's pages, separately for each organiser. They run in a separate frame whose address carries nothing about you or your order. You can change your answer with Tracking choices at the bottom of the page.
• Purchases sent from Tikit's servers: only if you agreed to hear from that organiser, Tikit sends your purchase (value, tickets and a reference that can't be traced back to your order) to their Meta, TikTok or Google account, with your email address and mobile number turned into a one-way SHA-256 code first, and the identifiers those tags set if you allowed them.
• Unfinished checkouts: if you start buying but don't finish, and you had already agreed to hear from that organiser, they may send you one reminder email. Contact details from an unfinished checkout are never shown to an organiser you haven't agreed to hear from.
• Meta, TikTok and Google handle what they receive under their own privacy policies.

Emails and messages

• Practical messages (tickets, receipts, refunds, changes to an event and reminders) are sent because you hold a ticket. They can't be unsubscribed from by email, although the WhatsApp and SMS switch stops reminders and other practical messages on those channels. Delivery of the tickets you bought is an essential message: the switch does not affect it, and it goes by the channels you chose at checkout.
• Notifications on your phone or in your browser work only if you turn them on. We keep a notification token for each phone or browser you turn them on for, so we can reach it. It is removed when you sign out, when you turn notifications off and when you delete your data, and it is shared only with the services that deliver notifications to your device (Google and Apple for the app, and your browser's own push service for the website).
• Marketing is sent only after you tick a box, which starts unticked, for a named organiser or for Tikit. We record the exact words you saw and the time.
• Every email links to a page where you change this without a password. Marketing email also carries a one-click unsubscribe.
• An address that bounces or reports spam stops getting anything but ticket emails until support clears it.
• You can export or delete your data, with a code we email you, at tikit.co.za/preferences.
• Organisers can turn sale alerts, the daily digest and payout updates on or off under Settings → Notifications, and choose who on their team gets them under Messaging.

Your data

• Download it: Settings → Account → Download my data returns everything you created as a file.
• Correct it: your name, phone and photo under Settings → Profile; your organiser profile and bank details under Organiser profile; your email under Settings → Account.
• Delete it: Settings → Account → Delete account. Deletion is immediate and permanent once you confirm the emailed link. It removes your sign-in, sessions and connected apps and, for an organiser, the draft events, every uploaded image, and the contact, bank, verification and ID details. Tickets already sold or bought are kept, with the organiser name on them and the event they are for, because the other party to those tickets still needs them; the activity log keeps an anonymised line so that "who cancelled this event" still has an answer. An organiser cannot delete while buyers hold tickets for an event that hasn't happened yet, while money is owed either way, or while team members are still attached.

How long Tikit keeps it

• Buyers' names, email addresses and phone numbers on orders, tickets, transfers, registrations, guest lists and messages are replaced with "Erased" 3 years after the event ends.
• Answers to checkout questions, attendee details, team entries and signed waivers are deleted then too.
• Orders, refunds, payouts and Tikit's ledger are kept with their amounts for at least 5 years; after 3 years they no longer say who placed the order.
• Tax invoices are kept exactly as issued for 5 years.
• The text of emails Tikit sent, and payment providers' notifications, are deleted after 12 months; door scan logs 12 months after the event.
• ID and passport numbers, dates of birth and private answers: 30 days after the event.
• A nightly job does this. Tikit can also erase the personal details on a single order on request: write to Needs your details — set contactEmail in src/lib/legal.ts.
• Organisers' verification documents are kept while the organiser uses Tikit.

Security

Everything travels over HTTPS. Passwords are stored as hashes. Door-staff PINs are stored as hashes. Ticket QR codes are signed so they cannot be forged.

POPIA

Tikit handles personal information under the Protection of Personal Information Act, 2013 (POPIA).

• Information Officer: Needs your details — set informationOfficer in src/lib/legal-popia.ts Needs your details — set informationOfficerEmail in src/lib/legal-popia.ts
• Information Regulator: Needs your details — set informationRegulator in src/lib/legal-popia.ts
• If there is a data breach: Needs your details — set breachProcess in src/lib/legal-popia.ts
• Organisers and Tikit: Needs your details — set operatorAgreement in src/lib/legal-popia.ts

Contact

Questions or requests about your data: Needs your details — set contactEmail in src/lib/legal.ts.