Privacy Policy

When you make an account: your email address, your name and your phone number, and we ask for your city and country. If you sign up with Google, we ask for your phone number when you first pay for tickets. A profile picture is optional.

Your phone number is used to reach you about a show you have tickets for. We only text you about other shows if you tick the box to hear about shows by email and text, and every one of those texts lets you reply STOP to end them. We keep a record of that choice: when and where you said yes, the number it was for, and the words you were shown. A yes is for the number you had then: if you change your number, we won't text the new one about other shows. Event organizers don't see your number.

When you buy a ticket: what you bought and when, the amount, and the billing details your card requires. We never see or store your card number — that goes directly to Stripe, who are certified to hold it and we are not.

When you use the site: which events you viewed, so organizers can see how many people looked at theirs, and technical details like browser and approximate location when something crashes. Crash reports have query strings stripped before they leave your browser.

At the door: the time your ticket was scanned, and by which staff member.

Who you follow: the artists, venues and organizers you follow, so we can tell you about their new shows. Nobody else can see who you follow.

When we email you: what we sent and when, and whether it was delivered, bounced or reported as spam. For emails about shows (not tickets or receipts), we also record whether you opened it and which links you clicked, using a tracking image and tracked links, so we can tell which emails are useful and stop sending ones that aren't. We keep a record of your email choices: when and where you said yes or no, and the words you were shown.

To provide what you asked for: an account, a ticket, entry to an event. To meet legal obligations, principally tax and financial record keeping. And for our legitimate interest in keeping the platform working and free of fraud.

Emails about shows go to you if you said yes, if you follow the artist, venue or organizer they're about, if you bought tickets from us in the last two years, or if you joined a waitlist or started buying tickets in the last six months, as Canada's anti-spam law allows. Every one says why you got it and has a link to stop them, which works straight away. You can turn each kind off in your account.

We do not sell your information to anybody, and we don't use it to pick who sees our ads. The advertising tools on KOLA, all described under Cookies below, are Google Ads learning which of our own ads led an organizer to sign up, and an organizer's own Meta Pixel and Google tags on their own events.

Event organizers see the name and email address of people who bought tickets to their own events, plus what was bought and whether it was scanned. They need this to run a door and to contact you if the show moves. They cannot see your activity anywhere else on KOLA, and one organizer cannot see another's buyers.

An organizer's own Klaviyo. An organizer can connect their Klaviyo account, their email marketing service. If they do, we send it the name and email of everyone who buys tickets to their events, and what they bought. Never your phone number. From there the organizer is responsible for it under their own privacy policy, and the unsubscribe link in their emails is how you stop them. If you unsubscribe from an organizer's emails on KOLA, we pass that on to their Klaviyo too.

Door staff see the guest list for the event they are working, and nothing else — no orders, no payments, no other events.

Our suppliers, who process data on our behalf and are not allowed to use it for their own purposes: Stripe (payments), Supabase (database and hosting), Resend (email delivery) and Sentry (crash reports). Stripe and Sentry are in the United States; Supabase and Resend process in the regions we've configured. Transfers rely on the standard contractual protections those providers offer.

We will disclose information if the law requires it, and we'll tell you unless we're forbidden to.

Your session is stored in your own browser so you stay logged in, along with which organizer you were last working as. Stripe sets its own cookies on the checkout page to spot card fraud.

We also use Google Analytics to count visits. Where the law says we have to ask first — Europe, the UK and Quebec — nothing is loaded until you say yes, and saying no means nothing is set and nothing is sent. Everywhere else it runs unless you turn it off, which you can do below. If your browser sends a “do not track me” signal we treat that as a no and never ask.

Either way, what it tells us is which pages were opened, roughly where from, and what kind of device — never your name, and never tied to your KOLA account. KOLA advertises on Google, and when somebody signs up to sell tickets on KOLA, Google Analytics tells our Google Ads account, so we can see which of our ads worked. That is a count, not a profile: we have not switched on Google's ad personalisation, so none of this is used to follow you to other sites or to choose the ads you see.

Organizers' own analytics and ad tags. An organizer can add their Meta (Facebook and Instagram) Pixel, their Google Analytics and their Google Ads to their own events, to count visits and see which of their ads sold tickets. Where they have, and the same choice is on, those services are told when you view that organizer's event page, choose a ticket, start checkout and buy: the show, the tickets, the price and an order number. Never your name, email or phone number, and never anything about the rest of KOLA or other organizers' events. Meta and Google set their own cookies to recognise your browser and use what they receive under their own privacy policies, which for Meta can include showing you ads. We ask Google not to use it for personalised ads. It follows the same rules as the visit counting: asked first where the law says so, on unless you turn it off everywhere else, and never with a “do not track me” signal or in the iPhone app.

That’s all of it. Nothing sold to anybody. (Opens and clicks in emails about shows are recorded as described above, not with cookies.) You can change your mind whenever you like, right here, and turning it off removes both kinds of cookie:

Order and ticket records are kept for seven years, because financial records have to be. Event view counts are aggregated and not tied to you after the event has passed.

Your profile is kept until you delete your account, which you can do yourself from your account settings at any time.

Account deletion removes your profile, your name, your contact details and your login. It cannot remove the financial record of a purchase, which we are required to keep — but that record is reduced to the transaction itself.

If you hold tickets to events that haven't happened yet, deleting your account cancels them and returns the seats to sale, without a refund. We warn you before you confirm. See the Refund Policy if you want your money back first.

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to how we're using it. Email support@kola.fm and we'll respond within 30 days.

If you're in Canada and unhappy with our response, you can complain to the Office of the Privacy Commissioner of Canada. If you're in the UK or EU, to your local supervisory authority.

KOLA isn't intended for children. We don't knowingly collect information from anybody under 16, and we'll delete it if we find we have.

If we change this policy in a way that materially affects you, we'll email you rather than quietly updating the date at the top.

Questions, or a request about your data: support@kola.fm.