Privacy Policy

When you make an account: your email address, and your name if you give one. Optionally a phone number, a city and a profile picture.

When you buy a ticket: what you bought and when, the amount, and the billing details your card requires. We never see or store your card number — that goes directly to Stripe, who are certified to hold it and we are not.

When you use the site: which events you viewed, so organisers can see how many people looked at theirs, and technical details like browser and approximate location when something crashes. Crash reports have query strings stripped before they leave your browser.

At the door: the time your ticket was scanned, and by which staff member.

To provide what you asked for: an account, a ticket, entry to an event. To meet legal obligations, principally tax and financial record keeping. And for our legitimate interest in keeping the platform working and free of fraud.

We do not use your information for advertising, and we do not sell it to anybody.

Event organisers see the name and email address of people who bought tickets to their own events, plus what was bought and whether it was scanned. They need this to run a door and to contact you if the show moves. They cannot see your activity anywhere else on KOLA, and one organiser cannot see another's buyers.

Door staff see the guest list for the event they are working, and nothing else — no orders, no payments, no other events.

Our suppliers, who process data on our behalf and are not allowed to use it for their own purposes: Stripe (payments), Supabase (database and hosting), Resend (email delivery) and Sentry (crash reports). Stripe and Sentry are in the United States; Supabase and Resend process in the regions we've configured. Transfers rely on the standard contractual protections those providers offer.

We will disclose information if the law requires it, and we'll tell you unless we're forbidden to.

We use cookies to keep you logged in and to remember which organiser you were last working as. That's it — no advertising cookies, no third-party trackers, and therefore no consent banner to click through.

Order and ticket records are kept for seven years, because financial records have to be. Event view counts are aggregated and not tied to you after the event has passed.

Your profile is kept until you delete your account, which you can do yourself from your account settings at any time.

Account deletion removes your profile, your name, your contact details and your login. It cannot remove the financial record of a purchase, which we are required to keep — but that record is reduced to the transaction itself.

If you hold tickets to events that haven't happened yet, deleting your account cancels them and returns the seats to sale, without a refund. We warn you before you confirm. See the Refund Policy if you want your money back first.

You can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, or object to how we're using it. Email support@kola.fm and we'll respond within 30 days.

If you're in Canada and unhappy with our response, you can complain to the Office of the Privacy Commissioner of Canada. If you're in the UK or EU, to your local supervisory authority.

KOLA isn't intended for children. We don't knowingly collect information from anybody under 16, and we'll delete it if we find we have.

If we change this policy in a way that materially affects you, we'll email you rather than quietly updating the date at the top.

Questions, or a request about your data: support@kola.fm.