Privacy policy

What we collect

When you buy a ticket, we collect:

• Your name and email address, given to us at checkout so we can email the QR code and any updates about the event.
• Your payment details, handled entirely by our PCI-DSS-compliant payment processor. Stubwave never sees, stores, or transmits your card number; the processor handles all of that on their side. We only see a transaction ID and the amount you paid.
• Your IP address, automatically captured by our hosting provider in standard request logs, and used for rate-limiting (preventing abuse of checkout and email re-send endpoints). Not used for tracking or profiling.

If you're an organizer or door-staff user, we also store your email address against an allowlist so you can sign in via a one-time magic link.

If you subscribe to our email updates

If you sign up via the newsletter form in our footer, we store your email address (plus, optionally, your name) so we can email you when there's a new show on sale. You can unsubscribe in one click from any email we send, or via the link in the welcome email; unsubscribing takes effect immediately and we won't send you newsletter content again.

Subscriber data is stored alongside the rest of our application data and is never shared with third parties or used for any purpose beyond emailing you about Stubwave shows. Per Canadian Anti-Spam Legislation (CASL), every newsletter email we send identifies Stubwave as the sender and carries a working unsubscribe link.

How we use it

• To process your order and issue your ticket
• To email your confirmation, ticket QR, refund notices, and (if you transfer your ticket) the transfer notification
• To verify entry at the door when door staff scan your QR
• To rate-limit endpoints that send email or initiate payment charges, so the platform stays healthy
• To investigate fraud, abuse, or buyer / organizer disputes if they come up

We don't sell your data. We don't use it to send marketing emails. We don't share it with advertisers.

Who we share data with

To run the platform, your data passes through a small number of service providers (“subprocessors”). Each one handles only what they need to do their job:

• Our payment processor handles your card number and billing details. They're PCI-DSS Level 1 certified, which is the highest tier of payment-card security compliance. Stubwave never sees, stores, or transmits the card number itself.
• Our email delivery provider transmits the transactional emails we send you (confirmation, ticket, refund, transfer, newsletter). They receive your email address and the content of each message.
• Our hosting and database provider stores your name, email, ticket record, and any authentication state required for organizer / door-staff access.
• Our inbound-email forwarder relays mail addressed to hello@stubwave.com and tickets@stubwave.com to our actual mailbox. They see message metadata in transit.

For our current subprocessor names, email hello@stubwave.com.

Cookies and tracking

We don't use analytics, ad-tracking, or third-party cookies. The only cookies stubwave.com sets are essential ones used by our auth system to keep you signed in after a magic link. Questions? Email hello@stubwave.com.

How long we keep it

Ticket and order records are retained indefinitely. We need them for refund processing (which can happen long after the event), accounting, and resolving disputes. Our payment processor also requires us to retain transaction records for compliance.

Server request logs roll off after 30 days. Rate-limit counters expire as soon as the limit window passes (minutes to hours).

Your rights

Under Canadian privacy law (PIPEDA) and equivalent laws in your jurisdiction, you have the right to:

• Request a copy of the personal data we hold about you
• Ask us to correct it if anything is wrong
• Ask us to delete it (with some limits: we can't delete records we need for accounting / refund processing for past purchases)
• Object to processing, or withdraw consent for anything optional

Email hello@stubwave.com with the request and a way to verify it's you (e.g., the email address on a recent order). We'll respond within 30 days.

Children

Stubwave is not directed at children under 13, and we don't knowingly collect their data. If you believe a child has bought a ticket without parental consent, email us and we'll delete the account and refund the order.

International users

Stubwave operates out of Canada. Our database and most of our subprocessors host data in the United States. If you're buying a ticket from outside Canada or the US, your personal data crosses borders to reach us. By using Stubwave, you consent to that transfer.

Changes to this policy

If we change how we handle data, we'll update this page and bump the “last updated” date at the top. For material changes (e.g., adding a new subprocessor), we may also send a notice to email addresses on file at the time of the change.

Contact

Privacy questions, data requests, or anything else — hello@stubwave.com. See the contact page for the full set of ways to reach us.