Privacy Policy
This policy explains how TicketVault LLC ("TicketVault", "we", "us") collects, uses, shares and protects information in the TicketVault Dashboard and Broker Hub at dashboard.ticketvault.co (the "Service"). The Service is a private business tool used by TicketVault staff and by the ticket brokers we work with. It is not offered to the general public.
1. Information we collect
Account and profile information
Your username, first and last name, email address, role, and the broker companies you can access. You sign in with your TicketVault POS credentials. Your password is checked with TicketVault POS at sign-in and is not stored by the Service. If you turn on two-step login, we store an encrypted authenticator secret.
Business and order information
Order, inventory, invoice, payout and exception information from TicketVault POS and from ticket marketplaces, including customer names, emails and delivery details on ticket orders that brokers fulfil.
Financial account information received through Plaid
When a card or bank account owner chooses to connect an account in the Card Feeds feature, they sign in to their financial institution inside Plaid's window. With their permission, we receive from Plaid Inc.:
- the institution name, account name and type, and the last 4 digits of the account or card number;
- transactions: date, amount, currency, merchant or description, category and pending status;
- an access token that lets us refresh those transactions.
We do not receive or store full card or account numbers, CVVs, or online banking usernames or passwords. We use Plaid's Transactions product only.
Connected services you choose to link
If you connect Slack, we store a token that lets the Service search Slack as you, limited to conversations you can already see.
Security and usage logs
Sign-ins, failed sign-ins, pages opened, changes you make, IP address, browser type and the time of each event.
Cookies and browser storage
We use one strictly necessary session cookie to keep you signed in, and your browser's local storage for preferences such as light or dark theme. We do not use advertising or third-party analytics cookies.
2. How we use information
- To operate the Service: fulfil and track ticket orders, handle exceptions and chargebacks, and manage broker inventory and pricing.
- To reconcile card purchases against purchase orders and to calculate and pay broker payouts.
- To secure the Service: authenticate users, enforce access permissions, detect and investigate misuse, and keep audit records.
- To meet legal, tax and accounting obligations and to resolve disputes.
We do not sell or rent personal information, and we do not use it for advertising or profiling.
3. How we share information
We share information only as needed to run the Service, with:
- Service providers that host or process data for us under contract: Railway (hosting and database), Google Workspace (email and spreadsheets), Slack (internal alerts), Plaid (financial account connections) and GitHub (source code, which contains no customer data).
- Ticket marketplaces and TicketVault POS, to the extent needed to fulfil orders and payouts.
- Authorities or other parties when required by law, legal process, or to protect the rights, property or safety of TicketVault, our users or others.
- A successor in a merger, acquisition or sale of assets, subject to this policy.
4. Plaid
We use Plaid Inc. to connect financial accounts. By connecting an account, you authorize Plaid to collect data from your financial institution and share it with us as described above, and you agree to Plaid's processing of your information under the Plaid End User Privacy Policy. You can disconnect an account at any time: in the Service (Card Feeds → Disconnect, or by asking us) or through my.plaid.com. When an account is disconnected, we revoke its access at Plaid and delete its stored accounts and transactions.
5. How we protect information
- Encryption in transit with TLS 1.2 or higher on every connection to the Service and to Plaid.
- All financial account data we receive through Plaid (access tokens, transaction amounts, descriptions, merchants and categories, account names, last 4 digits and institution names) is encrypted at rest with AES-256-GCM, as are two-step login secrets. Encryption keys are kept only in our hosting provider's secret store, separate from the database.
- Role-based and company-based access controls, so users see only the screens and broker companies their job requires.
- Two-step login, failed-login lockout, session expiry after 2 hours of inactivity, and audit logging of sign-ins and permission changes.
- A written Information Security Policy covering access, secrets management, vulnerability management and incident response, reviewed at least once a year.
No system is perfectly secure. If we learn of a breach affecting your information, we will notify you as required by law.
6. How long we keep information
| Information | Kept for |
|---|---|
| Orders, sales, payouts and financial records | 7 years, for tax and accounting |
| Card and bank transactions received through Plaid | Up to 7 years, or until the account is disconnected, whichever comes first |
| Plaid access tokens | Until the account is disconnected, then revoked and deleted immediately |
| Security and change logs | 12 months (page-view logs 90 days) |
| User accounts | Disabled when access ends; deleted after 12 months |
We delete or anonymise information when it is no longer needed, unless the law requires us to keep it longer or it is subject to a legal hold.
7. Your choices and rights
You can ask us to access, correct or delete your personal information, or to disconnect a linked financial account, by emailing support@ticketvaultpos.com. We respond within 30 days and may need to verify your identity. We keep only what the law requires us to retain. Depending on where you live, you may have additional rights under state privacy laws; we will honour them as required, and we will not discriminate against you for exercising them.
8. Children
The Service is a business tool and is not directed to anyone under 18. We do not knowingly collect information from children.
9. Changes to this policy
We review this policy at least once a year. If we make material changes, we will update the effective date above and notify users in the Service.
10. Contact us
TicketVault LLC
Email: support@ticketvaultpos.com