Privacy Policy

• Account details: your email address and, if you give it, your name.
• Orders and tickets: the events you buy for, ticket types, amounts, order codes, and whether a ticket was scanned at the door.
• Payment details: handled by Stripe. We receive the payment status and the last digits and brand of your card, never the full number.
• Organizer details: organization name, profile, team members and contact email. Identity and bank details for payouts are collected and held by Stripe, not by us.
• Device and usage: basic logs (IP address, browser, pages requested) to keep the service secure, and error reports when something breaks. We use your approximate location from your IP address to show events in your nearest city, and your device's precise location only if you tap “Use my current location”; neither is stored with your account.
• On your device: your chosen city and saved events in your browser's local storage, your basket during checkout, and a sign-in cookie. We don't use advertising cookies.
• Visitor counts: to know how many people use Mela and which pages help them, we set one first-party cookie with a random ID and record the pages you view, the site that sent you, your approximate city and device type, and which “Get tickets” links you click. We don't store your IP address or browser details with it, don't share it, and use no third-party analytics. If your browser sends a Global Privacy Control signal, we don't set the cookie.
• Event emails: if you sign up for event emails, your email address and the city you chose. Every email has an unsubscribe link.

• To sell you tickets, send them to you, and let you in at the door.
• To send messages about your orders, such as confirmations, refunds, cancellations and event changes.
• To pay Organizers and handle refunds and disputes.
• To prevent fraud and abuse, and to fix problems.
• To count clicks on “Get tickets” for events sold elsewhere (not linked to who you are).
• To show events in your city and improve Mela.

• The Organizer of an event you buy for receives your name, email, tickets and check-in status so they can run the event. They must use it only for that purpose and follow privacy law.
• Service providers that run parts of Mela for us: Stripe (payments and payouts), Supabase (database and sign-in), Resend (email), Vercel (hosting) and Sentry (error reports).
• Authorities when the law requires it, or to protect people from fraud or harm.

We don't sell your personal information, and we don't share it for cross-context behavioural advertising.

Order and payment records are kept for as long as tax and accounting law requires (generally up to 7 years). Other account data is deleted when you ask us to close your account.

You can ask to see, correct, download or delete your personal information, and opt out of any marketing email at any time. California residents have these rights under the CCPA, and Canadian residents under PIPEDA and provincial law. We won't treat you differently for using them.

To make a request, email privacy@melaa.co from the address on your account. We'll respond within 30 days.

Data is encrypted in transit and at rest and stored in the United States. Access is limited to people who need it to run Mela. If you're in Canada, your information may be processed in the United States and be subject to US law.

Mela isn't for children under 16, and we don't knowingly collect their personal information. A parent can buy family tickets on their own account.

If we change this policy in a way that matters, we'll tell you by email or on the site before it takes effect.