GDPR Compliance

TickAtlas is operated by RAZLabs LLC, a limited liability company registered in the State of Delaware, United States, which is the data controller for the purposes of this policy. RAZLabs LLC is committed to protecting the personal data of users in the European Economic Area (EEA) in accordance with the General Data Protection Regulation (GDPR). This page explains what data we collect, why we collect it, how long we keep it, and what rights you have over it.

1. Data We Collect

• Account information — Name, email address, and company name (optional), collected at registration.
• Payment information — Subscription plan and transaction records processed via NOWPayments. We do not store raw card data.
• API usage logs — Endpoint accessed, timestamp, response time, HTTP status, and the API key identifier (not the key itself).
• IP addresses — Logged per request for security, abuse prevention, and rate limiting.
• Session data — A session token stored in an httpOnly cookie to authenticate your dashboard session.
• Website usage and advertising measurement — Only if you accept cookies: page views and interactions on our website (Google Analytics), and page-view events used to measure our advertising (Taboola).

2. Why We Collect It

3. Data Retention

• API usage logs — Retained for the lifetime of your account. We do not operate a fixed deletion schedule for usage logs, and retention does not vary by plan. You can request erasure at any time under your right to deletion, below.
• Payment records — Retained for 7 years for legal and tax compliance purposes.
• Account data — Retained for the lifetime of your account. Closing your account does not by itself erase your personal data: to have it erased, email [email protected] and we will process the request within 30 days, unless a legal hold applies.
• Session data — Expires after inactivity or explicit logout.

4. Your Rights

Under GDPR, you have the following rights. To exercise any of them, email [email protected]. We will respond within 30 days.

• Access — Request a copy of the personal data we hold about you. A JSON export of your usage data is available via the dashboard.
• Rectification — Correct inaccurate or incomplete data via your dashboard profile settings, or by contacting us.
• Erasure — Request deletion of your account and associated personal data. Contact support to initiate. Payment records may be retained for legal compliance.
• Portability — Receive your data in a structured, machine-readable format (JSON). Available on request or via the dashboard export feature.
• Restriction — Ask us to pause processing of your data while a dispute is resolved.
• Objection — Object to processing based on legitimate interests (e.g. API usage analytics). We will stop unless we can demonstrate compelling grounds.
• Withdraw consent — Where processing is based on consent, you may withdraw at any time without affecting prior lawful processing. For cookies, clear the claw-consent cookie in your browser; the cookie banner then asks again.

You also have the right to lodge a complaint with your local data protection authority.

5. Data Processing Location

All data we store is processed and stored on our production server hosted by OVH in Gravelines, France (EU). We do not transfer personal data outside the EEA except where third-party processors listed below operate internationally under Standard Contractual Clauses or equivalent safeguards. If you accept cookies, your browser also sends website usage data to Google Analytics and page-view data to Taboola, which may process it outside the EEA (see section 6).

6. Third-Party Processors

We share data with the following sub-processors. Google Analytics receives data only if you accept cookies; the others only to the extent necessary to deliver the service:

Taboola receives page-view events, browser and device data and its cookie identifier directly from your browser, only if you accept cookies, so that we can measure our advertising. Taboola is not our processor: it acts as an independent controller of that data under Taboola's privacy policy.

We do not sell personal data to any third party, ever.

7. Data Security

• Passwords — Hashed with bcrypt before storage. We never store plaintext passwords.
• API keys — Stored as SHA-256 hashes. The raw key is only shown once at creation.
• Transport — All traffic is HTTPS-only with HSTS enforced. HTTP requests are redirected.
• Sessions — Dashboard sessions use httpOnly, Secure, SameSite cookies with automatic expiry.
• Access control — Internal admin access requires separate credentials and is IP-restricted.

For a full overview of our security practices, see our Security page.

8. Cookies

Analytics (Google Analytics) and advertising-measurement (Taboola) cookies are set only after you click Accept in the cookie banner. If you reject, neither is loaded.

9. Contact & Data Requests

For all data-related requests — access, erasure, portability, objection — contact us at:

[email protected]

We will acknowledge your request within 72 hours and respond in full within 30 days.