Privacy Policy

Last updated: 7 November 2026

1. Information we collect

When you create an account, we collect your name, email address, phone number (optional), and a securely hashed password — we never store your password in plain text. If you sell tickets as an organizer, we also collect your organization name and bio if you add one.

When you buy a ticket, your mobile money payment is handled directly by our payment processor (iotec) — obitickets never sees or stores your mobile money PIN, and doesn't store your full mobile money account details beyond the phone number used for that order.

When you log in or sign up, we automatically record the date and time, your device type, browser, and operating system, and the city/country your connection appears to come from (resolved from your IP address via a third-party lookup) — used only for account activity monitoring and security, never for advertising. We don't keep the raw IP address itself.

2. How we use it

• To create and secure your account, and let you log in
• To process ticket purchases and deliver your tickets by email
• To show organizers their event sales and manage payouts
• To respond to support requests and refund claims
• To detect suspicious account activity (unusual login locations, for example)

3. Third-party services we use

We rely on a small number of trusted providers to run obitickets, each only receiving what they need to do their job:

• iotec — processes MTN Mobile Money and Airtel Money payments
• Resend — delivers transactional emails (your tickets, password resets)
• ioTec Messaging — texts your ticket code(s) to the phone number used at checkout; only that phone number and the ticket details are sent to it
• A QR code generation service — turns your ticket code into a scannable image; only the ticket code itself (not your name or email) is sent to it
• An IP geolocation lookup — resolves a login's approximate city/country for the security monitoring described above

We don't sell your information to anyone, and we don't use advertising trackers.

4. Cookies

obitickets uses one session cookie to keep you logged in, and a CSRF token to protect your forms from being submitted by another site on your behalf. We don't use tracking or advertising cookies.

5. How long we keep it

We keep your account and order history for as long as your account is active, since it's how you view past tickets and organizers track their sales. If you ask us to delete your account, we'll remove your personal details, keeping only what we're legally required to retain (such as financial records for tax purposes).

6. Your rights

You can review and update your account details anytime from your dashboard. To request a copy of your data or ask us to correct something, contact us. To delete your account and personal details, use the account deletion page — we confirm the request by email and complete it within 30 days. These rights apply on the website and in the obitickets app.

7. Security

Passwords are hashed, not stored as plain text. Payment details are handled entirely by our payment processor, never by obitickets directly. We use standard safeguards (HTTPS, access controls) to protect the data we do hold, though no system is ever 100% guaranteed secure.

8. Changes to this policy

If we make a material change to how we handle your data, we'll update this page with a new "last updated" date.

9. Contact

Questions about your privacy? Get in touch and we'll help.