Privacy policy
Last updated 5 October 2026.
Our Tickets Ltd, trading as Our Merch (“we”), is the controller of the personal data described here. Company number 17487560, registered office 22 The Nursery, Sutton Courtenay, Abingdon, OX14 4UA, United Kingdom. Contact: kob@ourmerch.app.
Fans buying merchandise at a show
We do not ask for your name, email address or phone number at the merch stand, and we do not use your purchase for marketing. Your card is read by a Stripe card reader and your card details go to Stripe, not to us. For each sale we keep the items, the amount, the time, and the card brand and last four digits, because the venue and the artist need accurate accounts and refunds need to be traced to the right payment.
Venues, artists and their teams
- Account holders (venue managers, artists, tour and merch managers): your email address, the venues or artists you belong to, and a record of when you sign in. Statements are emailed to these addresses.
- Till staff: a display name and a PIN, which we store only in scrambled (hashed) form, plus which staff member made each sale, count and refund.
- Count-in and count-out: the name given by the artist's representative and the staff member who confirmed each count.
- Venue verification: Stripe collects identity and business information from venues directly, for its own legal checks, under its own privacy policy. We do not see identity documents.
Why we use it, and our lawful basis
- To provide the service to venues and artists and settle each show accurately: performance of our contract with them, and our legitimate interest in running the service.
- To keep sales and settlement records: our legal obligation to keep accounting records.
- To keep the service secure (sign-in records, PIN lock-outs, an audit trail of counts and refunds): our legitimate interest in preventing fraud and misuse.
Who we share it with
We use these service providers to run Our Merch. Each processes data only to provide its service to us:
- Stripe (payments, card readers and venue verification) — stripe.com/gb/privacy
- Supabase (database and sign-in, hosted in London)
- Vercel (website and app hosting)
- Resend (sending sign-in codes and statements by email)
- Google Workspace (our own email)
Sales and statement details are shared with the venue that made the sale and the artist whose merchandise was sold. Some of our providers are based in, or may access data from, the United States. Where data leaves the UK, it is protected by the UK's adequacy arrangements or by the UK International Data Transfer Addendum to the standard contractual clauses.
How long we keep it
Sales, counts and settlement records are kept for six years after the end of the financial year they relate to, as accounting rules require. Account details are kept while the account is active and deleted within twelve months of it closing, unless we must keep them longer by law.
Cookies
Our website uses only the cookies needed to keep you signed in to your account. We do not use advertising or analytics cookies.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to how we use it, or ask us to restrict it. Email kob@ourmerch.app. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.