Legal
Privacy Policy
Last updated 16 October 2026
The short version
- We collect only what we need to run your account, bill you and keep the Service secure.
- We never see your card number. Stripe handles payments.
- We use one essential cookie to keep you signed in. No advertising or tracking cookies.
- We don’t sell your data or use it for advertising.
- You can ask for a copy of your data, or for it to be corrected or deleted, at [email protected].
1. Who we are
TickFeed is operated by the sole trader who owns TickFeed, a sole trader in the United Kingdom trading as TickFeed. We are the controller of the personal data described here, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our postal address is available on request. Contact: [email protected].
2. What we collect
| Type | What it includes | Where it comes from |
|---|---|---|
| Account | Email address and whether you’ve confirmed it, password (stored only as a one-way scrypt hash, never in readable form), chosen currency, account status, sign-in session records. One-time email codes and password-reset links, stored only as hashes and valid for at most an hour. | You, when you sign up and sign in |
| API keys | Key names you choose, the first few characters of each key, creation and revocation dates. Keys themselves are stored only as a one-way hash. | You, in your dashboard |
| Billing | Your balance and its history (top-ups, charges), invoices, and the Stripe customer reference. For tax and invoices, Stripe collects your billing name, address and, if you give one, a business tax ID, and shares the result with us. | You, through Stripe Checkout |
| Usage | For each API or MCP request: which key made it, the time, the endpoint path, the result status and response time, and the amount charged. | Generated when you use the Service |
| Security | Records of failed sign-in attempts for an email address (kept for at most 24 hours). Your IP address is used briefly, in memory, to rate-limit requests and sign-ups; we don’t store it. | Generated when you use the Service |
| Support | Support tickets you open in your dashboard (subject, category, messages) and our replies, plus any emails you send us. | You |
We don’t receive or store your full card number, card security code or bank details. Those go directly to Stripe.
3. How and why we use it
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating and running your account, authenticating requests, providing the data you ask for | Contract |
| Charging requests to your balance, processing top-ups, issuing invoices, handling refunds | Contract |
| Calculating and collecting tax, and keeping accounting and tax records | Legal obligation |
| Protecting the Service and your account: rate limiting, preventing fraud and abuse, investigating problems | Legitimate interests (keeping the Service secure and available) |
| Understanding overall usage to improve reliability and plan capacity | Legitimate interests (improving the Service) |
| Sending service emails: email confirmation codes, password resets, payment receipts, low-balance alerts and security notices (such as a new API key or a password change) | Contract / legitimate interests (account security) |
| Telling you about important changes to the Service, prices or these policies | Contract / legitimate interests |
We only send service emails. We don’t send marketing emails unless you’ve opted in, and the emails we send don’t track opens or clicks.
We don’t sell personal data, use it for advertising, or make decisions about you based solely on automated processing that have legal or similarly significant effects. Declining a request because your balance is too low isn’t such a decision: it follows directly from the prepaid terms you agreed to.
4. Cookies
We use a single cookie, tf_session, to keep you signed in to your dashboard. It is strictly necessary, so it doesn’t need consent. It lasts up to 14 days, or until you sign out. We use no analytics, advertising or tracking cookies. Stripe sets its own cookies on its checkout pages to process payments and prevent fraud; see Stripe’s privacy policy.
5. Who we share it with
We share personal data only with service providers who help us run TickFeed, under contracts that require them to protect it:
| Provider | What for | Data involved |
|---|---|---|
| Stripe | Payments, invoices, tax calculation | Email, billing details, tax ID, payment and invoice records |
| Resend | Delivering our service emails | Your email address and the content of the email |
| Cloudflare | Network delivery, security and DNS for tickfeed.pro | IP address and request metadata as traffic passes through its network |
| Google Fonts, jsDelivr, cdnjs | Delivering fonts and page scripts to your browser | Your IP address and browser details when a page loads |
We may also disclose data if the law requires it, to protect our rights or users’ safety, or to a buyer if the business is sold (in which case this policy continues to apply).
6. International transfers
Some of our providers process data outside the UK, including in the United States. Where they do, the transfer is covered by UK adequacy regulations (including the UK–US data bridge for certified companies) or by the UK International Data Transfer Agreement or Addendum, as appropriate.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account details and API key records | While your account is open. Deleted within 30 days of closure, except as below. |
| Balance history, top-ups, invoices and other financial records | 6 years after the end of the financial year they relate to, as UK tax law requires |
| API request logs | 13 months, then deleted automatically |
| Sign-in sessions | Until they expire (up to 14 days) or you sign out |
| Failed sign-in records | 24 hours |
| Support tickets and correspondence | Up to 2 years after the ticket is closed or resolved, then deleted automatically |
Database backups are kept for a short rolling period, typically two weeks, and then overwritten.
8. Security
We protect your data with measures including: passwords hashed with scrypt; API keys and session tokens stored only as hashes; encrypted HTTPS connections; protection against cross-site request forgery; sign-in rate limits and lockouts; and administrative access restricted to the operator’s own server. No system is perfectly secure. If a breach affects your data in a way that puts you at risk, we will tell you and, where required, the Information Commissioner’s Office.
9. Your rights
Under UK data protection law you have the right to:
- access your personal data and get a copy;
- correct inaccurate data;
- erase your data, where we no longer need it or have no other lawful reason to keep it (we must keep financial records for the periods above);
- restrict or object to processing based on legitimate interests;
- data portability: receive data you gave us in a machine-readable format.
To use any of these rights, email [email protected] from the address on your account. We will respond within one month. There is no charge in most cases.
10. Children
TickFeed is for people aged 18 and over. We don’t knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
We will update this policy if what we collect or how we use it changes. For material changes we will notify account holders by email or in the dashboard before they take effect. The date at the top shows the latest version.
12. Contact and complaints
Questions or requests: [email protected]. If you’re unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.