Privacy Policy

We don’t run advertising trackers or third-party analytics on this site today, and nothing above is collected for marketing purposes.

To create and deliver your ticket, process a refund or an organiser’s payout, keep accounts secure, respond when you contact support, investigate suspected fraud, and meet the financial record-keeping obligations described below.

Your name and phone number became required once you sign in for the first time, before the rest of your account unlocks: Stub uses your name to confirm it’s speaking to the right person when you contact support or dispute a ticket, and your phone number so a member of the Stub team can reach you directly about your account or an order, through that same support tool. City is optional, and listed here only because you can choose to give it: nothing in Stub reads it today, and it is not required for that reason. If that ever changes, this page will say what it is used for before we ask for it.

Stripe processes every payment, refund, and organiser payout — Stub relies on Stripe Connect to hold and move money, and never sees or stores your full card or bank details.

Resend delivers the transactional emails Stub sends you (order confirmations, refund updates, magic-link sign-in emails) — it sees the email address and content of that message, nothing else.

Otherwise, your information is not sold, and is not shared with anyone outside Stub except where the law requires it (for example, in response to a lawful request from a New Zealand or Australian authority).

Inside Stub, retained identity (see the retention table below) can only be read by a Stub staff member through one audited internal tool built for that purpose, and only by someone whose role actually needs it. Every such lookup is permanently recorded — who looked, at whose record, on what route, and why (for a bulk search or export; a single lookup mid support-call doesn’t need a stated reason, but is still recorded). If your account has been deleted, that record stays hidden even from this internal path unless a named legal hold overrides it, which is itself recorded.

Deleting your account doesn’t erase everything uniformly — some records exist because the law requires them to, independent of what you’d prefer:

If you have an order, refund, or payout genuinely in progress when you ask to delete your account, that part of the request is held — not silently dropped — until it clears, and you’re told when that will be.

You can ask to see, correct, or delete the personal information Stub holds about you. This policy is written against the New Zealand Privacy Act 2020 and the Australian Privacy Act as the applicable law for a NZ/AU ticketing business — it does not claim compliance with any other jurisdiction’s privacy law (for example, the EU’s GDPR), because Stub does not operate there today.

Stub's infrastructure is hosted in Sydney, Australia.

Stub uses a session cookie to keep you signed in, and, for a guest checkout, a separate cookie that lets an emailed order link authenticate you to that one order without a password. Neither is an advertising or tracking cookie, and neither is shared with a third party.

Stub is not directed at children, and account creation asks for an adult's details.

If what we collect or how long we keep it changes, this page changes with it — it's meant to describe current behaviour, not a fixed promise about a future version of the product.

To ask about your data, or to request deletion: contact support — a person reads every message and replies within 24 hours.