TicketKit Privacy Policy
Effective date: 14 September 2026 Operator: Clarvit Technologies Private Limited, Mumbai, India Contact: varun@vthrive.co.in
TicketKit is a Shopify app that lets merchants sell event tickets from their store. This policy explains what information the app handles, why, and what happens to it. It applies to merchants who install TicketKit and to their customers who buy tickets.
What we collect
From merchants (store owners)
When you install TicketKit we receive your store's .myshopify.com domain and
an access token that lets the app create products and read orders in your
store. We store the events and ticket types you create in the app.
From your customers (ticket buyers) When an order containing a ticket is paid, Shopify sends the app the order details. From that we store the buyer's name and email address, the order number, and which ticket type was purchased. We do not receive or store payment card details, billing addresses, or phone numbers.
From attendees at the door When a ticket is scanned, we record the time and result of the scan.
Why we collect it
We use this information for one purpose: running the ticketing workflow.
- The buyer's email is used to send their ticket.
- The buyer's name appears on the ticket and the door scanner so staff can confirm identity.
- Order and scan records let merchants see who has bought and who has arrived.
We do not use customer data for advertising, profiling, or analytics, and we never sell or rent it.
Who we share it with
Only the providers needed to operate the service:
- Shopify — the app runs inside Shopify and exchanges data with it to create products and receive orders.
- Resend (resend.com) — delivers ticket emails. Receives the buyer's email address, name, and ticket details.
- Fly.io — hosts the application (Singapore region).
- Neon (neon.tech) — hosts the database (Singapore region).
Each is bound by its own privacy and security terms. No other third parties receive customer data.
How long we keep it
Ticket and attendee records are kept for as long as the merchant has the app installed, so they can manage past events. When a merchant uninstalls TicketKit, Shopify notifies us and we delete all of that store's data within 48 hours.
Data subject rights (GDPR, CCPA, and similar)
TicketKit supports Shopify's mandatory privacy webhooks:
- Customer data request — a merchant can ask us for the data we hold about one of their customers, and we will provide it.
- Customer data erasure — on request we remove the customer's name and email from their ticket records.
- Shop data erasure — on uninstall, all store data is deleted.
If you are a ticket buyer and want to exercise these rights, contact the merchant you bought from; they can raise the request through Shopify. You can also contact us directly at varun@vthrive.co.in.
Security
All traffic between your browser, Shopify, and TicketKit is encrypted with HTTPS. Data at rest is encrypted by our hosting providers. Access to a store's data is scoped to that store on every request — one merchant cannot see another's events or attendees. Door-scanner links contain a secret token; merchants should share them only with staff.
Children
TicketKit is a business tool for Shopify merchants and is not directed at children. We do not knowingly collect data from anyone under 16.
Changes to this policy
If we make material changes we will update the effective date above and, for significant changes, notify merchants through the app.
Contact
Clarvit Technologies Private Limited Mumbai, India varun@vthrive.co.in