Privacy Policy

Who is responsible for your data

When you join Default's list, buy from their store, or interact with their site, Default decides what is collected and how it's used. In privacy terms, Default is the "controller" (or "business" under US state law). HARD TICKET acts as Default's "processor" / "service provider": we handle data on the Artist's instructions and on their behalf, not for our own marketing.

HARD TICKET does not sell fan data and does not market to you on its own behalf. For a narrow set of data (your Fan Pass sign-in credential, the cross-artist recognition identifier, and platform security logs), HARD TICKET is the controller, as described below.

What we collect and why

What you provide: email (required to join or create a Fan Pass), name, phone (optional, only used for texts if you separately opt in), and any city/location you give.

What's generated as you use the site: purchase history and order details; engagement events (RSVPs, presaves, drop signups, votes, check-ins, link/email interactions); and device/cookie signals (browser type, general location inferred from IP, identifiers that keep you signed in and measure performance).

Why: to let you sign in without a password, deliver the shows/drops/merch/messages you asked for, process purchases, keep the platform secure, and give the Artist aggregate audience insight. We do not build advertising profiles for sale.

Fan Pass, passkeys, and biometrics

Fan Pass lets you sign in using your device's built-in security: Face ID, Touch ID, Windows Hello, or a device PIN. This is a passkey (WebAuthn / FIDO2), not a password.

We do not collect your biometrics. Your face scan or fingerprint never leaves your device and is never transmitted to or stored by HARD TICKET. Your device performs the check locally and only confirms that it succeeded. What we store is a public key (which can verify your sign-in but cannot impersonate you or reconstruct any biometric) and a random credential identifier. HARD TICKET never receives fingerprint, face-geometry, voiceprint, or other biometric data, and cannot identify you from any biometric characteristic.

"Sign in with HARD TICKET" can let you use the same credential across different Artists' sites so you don't create a new login each time. That recognition (next section) does not, by itself, give any Artist permission to contact you.

Recognizing you across artists, and why that isn't permission to market

So your Fan Pass works across Artists without re-registering, HARD TICKET creates a one-way, keyed reference from your email: we combine it with a secret value held only by HARD TICKET and run it through a one-way hash. The result lets us recognize the same person is present, but cannot be reversed back into your email, and the secret is never disclosed.

Recognition is not permission to market. Your contact details and your permission to receive email or text are stored per Artist and isolated to that Artist. If you opted in to Artist A, you have not opted in to Artist B, so B cannot email or text you until you separately opt in. Signing in with Fan Pass means we recognize you; choosing to "Become a Fan" is the separate, explicit step that grants that Artist permission to contact you.

The cross-artist layer shares only the minimal recognition signal (and any claims you expressly consent to release at sign-in). It never shares one Artist's marketing list, purchase history, or contact details with another.

Legal bases (GDPR / UK GDPR)

Where EU/UK GDPR applies we rely on: consent for marketing email/text and non-essential cookies (withdraw any time); performance of a contract for your Fan Pass and orders; legitimate interests for security, fraud prevention, recognizing returning fans, and aggregate audience insight (you may object); and legal obligation for records we must keep. Biometric special-category data is not processed by HARD TICKET because the check happens only on your device.

Cookies and tracking

We use a small number of cookies: strictly necessary ones (to keep you signed in, remember your Fan Pass, secure the site, these can't be switched off) and, where you consent, performance/analytics cookies. We honor the Global Privacy Control (GPC) signal as an opt-out of any sharing for cross-context advertising; HARD TICKET does not engage in cross-context behavioral advertising and does not sell personal information.

Service providers

We use vetted providers under contracts that restrict them to their service: Stripe (payments, each Artist uses their own Stripe account; we don't store your card number), our email delivery and text-messaging providers (the latter only if you opt in to texts, and used to honor STOP), print-on-demand / fulfillment partners (who receive the name + shipping details needed to deliver your order), and hosting/security infrastructure. A current sub-processor list is available on request.

Data retention

We keep personal information only as long as needed and as the Artist instructs: your Fan Pass credential while your pass is active (deleted when you delete it); fan contact/marketing records while you're subscribed and a reasonable period after; order/transaction records as required for tax and disputes; and security logs for a limited period. When no longer needed we delete or de-identify it.

US state rights, and no sale or sharing

We do not sell your personal information, and do not share it for cross-context behavioral advertising (as defined by CCPA/CPRA and similar laws), and have not in the preceding 12 months. Residents of California, Colorado, Connecticut, Virginia, Texas, and other states with comprehensive privacy laws may have rights to know, access, correct, delete, opt out of sale/sharing and targeted advertising, limit sensitive-data use, and be free from discrimination for exercising them. Because each Artist controls its own fan relationship, some requests are fulfilled by the Artist with our help. We honor the GPC signal.

International transfers

HARD TICKET is based in the United States and our providers may process data in the US and other countries. Where we transfer personal information out of the EEA, UK, or Switzerland, we rely on appropriate safeguards including the Standard Contractual Clauses (and the UK IDTA), with additional measures where required. Request details using the contact below.

Your rights and how to exercise them

You can request access, correction, export, or deletion at any time using the form below, or by email. To protect your account we may verify your identity (for example by confirming control of your email or Fan Pass). If your request concerns a specific Artist's records, we route it to that Artist and assist them; we respond within the legally required timeframe (generally 30 to 45 days). You may appeal where state law allows and complain to your data protection authority or state Attorney General.

Marketing opt-out: unsubscribe from any email using its link, and stop texts by replying STOP. Opting out of one Artist does not affect any other Artist you separately subscribed to.

Children

HARD TICKET and Fan Pass are not directed to children under 13, and we do not knowingly collect their personal information. You must be at least 13 (or the higher age of digital consent in your jurisdiction) to create a Fan Pass or join a list. If we learn we collected data from a child under 13 without required consent, we will delete it.

Security, changes, and contact

We use encryption in transit, phishing-resistant passkey sign-in, access controls, and strict tenant isolation so one Artist cannot access another's fan data; card data is handled by Stripe, not stored by us. No system is perfectly secure. If an incident affects your information we notify affected Artists (the controllers) without undue delay, and notify individuals and regulators where the law requires.

We may update this Policy; material changes will be posted with a new effective date.

The platform is operated by Brian Kaplan, doing business as Hard Ticket, 820 Harrisburg Lane, Mt Juliet, TN 37122. For anything about your data you can use the form below, write to privacy@hardticket.app, or contact Default directly. You can also stop messages from every artist at once, and delete your account across all of them, from your Fan Pass account page.