Privacy
Last updated: November 13, 2026
tixey.ca collects only what it needs to sell and check tickets. It has no ads, no analytics and no trackers, and it does not sell or share personal information for marketing.
Who is responsible
The service is run by Marwan, who is also the person in charge of the protection of personal information: marwanjalaleddine@gmail.com. Each organization that sells tickets is responsible for its own events and for how it uses its buyers' information.
What is collected, and why
| Whose | What | Why |
|---|---|---|
| Buyers | Name, email address, the tickets ordered, the amount, and an optional note | To hold the tickets, match the Interac e-Transfer payment, send the tickets and check them at the door |
| Buyers who pay | From the bank's deposit notice: the sender's name, the amount, the transfer's message and reference | To recognize the payment and match it to the order |
| Organizations | Name, contact email, Autodeposit address, sign-in names, passwords (stored only as a one-way hash), and, depending on what the organization chose: the ticket mailbox's address and app password, or the Gmail address connected through Google and the permission granted (both stored encrypted) | To run the account and read deposit notices |
| Organizations signing up | The internet address the sign-up came from | To stop abuse; deleted once the sign-up is decided, or after 30 days |
The organization's email
To recognize payments, tixey.ca needs the Interac e-Transfer deposit notices. Each organization chooses how they arrive. With forwarding (recommended), its Gmail forwards only those notices to tixey.ca, which has no access to the rest of its mailbox. With a mailbox, tixey.ca reads the organization's ticket mailbox about once a minute; this is why we ask organizations to use a new mailbox used only for ticket payments. Either way, only deposit notices from the trusted notice senders are processed. For any other email, only the sender's address is noted (so the organization can see what was skipped): never its subject or content.
An organization can also connect its Gmail by signing in with Google. It chooses what to allow. Read access lets tixey.ca receive payment notifications: Google's permission covers the whole mailbox, but tixey.ca only searches for messages from the organization's trusted notice senders and never opens anything else. Send access lets tixey.ca send ticket emails from that address, and allows nothing else. The organization can withdraw either at any time from its Settings or its Google account.
tixey.ca's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Gmail data is used only to recognize payments and send the organization's ticket emails. It is never sold, never used for advertising, never used to train AI models, and no person reads it unless the organization asks for help with a specific notice.
How long it is kept
- The full text of deposit notices: 30 days, encrypted. The decision (paid, unmatched, refused) and the amount stay, so the organization's accounts add up.
- Orders, tickets and payments: kept for the organization's records until the organization deletes them or asks us to.
- Nightly backups: 14 days on the server and 30 days in backup storage, then deleted.
Who can see it
- The organization sees the orders, payments and door check-ins for its own events, and nobody else's.
- The operator has technical access to the server, to keep it running, and does not look at personal information except to fix a problem or answer a request.
- Service providers, only for what they do: Oracle Cloud (servers, backups and the service's own emails, in Canada, Montreal region); Google (the organization's Gmail, which receives notices and sends tickets); Cloudflare (domain name, and the check that a form is not sent by a robot). Apple and Google receive a ticket only if the buyer adds it to their wallet.
- Information is disclosed to authorities only when the law requires it.
Where it is kept
On servers in Canada (Oracle Cloud, Montreal region). Emails pass through the providers above, some of which may process them outside Canada (for example Gmail).
Cookies
Two kinds only: the language you chose, and a sign-in cookie for organizers and door staff. No advertising or tracking cookies.
Security
Pages are served over HTTPS. Mailbox passwords and deposit notices are encrypted, sign-in passwords are hashed, and ticket links are long random keys. If an incident puts personal information at risk, the people concerned and, where required, the Commission d'accès à l'information du Québec are notified.
Your rights
You can ask to see the personal information held about you, to correct it, or to have it deleted, by writing to marwanjalaleddine@gmail.com. Buyers can also ask the organization that sold them the ticket. If you are not satisfied with the answer, you can complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).
Changes
If this policy changes, the new version is posted here with a new date.