Privacy Policy

dudulut tix is a ticketing service operated by dudulut, sole trader, ABN 82 778 989 397, in Australia. Event organisers sell tickets to their own shows using dudulut tix. This policy explains our handling of personal information and your access, correction and complaint options under applicable Australian privacy law.

Contact: hello@dudulut.app

Ticket buyers and guests: buyer and attendee names and email addresses where provided, what you bought or were issued, the amounts paid, any discount code used, and ticket and check-in status. Email is required for purchases; an organiser may issue a complimentary ticket without a guest email address. Buyer phone numbers are not collected at checkout.

Card payments: are handled by Stripe on Stripe's own payment page. We never see or store your full card number. We keep the payment reference, the card brand and the payment type.

Organisers: login email, password credentials handled by our authentication provider, organisation name, contact name, phone number and country, event and venue details, plus payment-account status from Stripe. Identity documents and bank details are supplied directly to Stripe through its forms, not collected through our own forms. If you sign in with Google, we receive the account information supplied for sign-in, including your email address and name.

At the door: when a ticket is admitted we record the time and the staff name entered on that device.

Ticket recovery and security: when you ask us to resend your tickets we keep a scrambled (hashed) copy of your email address and IP address to stop abuse.

Emails: we keep delivery records for ticket, recovery, cancellation and account emails, which can include a recipient address or its hashed value, provider reference, send status and errors. A successful send record is not proof that you read an email.

Show interest: we count event page views and "Buy tickets" clicks. Some demand measurement uses a random browser identifier to approximate distinct browsers. It is not derived from your name or email address.

We collect information from you, from the organiser when they issue tickets or manage an event, from staff admitting tickets, and from payment, sign-in and email services. Service providers may also process technical connection and security information when you use the service.

To sell and deliver tickets, take payments, admit you at the door, process refunds and cancellations, help you recover lost tickets, run organiser accounts, prevent fraud and misuse, and meet legal and tax obligations.

The application's email flows are transactional: tickets, orders, cancellations, recovery and account messages. No marketing subscription or advertising tracking feature is currently implemented. We do not sell your personal information.

The organiser of a show you buy tickets for can see your name and email address until that show ends, so they can contact you about it. After the show ends, dudulut tix hides your contact details from the organiser, who keeps only sales figures and masked names and emails.

If a show is cancelled, the organiser can see your contact details until the cancellation notice has been sent to you.

Organisers may retain copies or downloads of contact records obtained during that permitted access window. The current service does not provide a bulk attendee-contact download button. Hiding contacts after the event does not erase copies already held outside dudulut tix. Organisers are responsible for securing those records, using them only for lawful purposes, and meeting their own privacy obligations; ticket purchase does not itself authorise unrelated marketing.

Door staff see only masked email addresses.

We use these providers to run dudulut tix. Some of them may store or process information outside Australia, including in other countries where they operate:

• Stripe — card payments, organiser identity checks and payouts.
• Resend — sending ticket, recovery and cancellation emails; our authentication service also handles account verification and password-reset delivery.
• Google — sign-in with Google, and address search for organisers when creating events.
• Third-party cloud infrastructure and authentication services — website delivery, database, login, file storage, technical logs and backups.

These services receive information needed for their role, such as recipient addresses and ticket content for email delivery, payment details for Stripe, or sign-in information for authentication. They may use overseas infrastructure and subprocessors. We have not confirmed every processing or backup location, so this policy does not list unverified countries. Their privacy terms provide further information about their processing.

The main application database is hosted in the Seoul region of South Korea. This does not establish the location of every backup, email service, payment service or other processor; those locations have not all been confirmed.

We may also disclose information where required or permitted by law, including to deal with fraud, disputes or lawful requests.

The application uses browser storage for organiser login sessions, the buyer email associated with a checkout, temporary ticket-recovery access, and the staff name entered on a door device. A random show-interest identifier is reused for up to 90 days and replaced on a later visit when it has expired. Staff-name storage has no automatic expiry in the current application.

No advertising tracker, marketing-cookie consent tool or third-party advertising analytics script is implemented in the application. Stripe, Google and infrastructure providers may use their own cookies or similar technologies for payment, sign-in, security and service delivery. Their behaviour and retention are governed by their services; we have not independently verified every provider cookie. Blocking storage may affect sign-in, checkout or ticket recovery.

The service uses HTTPS, authenticated account access, database access controls and restricted ticket-recovery links. Organiser access to buyer contacts is limited as described above. These safeguards reduce risk but cannot guarantee that information will never be lost, misused or accessed without permission. Keep ticket links and account credentials private, and contact us if you suspect unauthorised access.

Order, buyer-contact, attendee, payment-reference, refund and admission records are kept to support tickets, refunds, accounting, tax, disputes and security. There is currently no automatic deletion schedule for these records or application email and recovery records; they may remain indefinitely unless a lawful deletion is carried out. Contact masking after event end is not deletion.

Organiser accounts that have ever created an event cannot be hard-deleted through the account controls: they may be blocked or retired while their history remains. An unused registration may be deleted. Closing or deleting an account does not automatically erase all transaction history, provider records or backup copies.

Data is held in third-party cloud services, but browser storage and records saved or downloaded onto devices also exist. Provider log and backup retention periods and all backup locations have not been confirmed for this service.

You can request access to your personal information, correction of inaccurate information, or deletion where lawful and practicable. Email hello@dudulut.app. We may need to verify your identity and will respond within a reasonable period. Some records may need to be retained for legal, accounting, dispute or security purposes. If we cannot fulfil a request, we will explain why.

You may also send a privacy complaint to that address. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.