This Privacy Policy covers the Meta & Instagram Marketing application (the “Application”) — the integration SELLTICKETS Ltd (“SellTickets.Net,” “we,” “us”) offers to Event Organizers through the SellTickets.Net marketplace, built on our registered Meta developer application (“Sell Tickets”). It explains exactly what data the Application receives from Meta’s platform (“Platform Data”), what it does with it, and how it is deleted. It supplements the general SellTickets.Net Privacy Policy; for anything the Application touches, this document is the more specific statement.
SellTickets.Net is a multi-tenant ticketing platform: Event Organizers (“Organizers”) run their own ticketing websites on our software. The Application is an optional marketplace add-on an Organizer can install and then connect to their own Facebook and Instagram business assets by signing in on facebook.com (Meta’s OAuth login). We never see the Organizer’s Facebook password; Meta issues us an access token limited to the permissions the Organizer approved, and the Organizer can withdraw it at any time — in their SellTickets.Net admin panel or on Meta’s side. In everything the Application does, we act as the Organizer’s service provider (a “Tech Provider” in Meta’s terms): each connection serves exactly one Organizer, on the assets that Organizer selected.
Depending on the permissions the Organizer approves, the Application receives and — where stated — stores:
We do not receive Facebook passwords, the personal data of the Organizer’s followers or customers from Meta, or any data about Facebook users who have not connected the Application.
Solely to provide the Application’s features to the Organizer who granted access:
Every one of these actions is initiated or configured by the Organizer and operates only on the Organizer’s selected assets.
appsecret_proof so a token alone is useless against Meta’s API.Platform Data is stored on our infrastructure in the European Union (Amazon Web Services, Frankfurt, Germany). Access tokens are encrypted at rest; all traffic to Meta and to our users runs over TLS; and per-tenant isolation is enforced at the application layer, so one Organizer’s connection is never visible to another. The general Privacy Policy’s security section applies in full.
Platform Data is kept only while the connection exists. It is deleted from our systems when any of the following happens:
If you bought a ticket on an Organizer’s website: the pixel events described in Section 3 go to that Organizer’s own Meta dataset, not to any property of ours. The Organizer is the data controller of its pages and is responsible for disclosing this tracking in its own privacy notice and obtaining any consent its jurisdiction requires. You can limit this tracking through browser controls or Meta’s Ad preferences, and you can direct privacy requests to the Organizer you bought from — we assist Organizers in fulfilling them.
Our receipt and use of Platform Data is governed by the Meta Platform Terms and Developer Policies. Meta’s own processing is described in the Meta Privacy Policy. For everything this document does not address — cookies, payments, international transfers, your legal rights — the general SellTickets.Net Privacy Policy applies. The English version of this document is the authoritative version.
SELLTICKETS Ltd (operating as SellTickets.Net)
Office A, Innovation City Business Centre, RAK BANK ROC Office, Ground Floor, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates
E-mail: [email protected]
This Privacy Policy explains how SELLTICKETS Ltd (“SellTickets.Net,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information in connection with the selltickets.net platform — both on our own websites and through the ticketing websites we host for Event Organizers. It also contains the disclosures required for our integrations with Google, Facebook, and Instagram, including our use of OAuth sign-in, the Google Ads API, the Meta Pixel, and Meta developer applications.
SellTickets.Net is a multi-tenant Software-as-a-Service platform. Event Organizers (“Organizers” or “Tenants”) use our software to run their own ticketing websites — on a subdomain of selltickets.net or on their own custom domains — and members of the public (“Ticket Buyers”) buy tickets on those websites. Because of this, we act in two distinct roles:
gclid). Where the visit results in an order, that identifier is stored with the order so the Organizer can see which advertising produced the sale, whatever cookie choice the visitor made. It identifies the click, not the person. Sharing it with the advertising platform is a separate step and requires marketing consent (Section 6.1).We use cookies and similar technologies that are strictly necessary to operate the platform: session cookies (sign-in state, shopping cart, checkout integrity), language preference, and security cookies set by our edge provider, Cloudflare. On our own website we additionally measure visits using a privacy-conscious, server-mediated analytics setup (Cloudflare Zaraz); identifiers sent to analytics are pseudonymized. Our own website also runs a Google Ads conversion tag, but only for visitors who accept marketing cookies — see Section 6.2. On Organizer-hosted pages, additional cookies or pixels may run if the Organizer has enabled them — see Section 8. You can control cookies through your browser settings; blocking strictly necessary cookies may break sign-in or checkout.
Consent banner. Organizer-hosted pages show a cookie-consent banner: strictly necessary cookies (including the operational analytics above) run in any case, while preference and marketing cookies run only if the visitor consents — per category, if they wish. The choice, including a decline, is stored in a small consent cookie (st_cc) for about six months so the banner is not shown again, and is asked afresh when it expires or when the Organizer’s cookie practices change.
This section is the disclosure required by the Google API Services User Data Policy. The application it describes is SellTickets.Net, operated by SELLTICKETS Ltd — the same name shown on Google’s OAuth consent screen — reachable at selltickets.net. It sets out, for each Google integration separately, what Google user data the application accesses, why, where it is stored, who it is shared with, how long it is kept and how to have it deleted.
We use Google in three separate ways, and the difference matters: in the first the Organizer connects their own Google account; in the second the advertising account is ours; in the third, described in Section 6.3, a Ticket Buyer signs in with their own Google account.
6.1 Advertising on Google (Google Ads API). Organizers may ask us to advertise their performances on Google Search. The most important thing to understand about this service is that the advertising account is ours, not the Organizer’s. SELLTICKETS Ltd holds its own Google Ads manager account and its own Google Ads API credentials, and creates one advertising sub-account per Organizer beneath it. The Organizer does not connect a Google account for this feature and never receives Google Ads credentials; we are the advertiser of record and Google invoices us. Running this feature gives us no Google user data belonging to the Organizer or to any Ticket Buyer.
https://www.googleapis.com/auth/adwords scope. That grant reaches exactly one account — ours — and is used only to create advertising sub-accounts under our manager account, to build and manage the campaigns described above, to report settled ticket sales as conversions, and to read back the resulting cost and performance figures. The refresh token is stored encrypted on our servers, is never exposed in a browser, and is used only by scheduled server-side tasks. No Organizer and no Ticket Buyer authorizes anything, and none of their Google account data is accessed by this integration.Google’s own processing of advertising data is described in the Google Privacy Policy and governed by Google’s advertising and data-processing terms.
6.2 Advertising SellTickets itself. Separately from the service described above, we advertise our own product to event organizers, and our own website selltickets.net carries a Google Ads conversion tag so that we can tell which of our advertisements produced an enquiry. It runs only where the visitor accepted marketing cookies, and only on selltickets.net — never on an Organizer’s ticketing pages, where the measurement described in Section 6.1 is server-side and sets no advertising cookie. The one conversion it records is a submitted “express interest” enquiry, and it carries the page and the enquirer’s self-declared business profile; the name, e-mail address and telephone number given in that form are not sent to Google.
6.3 “Sign in with Google” for Ticket Buyers. An Organizer may offer Ticket Buyers the option of creating an account and signing in with their Google account, instead of choosing a password. This is a sign-in feature only: it establishes who the Buyer is so they can reach their orders and tickets, and it does nothing else.
openid, email and profile. In practice that is a stable Google account identifier, the Buyer’s e-mail address, and the display name on their Google account. We request no other permission, and we therefore have no access to the Buyer’s Gmail, Drive, Contacts, Calendar or any other Google service.Whose name appears on the Google screen. Where the Organizer has their own verified Google application — which requires their own domain, logo and registered company details — the permission screen carries the Organizer’s name and logo, because the application is theirs; SellTickets operates the sign-in on their behalf, and the Organizer’s storefront says so beneath the button. Every other storefront uses SellTickets’ own application, and the permission screen says SellTickets.Net. The data described above is the same either way.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, as stated in Section 6.4.
6.4 Limited Use of Google user data. SellTickets.Net’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This applies to every integration in this section, and specifically:
Organizers may install our Meta & Instagram integration and connect their Facebook and Instagram professional assets through Meta’s OAuth login. Depending on the permissions the Organizer approves during that flow, we may receive and store (“Platform Data”):
How we use Platform Data. Solely to provide the features the Organizer has enabled: serving the Organizer’s own Meta Pixel on the Organizer’s ticketing pages, and — where the Organizer uses them — features that publish content or manage advertising on the Organizer’s behalf, on the assets the Organizer selected. We act as the Organizer’s service provider in doing so; we do not use Platform Data for our own advertising or analytics, we do not sell it, and we do not share it with third parties except as needed to operate the feature (that is, exchanging it with Meta itself via its APIs).
Consent first, hashing always. On Organizer pages, the Organizer’s Meta Pixel loads only after the Ticket Buyer grants marketing consent on the cookie banner (Section 5); declining keeps it off entirely. Where the Organizer uses server-side purchase confirmation (Meta’s Conversions API), events are sent only for orders placed with that consent — the choice is recorded with the order — and the buyer’s e-mail address is transmitted solely as an irreversible SHA-256 hash, with the order number as the deduplication event ID. Plain e-mail addresses are never sent to Meta.
A dedicated privacy policy for this application — covering its Platform Data handling in full — is published at selltickets.net/privacy/meta.
Compliance and control. Our use of Platform Data is subject to the Meta Platform Terms and Developer Policies. The Organizer can disconnect the integration at any time from the SellTickets.Net admin panel (Marketplace → Meta & Instagram), which deletes the stored tokens and the associated Platform Data from our systems. The connection can also be revoked on Meta’s side under Facebook Settings → Business Integrations (or Instagram Settings → Apps and Websites). See Section 15 for full deletion instructions. Meta’s own processing is described in the Meta Privacy Policy.
When an Organizer connects its Meta Pixel (and, similarly, any analytics the Organizer configures), our platform loads that Organizer’s pixel on the Organizer’s hosted pages and sends it standard events — such as page views and purchase confirmations relating to that Organizer’s events. The pixel runs consent-first: it loads only after the Ticket Buyer accepts marketing cookies on the page’s consent banner (Section 5), and a decline keeps it off entirely. These events go to the Organizer’s own Meta dataset (or analytics property), not to any property of ours. The Organizer, as the data controller of its pages, is responsible for disclosing this tracking in its own privacy notice and for obtaining any consent its jurisdiction requires; to help with that, the platform publishes a ready-made pixel disclosure notice on the Organizer’s pages when a pixel is activated. Where an Organizer advertises through us on Google Search, the click identifier described in Section 6.1 is recorded with the resulting order in every case, as part of the Organizer’s own record of which advertising produced which sale. Reporting that sale to Google is a separate step and is consent-first: an order placed without marketing consent is never reported. Ticket Buyers can also limit this tracking through browser controls, ad-preference settings on the relevant platform (for Meta: Ad preferences), or by contacting the Organizer.
Card payments are processed by PCI-DSS-certified payment gateways (currently iyzico and PayTR, chosen per Organizer). Card details are either entered in an interface controlled by the gateway or transmitted directly to the gateway over encrypted channels for 3-D Secure authentication; full card numbers are never stored on our servers. We retain transaction metadata (amount, currency, status, gateway reference, and masked card details where provided by the gateway) as needed for order fulfilment, refunds, fraud prevention, and financial record-keeping.
We share personal information only with service providers that help us run the platform, under contracts limiting their use of it, and only as needed:
We may also disclose information as part of a corporate transaction (merger, acquisition, or asset sale), subject to this policy continuing to apply.
Platform data is primarily stored and processed in the European Union (Frankfurt, Germany). SELLTICKETS Ltd is established in the United Arab Emirates, and some service providers listed above operate globally. Where personal data is transferred across borders, we rely on appropriate safeguards such as contractual data-protection commitments with our providers.
We protect data with TLS encryption in transit (with HSTS), encryption of stored credentials and third-party tokens, strict per-tenant data isolation enforced at the application layer, web-application-firewall and bot protection at the network edge, least-privilege access controls, and continuous security monitoring. No system is perfectly secure; if we learn of a breach affecting your personal data we will notify affected parties and authorities as required by law.
Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or receive a copy of your personal data, and to object to certain processing.
You can have data deleted from our systems in any of the following ways:
Our platform and websites are not directed at children. We do not knowingly collect personal data from anyone under 16 (or the higher minimum age of digital consent where one applies). Purchases must be made by adults; if you believe a child has provided us personal data, contact us and we will delete it.
We may update this policy as the platform, law, or our third-party integrations evolve. The effective date at the top reflects the latest revision; material changes will be announced to Organizers through the platform. The English version of this policy is the authoritative version.
SELLTICKETS Ltd (operating as SellTickets.Net)
Office A, Innovation City Business Centre, RAK BANK ROC Office, Ground Floor, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates
E-mail: [email protected]
By accessing or using selltickets.net, owned and operated by SELLTICKETS Ltd, you agree to be bound by these Terms of Service.
selltickets.net provides a multi-tenant Software-as-a-Service (SaaS) platform allowing Event Organizers to build custom ticketing websites, manage event descriptions, and process ticket sales under their own domains.
The platform generates an XML sitemap for your ticketing pages and publishes standard structured data so that search engines can index your events. We do not guarantee any particular ranking, indexing outcome, or search traffic, and search engines are free to change how they treat your pages at any time.
Where you ask us to, we will advertise your performances on Google Search. The following applies to that service.
SELLTICKETS Ltd shall not be held liable for any indirect, incidental, or consequential damages arising from platform downtime, failed ticket transactions, or the cancellation of an Organizer’s event. Our total liability is limited to the subscription fees paid by the Organizer in the preceding twelve months. That limit caps what we may owe the Organizer; it does not reduce or excuse any amount the Organizer owes us, including advertising credit drawn, advertising costs we have incurred on the Organizer’s behalf and the cost-recovery charge under Section 6.
These Terms shall be governed by and construed in accordance with the laws of the Emirate of Ras Al Khaimah and the applicable federal laws of the United Arab Emirates, without regard to conflict of law principles.
Questions about these Terms can be sent to [email protected].