Privacy Policy

The platform is operated by AirmyTicket. Contact: info@airmyticket.com.

From brand users (admin, agent, cashier): name, email, phone (optional), bcrypt-hashed password, login history with IP and user-agent.

From end customers (entered by an agent on their behalf): name, email, phone, payment method, purchase + redemption history.

Automatically: IP, browser/user-agent, audit log entries, login attempt records (for brute-force defence).

• To create, deliver and verify promo codes
• Customer communication via email/SMS (codes, payment links)
• Fraud prevention (audit, rate limiting, lockout)
• Technical support
• Compliance with legal obligations

We never use personal data for advertising or marketing.

• Resend — email delivery
• Twilio — SMS delivery
• Cloudflare — DDoS protection, CDN
• Vercel — frontend hosting
• Railway — backend and database hosting

None of these processors are licensed to use the data outside the scope of providing the service.

• Brand accounts: until the account is deleted
• Promo code records: 12 months after redemption
• Audit log entries: 90 days
• Login attempt rows: 90 days
• Password reset tokens: deleted on use or after 30 days

• Access — receive a copy of your data
• Rectification — correct inaccurate data
• Erasure — request deletion
• Portability — export in machine-readable form
• Objection — opt out of processing

Requests: info@airmyticket.com. Response within 30 days.

We use only essential cookies (auth session, role indicator, language preference). No tracking, analytics or marketing cookies.

Bcrypt password hashing, mandatory HTTPS with HSTS preload, optional 2FA, rate limiting and lockout, Cloudflare WAF, audit logging on all sensitive operations.

The service is not directed to anyone under 18. We do not knowingly collect data from minors.

Material changes are announced by email at least 30 days before they take effect.

Privacy: info@airmyticket.com · Security: security@airmyticket.com