Privacy notice

TicketHero is a booking product for attractions and seasonal events. It is a Boostkit product, run from Kent in the United Kingdom. In this notice, “we” and “us” mean Boostkit.

For what we collect through this website and the booking demo, we are the data controller: we decide why and how the information is used. To ask about anything in this notice, use the contact form or email matt@boostkit.io.

We collect only what you give us, plus the small amount of technical information needed to run the site. We do not buy information about you, build advertising profiles or sell anything you send us.

When you send an enquiry we receive your name, your email address, your venue name if you give one, and your message. It is sent to us as an email so that we can reply. Enquiries are not saved to a database: they live in our email inbox.

Tiki-Taka answers questions about TicketHero. The questions you type, and the earlier messages in the same conversation, are sent from our server to an AI model provider through a service called OpenRouter, which returns the answer. The answers are automated and can be wrong.

We do not save your conversation. It is held in your browser while the page is open and is gone when you reload or leave. The AI providers handle the text under their own terms and privacy policies, so please do not type personal details, payment details or anything confidential into the assistant.

The public demo is for a made-up venue. No payment is taken and no booking made in it is real. You are welcome to use made-up details there. If you complete a booking, we store:

• your first name, last name and email address;
• the experience, date, start time, tickets and extras you chose, and the price;
• whether you ticked the box to hear news and offers from the venue. It is unticked unless you tick it, and no marketing is sent from the demo;
• where you came from: campaign tags in the web address (utm_source, utm_medium and utm_campaign), the name of the website that referred you, and the page the booking panel was on;
• if you choose to add them afterwards, each child’s first name, age and interests. These are optional.

Your choices and where you came from are saved when you press Continue to hold a place, before you give your name. A place that is held and not completed is released after ten minutes.

A booking in the public demo sends one confirmation email to the address entered, marked as a demonstration. To stop the demo being used to send unwanted email, any one address is sent at most one a day, and we keep a record of the address and the time for that purpose. If you receive one you did not ask for, someone entered your address by mistake and nothing else will be sent.

Anyone can open the demo venue’s staff admin to see how it works. There, each booking shows only a first name and the first letter of the surname, and email addresses are hidden.

After booking you are given a private link to your booking page. Anyone who has that link can see the booking and the details added to it, so share it only with people you trust.

A private venue preview works the same way and is opened with an access code. People with staff access to that preview can see the bookings made in it.

Each member of a venue’s staff signs in to the admin with their own email address and password. For each account we hold the person’s name, email address, role at the venue and the time they last signed in. Passwords are stored only in a scrambled form that we cannot read back. Accounts are created by the venue’s owner or by us.

To slow down password guessing, a failed sign-in is recorded against the email address tried and the IP address it came from, and counts for 15 minutes. Signing in sets a cookie, described under Cookies.

Like every website, ours receives your IP address and details of your browser when you load a page. We use the IP address briefly to limit how many contact messages and assistant questions one address can send in ten minutes, which protects the site from abuse. When you hold a place in the booking flow, a one-way mark made from your IP address is saved with it, so that one visitor cannot hold a whole date. The mark cannot be turned back into the address. Our hosting and database providers also keep routine server logs. We do not use this information to identify you or to follow you around the web.

When you book with a real venue through TicketHero, that venue is the data controller for your booking information. It decides what is collected and how it is used, and we process it only on the venue’s behalf and on its instructions. The venue’s own privacy notice applies, and the venue is the right place to ask about your booking or your information.

A venue can see its bookings in the TicketHero admin, and can have them sent to its own systems. If you contact us about a booking with a venue, we will pass your request to that venue.

This site sets only strictly necessary cookies, and only when you sign in or open a private preview. An ordinary visit sets none. There are no analytics cookies, no advertising cookies and no tracking pixels, which is why you do not see a cookie banner.

You can delete or block cookies in your browser settings. If you block these, staff sign in and private previews will not work; the rest of the site will.

We use a small number of companies to run TicketHero. Each one handles information only to provide its service to us.

We do not share your information with anyone else unless the law requires it.

These providers may process information outside the United Kingdom, including in the United States. Where that happens, we rely on the contractual safeguards for international transfers that the providers offer in their standard data processing terms.

UK data protection law asks us to say why we are allowed to use your information.

• Enquiries. Our legitimate interest in replying to people who contact us and, where you are asking about working with us, taking steps towards an agreement at your request.
• The assistant. Our legitimate interest in answering questions about the product.
• Demo and preview bookings. Our legitimate interest in showing how the product works. The marketing box records your consent choice and no marketing is sent.
• Keeping the site safe. Our legitimate interest in preventing abuse of the forms and the assistant.
• Staff accounts. Our legitimate interest in keeping the admin secure and letting each venue control who can see its bookings.
• Cookies. The cookies above are strictly necessary for a service you have asked for, so the law does not require consent for them.

• Enquiries are kept for as long as we need to deal with them and any conversation that follows, then deleted.
• Demo and preview bookings are sample data. We may clear them at any time, and we will delete yours sooner if you ask.
• Assistant conversations are not kept by us.
• Staff accounts are kept until the venue or we remove them. Failed sign-in records are cleared after a later successful sign-in.
• Cookies last for the times shown above.

Under UK data protection law you can ask us to:

• give you a copy of the information we hold about you;
• correct anything that is wrong or incomplete;
• delete your information;
• stop or limit how we use it, or object to our using it;
• give you your information in a form you can take to another service;
• withdraw a consent you have given, such as a marketing choice.

To use any of these, send a message through the contact form or email matt@boostkit.io. There is no charge. We will reply within one month and may need to check who you are first. If your request is about a booking with a venue, we will pass it to that venue.

If you are unhappy with how we have used your information, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at ico.org.uk.

TicketHero is under active development, so this notice will change as the product does, for example when card payments and booking emails arrive. We will update this page and its date each time. See also our terms of use.