Privacy Policy

Effective: May 20, 2026

1. Introduction

Music By Masses LLC ("we," "us," or "our"), a Colorado limited liability company, operates fan.tickets (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you access or use our Platform. We are committed to protecting your privacy and handling your data in accordance with applicable law, including the Colorado Privacy Act (CPA), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable state privacy laws.

By using our Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Platform.

2. Data We Collect

We collect the following categories of personal information from the following sources:

Information You Provide Directly

• Account Data: Phone number (required for SMS authentication), name, email address
• Purchase Data: Order history, ticket and merchandise details, transaction amounts, promo codes used
• Shipping Data: Physical mailing address (collected when purchasing merchandise)
• Communications: Messages you send to our support team

Information Collected Automatically

• Device and Technical Data: IP address, browser type and version, device type, operating system, screen resolution
• Usage Data: Pages visited, features used, search queries, referring URLs, session duration, click patterns, and sampled session replay recordings (see Section 7)
• Advertising and Analytics Data: Data collected through Google Analytics and the Meta Pixel, including page views, conversion events (such as ticket purchases, add-to-cart actions, and checkout initiation), and hashed or anonymized identifiers used for advertising measurement and attribution

Information from Third Parties

• Payment Data: Transaction confirmations and fraud signals from Stripe, our payment processor. We do NOT receive or store your full credit card number, CVV, or expiration date — this data is collected and processed directly by Stripe.

Sensitive Personal Information

We may process the following categories of sensitive personal information as defined under CCPA/CPRA: phone number (account login credential) and financial information (payment data processed by Stripe). We use sensitive personal information only for the purposes of providing our services to you and do not use it for profiling or targeted advertising.

3. How We Use Your Data and Legal Basis

We process your personal information for the following purposes and legal bases:

• Contract performance: Process orders, deliver digital tickets, ship merchandise, authenticate your account via SMS, send transactional communications (order confirmations, event updates, shipping notifications)
• Legitimate interest: Prevent fraud and ensure platform security, improve the Platform through analytics and usage patterns, respond to support requests, protect our legal rights
• Consent: Send marketing communications (you may opt out at any time)
• Legal obligation: Comply with tax, accounting, and reporting requirements, respond to valid legal process and government requests, maintain records as required by law

4. How We Share Your Data

We share your information with the following categories of third parties only as necessary for the purposes described below:

• Event Partners (venues and organizations): Your name and email for event check-in, entry management, and event-related communications. We do NOT share your payment data, phone number, or shipping address with Event Partners unless required for merchandise fulfillment. Event Partners are independent data controllers for the data they receive and are responsible for their own privacy practices.
• Stripe (payment processor): Payment data is collected and processed directly by Stripe, which acts as a data processor on our behalf. Certain Event Partners receive payments through Stripe Connect, where Stripe processes payments on behalf of both Music By Masses LLC and the Event Partner. See Stripe's Privacy Policy .
• SMS service provider: Your phone number is shared with our SMS service provider for sending verification codes and transactional messages.
• Shipping providers: Your name and shipping address for merchandise fulfillment.
• Legal requirements: We may disclose your information to comply with applicable law, legal process, court orders, subpoenas, or government requests.
• Analytics and advertising platforms: We use Google Analytics and the Meta Pixel to measure Platform usage, advertising performance, and conversion events. These services may collect or receive data such as page views, purchase events, device identifiers, and IP addresses. Meta may use this data in accordance with Meta's Privacy Policy . Google may use this data in accordance with Google's Privacy Policy .
• Error monitoring and session replay (Sentry): We use Sentry (Functional Software, Inc.) to detect, diagnose, and fix errors and to record a sample of user sessions for debugging and security purposes. Sentry receives technical and usage data including IP address, device and browser information, error reports, and session replay recordings. See Sentry's Privacy Policy .
• Mapping and content delivery (Google): Event pages display venue locations using Google Maps and load typefaces from Google Fonts. When these load, Google receives your IP address and basic request data. See Google's Privacy Policy .
• Business transfers: In the event of a merger, acquisition, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you of any such transfer and any choices you may have regarding your information.

5. Sale and Sharing of Personal Information

We do not sell your personal information as defined under the CCPA/CPRA or any other applicable state privacy law.

Sharing for advertising measurement: We use the Meta Pixel and Google Analytics to measure the effectiveness of our advertising campaigns and to understand how users interact with the Platform. These technologies may share certain data (such as conversion events, device identifiers, and IP addresses) with Meta and Google. Under CCPA/CPRA, this may constitute "sharing" of personal information for cross-context behavioral advertising. You have the right to opt out of this sharing. To opt out, you may:

• Enable Global Privacy Control (GPC) in your browser — we honor GPC signals as a valid opt-out request
• Contact us at main@musicbymasses.com with the subject line "Opt Out of Sharing"
• Use browser-based tools to block tracking pixels (e.g., ad blockers or privacy-focused browser extensions)

We do not use or disclose sensitive personal information for purposes other than those permitted under CCPA/CPRA, including providing the services you request. You have the right to limit the use of your sensitive personal information, though we only use it for permitted purposes as described in this policy.

6. SMS and Phone Number

Your phone number is the primary identifier for your account and is used for SMS-based authentication. By providing your phone number and using the Platform, you consent to receiving SMS messages for the following purposes:

• Verification codes during account login and authentication
• Order confirmation and receipt notifications
• Event reminder notifications
• Shipping status updates for merchandise orders

Message frequency: Approximately 2–5 messages per transaction. Standard message and data rates may apply. You may opt out of non-essential SMS messages at any time by replying STOP to any message. Note that opting out of verification codes will prevent you from logging into your account.

We will not use your phone number for marketing or promotional purposes without your separate, explicit prior consent. We do not share your phone number with Event Partners or other third parties for their marketing purposes.

7. Cookies and Tracking Technologies

We use strictly necessary cookies for session management and user authentication. These cookies are essential for the Platform to function and cannot be disabled.

We also use the following analytics and advertising measurement technologies:

• Google Analytics (GA4): We use Google Analytics to understand how users interact with the Platform. Google Analytics collects data such as pages visited, session duration, and device information. This data is used to improve the Platform experience. See Google's Privacy Policy and opt out of Google Analytics .
• Meta Pixel: We use the Meta Pixel to measure the effectiveness of our advertising on Meta platforms (Facebook, Instagram). The Meta Pixel collects data about your interactions with the Platform, including page views, ticket purchases, add-to-cart actions, and checkout events. This data is sent to Meta and may be used by Meta for ad targeting and measurement. See Meta's Privacy Policy . You can manage your Meta ad preferences at Meta Ad Preferences .
• Session Replay (Sentry): To diagnose errors and improve reliability and security, we use Sentry to record a sample of user sessions. These recordings capture interactions such as page navigation, clicks, and scrolling. Text content and form inputs — including any payment details — are masked by default and are not visible in the recording. Replays are used only for debugging, fraud prevention, and platform security, and are not used for advertising or sold to third parties. See Sentry's Privacy Policy .

We do NOT sell your data to advertisers or data brokers.

Global Privacy Control (GPC): We honor Global Privacy Control signals received from your browser. When we detect a GPC signal, we treat it as a valid opt-out request under applicable state privacy laws. We do not currently respond to "Do Not Track" browser signals, as there is no industry-standard protocol for interpreting them.

8. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

California Residents (CCPA/CPRA)

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the third parties with whom we share it
• Right to Delete: Request deletion of your personal information, subject to certain exceptions (e.g., legal obligations, transaction completion)
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt Out of Sale/Sharing: We do not sell or share your personal information, but you may still submit an opt-out request
• Right to Limit Sensitive Information: Request that we limit the use of your sensitive personal information to purposes necessary for providing services
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights

Colorado Residents (CPA)

• Right to Access: Confirm whether we are processing your data and access your personal data
• Right to Correct: Correct inaccuracies in your personal data
• Right to Delete: Request deletion of your personal data
• Right to Data Portability: Obtain a copy of your personal data in a portable, readily usable format
• Right to Opt Out: Opt out of targeted advertising, sale of personal data, or profiling (we do not engage in any of these activities)
• Right to Appeal: Appeal our decision regarding a privacy rights request

Virginia, Connecticut, Texas, Oregon, and Other State Residents

If you are a resident of Virginia (VCDPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), Montana (MCDPA), or any other state with a comprehensive consumer privacy law, you may have similar rights to access, correct, delete, and port your personal data, as well as the right to opt out of targeted advertising, sale of personal data, or profiling. We do not engage in the sale of personal data, targeted advertising, or profiling as defined under these laws. To exercise your rights, contact us using the information below.

How to Exercise Your Rights

To exercise any of these rights, contact us at main@musicbymasses.com with the subject line "Privacy Rights Request." We will verify your identity by sending a verification code to the phone number associated with your account. If you do not have an account, we may request additional identifying information.

We will acknowledge your request within 10 business days and provide a substantive response within 45 days. If we require additional time (up to an additional 45 days), we will notify you of the extension and the reason. You may designate an authorized agent to submit a request on your behalf, provided the agent can verify your identity and authorization.

9. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, as described in this policy, unless a longer retention period is required or permitted by law:

• Account data: Retained while your account is active, plus 30 days after account deletion to allow for account recovery
• Transaction records: 7 years from the date of the transaction, as required for tax, accounting, and legal compliance
• SMS verification codes: Deleted immediately after verification or expiration (typically within 10 minutes)
• Shipping data: Retained for the fulfillment period plus 180 days for dispute resolution and chargeback processing
• Usage and technical data: 12 months from collection
• Session replay recordings and error reports: 90 days from collection
• Support communications: 3 years from the date of the communication

10. Data Security

We implement reasonable and appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL protocols
• Payment processing handled exclusively by Stripe, which is PCI DSS Level 1 certified
• Role-based access controls limiting employee access to personal data
• Regular monitoring and logging of system access

While we take reasonable measures to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

Data Breach Notification: In the event of a data breach that affects your personal information, we will notify you as required by applicable law, including Colorado's data breach notification law (C.R.S. § 6-1-716), which requires notification within 30 days of determining that a breach has occurred. We will also notify any applicable regulatory authorities as required.

11. Children's Privacy

We do not knowingly collect personal information from children under the age of 13 in compliance with the Children's Online Privacy Protection Act (COPPA). Our Platform is not directed to children under 13, and we do not knowingly allow children under 13 to create accounts or make purchases.

If we discover that we have inadvertently collected personal information from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us immediately at main@musicbymasses.com.

Minors between 13 and 17 may use the Platform but must have a parent or legal guardian create the account, make purchases on their behalf, and consent to this Privacy Policy.

12. International Visitors

The Platform is operated from the United States and is intended for users located within the United States. If you access the Platform from outside the United States, please be aware that your personal information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those of your country of residence. By using the Platform, you consent to the transfer of your information to the United States and the processing of your data as described in this Privacy Policy.

We do not intentionally market the Platform to individuals located in the European Economic Area (EEA), the United Kingdom, or other jurisdictions that require compliance with the General Data Protection Regulation (GDPR) or similar frameworks. If you are located in such a jurisdiction, please do not provide personal information through the Platform.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated to you via email or SMS notification at least fifteen (15) days before the changes take effect. The "Effective" date at the top of this page will reflect the most recent revision.

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the revised policy. If you do not agree to the revised policy, you must discontinue use of the Platform. Prior versions of this policy are available upon request.

14. Contact Us

For privacy-related questions, concerns, or to exercise your rights under applicable privacy law, contact us at:

Music By Masses LLC
Email: main@musicbymasses.com
Subject line: "Privacy Inquiry" or "Privacy Rights Request"

For Colorado residents: if you are not satisfied with our response to your privacy rights request, you have the right to appeal by contacting us with the subject line "Privacy Rights Appeal." If your appeal is denied, you may contact the Colorado Attorney General's office.