Effective date: September 22, 2026
Last updated: October 9, 2026
Ticketly ("the App"), provided by MerchBytes ("we", "us", or "our"), lets Shopify merchants create admission tickets, sell them through Shopify POS, print them with a QR code, validate them at the entrance and review ticket sales ("the Service"). This Privacy Policy explains what information we collect, how we use and share it, how long we keep it and what rights you have when you install or use the App with your Shopify store.
Information the App Collects
We process only the information needed to provide the Service:
- Store and account information: your store's myshopify domain, your Shopify store ID and the store contact email address that Shopify provides when you open the App, and whether the App is installed. We also read your store name, currency and time zone from Shopify when they are needed, for example to print your store name and the correct dates on tickets; we do not keep a separate copy of them.
- Authentication information: the Shopify access token and the session tokens used to connect the App to your store and to verify each request from your Shopify admin and Shopify POS.
- Ticket catalogue: the tickets you create: name, price, colour, validity rule, optional ticket limit and, if you choose, the Shopify product variant a ticket is sold as, with its title.
- Sold tickets: for each ticket sold, its 12-digit ticket code, ticket name, price, validity date, the Shopify order ID and order line item ID, the POS location ID and the POS staff member ID, the time of sale, the time of redemption once the ticket is used and, if a refund voids the ticket, the time of the refund and the Shopify refund ID.
- App settings: the business name printed on tickets and whether tickets print automatically.
- Report exports: when you download or email a report, a record of the period, location and time zone requested and a download link that expires after 24 hours. When you email a report, we use the email address you enter only to send that email; the App does not store it.
- Technical and support information: request and error logs kept by our servers, and the information you send us when you contact support or make a privacy request.
We receive this information from Shopify and Shopify POS, from what you and your staff enter in the App, and from your messages to us.
What we do not collect. Ticketly does not collect personal information about your customers (ticket buyers): no names, email addresses, phone numbers or postal addresses. It stores no staff names, only the numeric staff member ID that Shopify POS provides. It never receives or stores payment card details: payments are taken by the Shopify POS checkout, and the App only records which ticket lines were paid or refunded. A ticket carries only a random code, and the App does not track who holds it. The App does not use advertising or analytics trackers.
Information kept in your Shopify store. When a cashier adds tickets to the cart, the App adds the ticket details (ticket ID, name, price, validity date and ticket codes) to that cart line as hidden line-item properties. They become part of the order in your Shopify store.
On the POS device. Until they reach our servers, sold tickets are kept in the App's storage on the Shopify POS device, for example during a network outage. The App also keeps there a note of which orders were printed and a status marker used to warn staff when sold tickets have not reached our servers yet. These entries are removed or overwritten once they are sent or no longer needed.
Shopify Permissions
The App requests read_products, so that you can link a ticket to one of your product variants, read_locations, to show location names in reports, and read_orders, so that the App can issue the ticket codes of an order as soon as Shopify reports it as paid and void the tickets of refunded items. With this permission, order information reaches the App only through two webhooks: from orders/paid only the order identifier, the order line item identifiers, location, time and the ticket lines are kept; from refunds/create only the refund identifier and the refund time are kept, on the tickets the refund voids. A voided ticket is marked "Refunded": it can no longer be redeemed and is no longer counted in reports or against the ticket limit. The App does not read customer records and does not store the buyer’s name, contact details or payment data.
How We Use Information
We use information to:
- Connect the App to your store and authenticate requests.
- Store your tickets, record tickets sold after payment, void the tickets of refunded items, validate ticket codes and undo redemptions.
- Show ticket codes after checkout, print tickets and provide reports and report exports.
- Check your Ticketly subscription through Shopify billing.
- Respond to support and privacy requests.
- Diagnose problems, keep the App secure and improve it.
- Meet legal obligations and address disputes or misuse.
We do not sell or rent personal information and do not use it for advertising.
If the EU or UK General Data Protection Regulation applies to you, we process your store information to provide the Service you installed (performance of a contract), to keep the App secure and to support you (our legitimate interests), and where the law requires it (legal obligations). For information about your staff and orders that you process with the App, such as POS staff member IDs and order IDs, we act on your behalf as your service provider (processor).
Sharing Information
We exchange information with Shopify as needed to provide the Service. Shopify's own handling of your data is described in Shopify's Privacy Policy. Ticket and sales records are available to people who have access to the App for your store.
We use service providers to host and operate the App: our servers and database run on Amazon Web Services (AWS) in the United States, and report emails are sent through AWS. If you use the App from outside the United States, your information is transferred to and processed in the United States. When you print tickets, the ticket content is sent through Shopify POS to the printer you choose.
We may disclose information when required by law, to respond to lawful requests or to protect our rights.
Data Retention and Deletion
We keep information while the App is installed on your store and as long as needed to provide the Service.
When you uninstall the App, we mark your store's installation as uninstalled. About 48 hours later Shopify sends us a shop data erasure request (shop/redact). We then permanently delete your store's Ticketly data: tickets, sold tickets, settings and report records. Report download links expire 24 hours after they are created, and a generated report file is deleted from our server once it is downloaded.
Because the App holds no personal information about your customers, customer data requests from Shopify (customers/data_request and customers/redact) find nothing to return or delete.
The installation record (store domain, Shopify store ID, contact email and access token) is marked as uninstalled straight away and is deleted with the rest of your store's data when the shop data erasure request arrives. Server logs and backups are kept for a limited period and then deleted or overwritten. Printed tickets and the orders in your Shopify store follow your own and Shopify's retention practices.
Your Rights
Depending on the laws that apply to you, including the GDPR and US state privacy laws, you may have the right to access, correct, update, export or delete personal information we hold about you, to object to or restrict some processing, and to complain to a data protection authority.
To make a request, email us at the address below, name the Shopify store concerned and describe the request. We may need to verify your identity or your authority to act for the store. We respond within the time required by the applicable law.
If you are a customer or staff member of a store that uses Ticketly, please contact that store first; we will help the merchant respond.
Security
Requests between Shopify POS, your Shopify admin and our servers use HTTPS and are verified with Shopify session tokens. Access to our systems is limited to people who need it to operate the App.
Changes
We may update this Privacy Policy to reflect changes to the App, our practices, or legal or regulatory requirements. We will publish the updated policy on this page and change the "Last updated" date above.
Contact Us
For questions about our privacy practices, privacy requests or complaints, email contact@merchbytes.com or write to:
MerchBytes
8 The Green, STE A
Dover, DE 19901
USA