Valid — Privacy Policy

1. Scope

This Privacy Policy explains how Valid collects, uses, shares, and protects personal information when you use the Valid concierge, websites, and applications (the “Platform”). It applies to buyers, sellers, and visitors.

2. Information We Collect

• Account information: name, email, phone number, password.
• Transaction information: purchases, listings, payouts, and related records.
• Identity verification information: a government-issued ID, proof of address, and a photograph (selfie). See Section 5 for how the selfie is handled.
• Payment information: handled by our third-party payment processor, Stripe, Inc. We receive limited details such as the last four digits of a card or bank account, not full numbers.
• Device and usage information: IP address, device identifiers, log and analytics data, and cookies (Section 9).

3. How We Use Information

We use information to operate the concierge, process transactions, verify identity and prevent fraud, provide support, comply with legal and anti-money-laundering (AML) obligations, communicate with you, and improve the Platform. Specifically for compliance, we use identity and transaction data to perform sanctions screening against government watchlists (including OFAC), monitor for suspicious activity, and file legally required reports.

4. Legal Bases for Processing (UK/EU Users)

If you are located in the UK or European Economic Area (EEA), we process your personal data under the following legal bases:

• Performance of a Contract: To provide the Platform services, process transactions, and enforce our Terms of Service.
• Legal Obligation: To comply with applicable laws, including AML and sanctions requirements.
• Legitimate Interests: To prevent fraud, ensure security, and improve the Platform, provided these interests are not overridden by your data protection rights.
• Consent: Where required by law, such as for non-essential cookies or certain marketing communications. You may withdraw consent at any time.

5. Identity Verification and KYC

When you complete identity verification (KYC), we collect your government-issued ID, proof of address, and a photograph of you (a selfie). We may use third-party verification vendors to assist with this process. A trained reviewer manually compares the selfie to the photograph on your ID. We do not use facial-recognition technology, and we do not create biometric templates, faceprints, or scans of face geometry from your photograph.

Your selfie is permanently deleted within 90 days of the verification decision. Your ID document and other KYC data are retained for the period required by anti-money-laundering law (see Section 7).

6. How We Share Information

• Service providers: Stripe for payments; verification, hosting, communications, and analytics providers, under contract.
• Other users: limited information necessary to complete a transaction (for example, ticket transfer details).
• Legal and safety: where required by law, to comply with legal process, or to protect rights, safety, and the integrity of the Platform.
• Business transfers: in connection with a merger, acquisition, or sale of assets.

We do not sell your personal information. We do not “share” your personal information for cross-context behavioral advertising.

7. Data Retention

We retain identity-verification, transaction, and payout records for seven (7) years from the end of our relationship with you, as required by anti-money-laundering and tax laws, and other information for as long as needed for the purposes described. When we delete data, we delete it from active systems and destroy the encryption keys protecting any copies held in backup archives, rendering those copies permanently unreadable; backup archives expire on a rolling schedule.

8. Security

We use technical and organizational measures to protect personal information, including encryption of sensitive data, access controls, and audit logging. No system is perfectly secure, but we work to protect your information and to notify you and authorities of breaches as required by law.

9. Cookies

We use essential cookies to operate the Platform and, with your consent where required, analytics and preference cookies. You can manage choices through our cookie banner and preference center.

9A. SMS/Text Messaging Communications

If you provide your phone number when creating an account or using the Platform, you consent to receive text (SMS) messages from Valid, including one-time passcodes to verify your phone number and secure your account, and transactional messages such as event reminders, ticket purchase confirmations, and resale or payout notifications related to your account activity. Message frequency varies based on your account activity. Message and data rates may apply.

Your mobile phone number and your SMS opt-in and consent data will not be shared with, sold to, or disclosed to third parties or affiliates for marketing or promotional purposes. We share this information only with our SMS service providers (such as Twilio, Inc.) solely to deliver messages on our behalf, and as otherwise required by law.

You can opt out of SMS messages at any time by replying STOP to any message. After opting out, you will receive one final message confirming your opt-out. For help, reply HELP or contact us at support@validtickets.app. Note that opting out of SMS may limit certain Platform features, such as phone-based account verification. Carriers are not liable for delayed or undelivered messages.

10. U.S. State Privacy Rights (including CCPA/CPRA)

If you are a resident of California, Colorado, Connecticut, Utah, Virginia, or other states with applicable privacy laws, you have specific rights regarding your personal information:

• Right to Know/Access: You may request the specific pieces and categories of personal information we have collected about you.
• Right to Delete: You may request the deletion of your personal information, subject to certain legal exceptions (e.g., AML retention requirements).
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out: As stated in Section 6, we do not sell or “share” personal information.
• Non-Discrimination: We will not discriminate against you for exercising these rights.

To exercise your rights, please contact us at privacy@validtickets.app. We will verify your identity before processing your request.

11. Saint Lucia Data Protection Act

If you are a resident of Saint Lucia, we process your personal data in compliance with the Data Protection Act (Cap. 12.21). You have the right to access, correct, or request deletion of your data.

12. International Transfers

We operate using infrastructure located in the United States and elsewhere. By using the Platform, you consent to the transfer of your information to the United States, where data protection laws may differ from those in your jurisdiction. Where we transfer personal information across borders from the UK, EEA, or Saint Lucia, we rely on legally recognized transfer mechanisms, such as Standard Contractual Clauses, to ensure your data remains protected.

13. Children

The Platform is not directed to and may not be used by anyone under 18, and we do not knowingly collect their information.

14. Changes and Contact

We may update this Policy and will notify you of material changes.

Contact: ValidTX, LLC, 1111B S Governors Ave #89349, Dover, DE 19904, privacy@validtickets.app.