Privacy Policy

1. Who controls your personal data

The legal operator identified above is the controller of personal data processed for THE MILLION SEATS, except where a third-party provider acts as an independent controller for its own purposes.

Privacy contact: Available before live consumer sales.

2. Data we process

• Purchase and transaction data: seat code, product selected, price, transaction identifiers, payment status and billing/tax information where required.
• Checkout acceptance records: the versions of the Terms, Content Policy and Privacy notice presented at checkout; confirmation of the required checkout acknowledgements; the related reservation/checkout identifiers; and the server timestamp of acceptance.
• Public Seat data: display name, website URL, short message, seat location and Founder status where applicable.
• Technical and security data: IP address, device/browser information, timestamps, request logs, security events and diagnostic information.
• Contact data: your purchase email address received from the payment checkout for transactional purchase confirmation, plus information you provide when contacting us or exercising a legal right.
• Moderation and safety records: internal restriction status, reason, administrative notes, relevant seat/domain identifiers and an audit history of moderation actions.

Payment-card details are generally collected directly by the payment processor rather than by THE MILLION SEATS.

3. Why we use personal data

• To create, maintain and display your digital seat and provide the contract.
• To record and evidence the terms and checkout acknowledgements associated with a purchase.
• To process payments, refunds and transaction records.
• To prevent fraud, abuse, security incidents and misuse.
• To comply with tax, accounting, consumer, legal and regulatory obligations.
• To send the transactional purchase-confirmation email containing the Public Seat link and purchase summary.
• To answer support and privacy requests and to enforce safety and content rules.
• To protect and improve the reliability of the service.

4. Legal bases

Depending on the activity, processing is based on performance of a contract, compliance with legal obligations, legitimate interests in operating and securing the service, and consent where consent is required by law.

5. Public information

Public Seat information is intentionally public. Do not publish information you want to keep private. Public content may be copied or shared by other internet users beyond our control.

6. Service providers and recipients

We may use service providers for payments, hosting, content delivery, security, database/storage, email and professional advice. Current core infrastructure may include Stripe for payment processing, Cloudflare for hosting, network, security and related infrastructure services, and Resend for transactional email delivery when that feature is enabled.

Providers process data under their own terms and data-protection arrangements where applicable.

7. International transfers

Some service providers may process data outside the European Economic Area. Where required, transfers are made using legally recognised safeguards, adequacy decisions or other valid transfer mechanisms.

8. Storage and retention

Public Seat data is retained while the seat claim remains active, unless it must be removed earlier. Transaction, checkout-acceptance, tax and accounting information is kept for the periods reasonably required to administer and evidence the contract and to comply with applicable statutory obligations. Security and technical records are retained only for as long as reasonably necessary for security, diagnostics and legal obligations.

9. Cookies and local storage

The service may use strictly necessary cookies, browser storage or equivalent technologies for checkout state, security and core functionality. Non-essential analytics or advertising technologies will not be introduced without updating this notice and, where required, obtaining consent.

10. Your rights

Subject to applicable law, you may have rights of access, rectification, erasure, restriction, objection and data portability, and the right to withdraw consent where processing is based on consent.

You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or the competent supervisory authority in your country.

11. Children

The paid service is not directed to children. Purchasers must meet the eligibility requirements in the Terms.

12. Security

We use technical and organisational measures intended to protect personal data. No internet service can guarantee absolute security.

13. Changes to this Privacy Policy

We may update this policy when processing activities, providers or legal requirements change. The date at the top identifies the currently published version.