Privacy Policy

MAG Tickets is operated by ThreeSixty Group LLC ("MAG", "we", "us"). When you buy a ticket, MAG is the data controller for your order. This policy explains what we collect, why, and what you can do about it.

We collect only what we need to sell you a ticket and let you into an event:

• ·Identity & contact: your name and email address, given at checkout.
• ·Order data: the events and tickets you buy, quantity, price, promo codes, and your unique QR codes.
• ·Payment status: whether a payment succeeded or failed. We do NOT collect or store your full card number — that is handled entirely by our payment processor, ONVO Pay.
• ·Technical data: IP address and basic request metadata, used for security, fraud prevention, and rate limiting.

We do not store full credit/debit card numbers, CVV codes, or card expiry dates. Card details are entered inside ONVO's secure, PCI-compliant payment form and never touch our servers.

We do not sell your personal data to anyone, ever.

We use your data to:

• ·Process your order and deliver your tickets by email.
• ·Validate entry at the door via your QR code.
• ·Send you transactional messages about your order (confirmations, changes, cancellations).
• ·Prevent fraud, abuse, and oversell, and keep the platform secure.
• ·Comply with tax and accounting obligations in Costa Rica.

We share data only with the service providers we need to run the platform, and only what they need:

• ·ONVO Pay — to process your payment.
• ·Supabase — our database and infrastructure host, where your order is stored.
• ·Resend — to send you your ticket and order emails.
• ·Vercel — our hosting/CDN provider.
• ·Event organizers — for organizer-run events, the organizer receives the attendee list (name, email) needed to run that specific event.

We keep order and ticket records for as long as needed to provide the service and meet legal, tax, and accounting requirements in Costa Rica. After that, records are deleted or anonymized.

We protect your data with encryption in transit (HTTPS), strict server-side access controls, rate limiting, input validation, and a content security policy. Payment card data is isolated inside ONVO's PCI-compliant environment.

No system is perfectly secure, but we follow industry best practices and keep our attack surface small.

You can ask us to access, correct, or delete the personal data we hold about you, subject to our legal obligation to retain certain records. To make a request, email us and we'll respond within a reasonable time.

We use only the minimal storage needed to make the site work — for example, keeping your pending order during checkout. We do not use third-party advertising or tracking cookies.

We may update this policy as the platform evolves. The "last updated" date reflects the current version.