Privacy Policy

1. Who We Are

Tenbai ("we", "our", "us") is a student ticket resale marketplace operated by William Dean. We connect university students who want to buy and sell event tickets safely.

Data controller contact: hello@tenbai.co.uk

If you have any questions about how we handle your data, please contact us at the address above before escalating to the ICO.

2. Data We Collect

We collect the following categories of personal data:

Account data: full name; university email address (.ac.uk); year of study; university name (inferred from your email domain); profile photo (optional).

Transaction data: tickets listed and purchased; chat messages between buyers and sellers; ticket files and transfer links uploaded by sellers; payment records (amount, date, Stripe payment intent ID); payout records (amount, date, Stripe transfer ID).

Payout setup data: sort code and account number (transmitted to Stripe only, not stored by us); date of birth and address (transmitted to Stripe for identity verification, not stored by us); Stripe account ID.

Device and app data: push notification token and device platform (iOS, Android, or web), if permission granted; crash reports and diagnostic data collected automatically by our crash reporting provider (Sentry).

Preferences and activity data: events you have saved (bookmarks); price alerts you have set on events; and event suggestions you submit to us.

Bug reports: if you send one from Settings → Report a bug, your description, an optional screenshot, your name and email address, and your device model and app version.

In-app notification history: records of notifications we send you within the app (for example sale confirmations, payout alerts, and price alerts), including related event names and transaction references, retained until you delete them or close your account.

Review and trust data: ratings and written reviews left by buyers; reports submitted about other users or listings.

Seller email access log: when a signed-in user views a seller profile, we record which account viewed which seller and when. We use this only to detect and prevent bulk collection of student email addresses, and it is retained for 30 days.

Waitlist data (website visitors): if you join the waitlist on our website before creating an account, we collect the email address and university you provide on that form.

3. Legal Basis for Processing (UK GDPR)

We process your personal data under the following legal bases under Article 6 of the UK General Data Protection Regulation (UK GDPR):

Contract performance (Article 6(1)(b)): processing your account, transaction, and payout data is necessary to provide the Tenbai service you have agreed to use.

Legal obligation (Article 6(1)(c)): we are required to retain certain financial records for a minimum of six years under UK tax law.

Legitimate interests (Article 6(1)(f)): we process diagnostic and crash data and the bug reports you send us, and take fraud prevention measures, on the basis of our legitimate interest in maintaining a safe and functional service.

Consent (Article 6(1)(a)): we send push notifications only where you have granted permission on your device. You may withdraw consent at any time in your device's notification settings.

4. How We Use Your Data

We use your personal data to: create and maintain your account; verify your UK university student status; enable ticket listings and purchases; process payments and hold funds in escrow until delivery is confirmed; transfer payout funds to your bank account; facilitate secure buyer–seller messaging; send you push notifications about price alerts, purchases, messages, and payouts (with your permission); display your name, university, rating, and avatar to other users in the context of a transaction or your public seller profile; detect and prevent fraud and policy violations; respond to dispute reports and resolve buyer protection claims; and comply with legal obligations including financial record-keeping.

5. Who We Share Data With

We do not sell your personal data to third parties for marketing purposes.

Supabase (database and authentication): your account data, transaction records, messages, and ticket files are stored on Supabase infrastructure hosted in the United Kingdom (London). Supabase acts as a data processor on our behalf. Privacy policy: supabase.com/privacy.

Stripe (payments and payouts): payment information, bank details, date of birth, and address are processed by Stripe, Inc. Stripe is an independent data controller for its own compliance purposes and is registered with the UK ICO. Privacy policy: stripe.com/gb/privacy.

Expo (push notifications): if you enable push notifications, your device push token is registered with Expo's notification service. Privacy policy: expo.dev/privacy.

Sentry (crash reports and bug reports): crash reports, diagnostic data, and any bug reports you send from Settings → Report a bug (your description, an optional screenshot, your name, email address, device model and app version) are processed by Sentry (Functional Software, Inc.) to help us find and fix problems. Sentry stores this data in the European Union (Frankfurt, Germany). Privacy policy: sentry.io/privacy.

Resend (email delivery): we use Resend to send you one-time verification codes when you sign in, and account or security notifications. Resend processes your email address for this purpose. Privacy policy: resend.com/legal/privacy-policy.

Zoho Mail (our mailbox): our own hello@tenbai.co.uk mailbox is hosted by Zoho Mail, so if you email us, your message and email address are processed by Zoho. Privacy policy: zoho.com/privacy.html.

Law enforcement and regulatory bodies: we may disclose personal data if required to do so by law, court order, or a regulatory body, or to prevent fraud or protect the safety of our users.

Other users (limited): your name, university, year of study, average rating, review count, and profile photo are visible to other Tenbai users when you list tickets or appear in a transaction. If you list a ticket for sale, your university email address is additionally shown on your seller profile to other signed-in Tenbai users, so that buyers can confirm they are dealing with a genuine student. We limit how many different seller email addresses any single account may view, in order to prevent bulk collection. Your email address is not visible to visitors who are not signed in, and is never published on our public website.

6. International Data Transfers

Supabase stores your data in the United Kingdom (London). This data stays in the UK, so no international transfer safeguards are required for it.

Stripe (US), Expo (US) and Sentry (US, storing data in Frankfurt, Germany) process data outside the UK. These transfers are made on the basis of Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office.

You may request further information about the specific safeguards we rely on by contacting hello@tenbai.co.uk.

7. Data Retention

Account data: retained while your account is active; deleted promptly upon request.

Transaction and financial records: retained for 6 years from the date of the transaction (UK tax law - HMRC).

Ticket files: deleted from storage 30 days after the event date.

Push notification tokens: deleted on sign-out, or within 30 days of inactivity.

Crash and diagnostic data, and bug reports: retained for up to 90 days.

Reviews: retained until deletion is requested or the account is closed.

Seller email access logs: retained for 30 days.

After the applicable retention period, data is deleted or irreversibly anonymised.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access (Article 15): request a copy of all personal data we hold about you.

Right to rectification (Article 16): correct inaccurate or incomplete data. Many fields can be updated directly in the app under Edit Profile.

Right to erasure (Article 17): delete your account at any time in the app under Settings → Delete account, which removes your profile and personal data. Records of completed transactions are retained in anonymised form for 6 years as required by UK tax law. You may also request erasure by contacting hello@tenbai.co.uk.

Right to restriction of processing (Article 18): ask us to restrict processing while a dispute about its accuracy is resolved.

Right to data portability (Article 20): request an export of your personal data in a structured, machine-readable format.

Right to object (Article 21): object to processing based on our legitimate interests.

Right to withdraw consent (Article 7(3)): withdraw consent for push notifications at any time via your device settings.

Right not to be subject to automated decision-making (Article 22): we do not make automated decisions with significant legal effects about you.

9. Exercising Your Rights and Complaints

To exercise any of your rights, contact us at: hello@tenbai.co.uk. We will respond within one calendar month. We may need to verify your identity before processing your request.

If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Website: ico.org.uk/make-a-complaint | Phone: 0303 123 1113 | Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Security

We take appropriate technical and organisational measures to protect your data: all data is transmitted over encrypted connections (HTTPS/TLS); authentication uses one-time verification codes - no passwords are stored; database access is governed by row-level security policies; ticket files are stored in a private storage bucket accessible only via short-lived signed URLs; Stripe handles all card data directly and we never see or store card numbers; bank details are transmitted directly to Stripe and not stored in our database.

Despite these measures, no system is completely secure. If you believe your account has been compromised, contact hello@tenbai.co.uk immediately.

11. Children's Privacy

Tenbai is intended for UK university students aged 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with data, please contact hello@tenbai.co.uk and we will delete it promptly.

12. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify you by in-app notification or email at least 14 days before the change takes effect.

13. Contact Us

Tenbai | Email: hello@tenbai.co.uk | Website: tenbai.co.uk

For data protection queries, please include "Privacy" in your subject line.