1. Who we are
UniRelay is operated by UNIRELAY LTD. For UK data protection purposes, UNIRELAY LTD is the controller of the personal information described in this policy.
You can contact us about privacy, support or account deletion at support@unirelay.co.uk.
UniRelay is intended for users aged 18 or over. You must not use UniRelay if you are under 18.
2. Information we collect
The information we collect depends on how you use UniRelay. It may include:
- Account information, such as your full name, email address, user ID, university, year of study, profile photo and student verification status.
- Authentication and session information, such as login identifiers and authentication records managed through Supabase.
- Device notification information, such as Expo push tokens and device-level notification identifiers associated with your authenticated UniRelay user account and device when you choose to enable push notifications.
- Ticket listing information, including event name, date, time, venue, entry conditions, face value, selling price, listing status and seller ID.
- Uploaded files, including ticket images, PDFs, screenshots and proof-of-purchase files provided for listing, verification, support or dispute handling.
- Ticket verification information, including extracted event details, verification decisions, whole-file hashes, QR or barcode hashes, QR/barcode detection status and duplicate-ticket checks.
- Purchase and transaction information, including buyer and seller IDs, ticket ID, offer ID, payment status, payout status, Stripe payment and charge identifiers, transfer identifiers, amounts, buyer service fees and timestamps.
- Offers and messages entered in the app, such as offer amounts, counter-offers, offer status and related timestamps.
- Disputes and problem reports, including the purchase involved, reason selected, details you provide, status, resolution and administrator review notes or actions.
- Proof-of-purchase emails, where a seller forwards or sends proof to a UniRelay proof address. This may include email headers, sender, subject, email body, attachments, Resend message identifiers and extracted proof-check results.
- Seller payout information, including Stripe connected account ID, onboarding status, whether payouts and charges are enabled, whether details have been submitted and the time UniRelay last checked the account status.
- Support communications, including emails sent to support and any information needed to respond to your request.
- Technical, security and fraud-prevention information, such as logs, request metadata and information produced by our infrastructure providers where needed to operate and protect UniRelay.
3. Payments, Apple Pay and seller payouts
Payments are processed by Stripe. UniRelay supports card payments and Apple Pay through Stripe where available. UniRelay does not store full payment-card numbers, Apple Pay payment credentials, bank account credentials or Stripe identity documents.
Stripe may collect and process payment details, Apple Pay tokens, seller bank details and identity/KYC information directly. UniRelay may receive and store the identifiers, transaction records, verification status, payout status, connected account status and related information needed to operate the marketplace, handle disputes, prevent fraud, process refunds and release seller payouts.
4. Push notifications
UniRelay may use push notifications for App Functionality if you choose to allow them on your device. We use them for transactional marketplace updates, such as offers, ticket sales, refunds, seller payout updates and ticket verification status.
When push notifications are enabled, UniRelay stores Expo push tokens and related device-level notification identifiers with the authenticated UniRelay user and device. These token mappings let us send the notification to the correct signed-in user and support multiple devices for the same account.
Push notifications are delivered using Expo Push Service and Apple Push Notification service (APNs). UniRelay does not use push tokens or notification identifiers for advertising, behavioural advertising or cross-app tracking.
Push notifications are optional. You can deny permission when asked, disable notifications in iOS Settings, or continue using UniRelay without push notifications. UniRelay unregisters or removes token mappings on logout and account deletion according to the implemented account and device-token controls.
Notification payloads are designed to avoid sensitive payment, bank, KYC, identity-document and ticket-barcode information. A notification may contain a general marketplace update and a safe in-app destination, but it should not include private ticket files, QR codes, full payment details, bank details or Stripe secrets.
5. How we use information
We use personal information to:
- create, authenticate and manage UniRelay accounts;
- show listings and profile information needed for the marketplace;
- let users list, reserve, buy and sell student event tickets;
- verify ticket details, check uploaded tickets and proof of purchase, and detect duplicate or suspicious tickets;
- process payments, refunds and seller payouts through Stripe;
- hold seller payouts during the buyer protection period, open disputes, suspected fraud, incomplete verification or payment-provider requirements;
- send optional transactional push notifications about important marketplace events, where you have allowed notifications;
- provide support, respond to account requests and investigate problem reports;
- detect, prevent and investigate fraud, abuse, duplicate tickets, invalid tickets and security incidents;
- maintain, troubleshoot, secure and improve UniRelay; and
- comply with legal, tax, accounting, regulatory and payment-provider obligations.
6. Lawful bases under UK GDPR
We rely on different lawful bases depending on the context:
- Contract: to provide the UniRelay marketplace, accounts, listings, purchases, offers, support, payment flows and seller payout setup requested by users.
- Legal obligation: to keep records required for tax, accounting, consumer, fraud-prevention, dispute, payment and regulatory reasons.
- Legitimate interests: to protect users and UniRelay, prevent fraud and duplicate ticket sales, secure the service, resolve disputes, enforce our terms and improve marketplace reliability.
- Consent: where the app or law requires consent, such as optional device permissions or other optional features. You can withdraw consent through your device settings or by contacting us where applicable.
8. International transfers
Some service providers may process personal information outside the United Kingdom. Where required, we rely on appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU standard contractual clauses, or other lawful transfer mechanisms.
9. Retention
We keep personal information only for as long as reasonably needed for the purposes described in this policy.
Sold ticket and proof files are scheduled for cleanup 30 days after the event unless there is an open dispute. If a dispute is open, the relevant files may be retained until the dispute is resolved.
Push token mappings are updated when a device token changes and are unregistered or removed on logout and account deletion according to UniRelay's device-token controls. Invalid or unregistered device tokens may also be removed when reported by the push notification delivery providers.
Other records, including purchase records, transaction history, payout records, refund records, dispute records, fraud-prevention records and legal or accounting records, may be retained where reasonably required for accounting, tax, fraud prevention, dispute handling, enforcement, payment-provider requirements or legal compliance.
10. Security
We use technical and organisational measures designed to protect personal information, including authenticated access, private storage for ticket files, backend access controls, webhook validation, duplicate-ticket checks and provider security controls. No online service can guarantee absolute security.
Please do not email passwords, full card numbers, bank login details, identity documents or other sensitive security credentials to UniRelay support.
11. Account deletion
You can request account deletion in the app or by contacting support@unirelay.co.uk. UniRelay may need to delay deletion while there is an open dispute, pending payment, active paid ticket, pending or held seller payout, or another legal, payment, safety or fraud-prevention reason.
When deletion is completed, active unsold listings, related private files and push token mappings are removed where appropriate, some profile and verification records are deleted, and buyer/seller references on completed transaction records may be anonymised rather than deleted where UniRelay must retain transaction records.
12. Your rights
Under UK data protection law, you may have rights to access, correct, delete, restrict or object to our use of your personal information, and to receive a copy of information you provided to us. You may also have the right to withdraw consent where processing is based on consent.
To exercise your rights, contact support@unirelay.co.uk. We may ask you to verify your identity before acting on a request.
You also have the right to complain to the Information Commissioner’s Office. You can contact the ICO at ico.org.uk/make-a-complaint.
13. Changes to this policy
We may update this Privacy Policy as UniRelay develops or legal requirements change. We will update the “Last updated” date when we make material changes.
14. Contact
For privacy questions, support, account deletion or rights requests, contact support@unirelay.co.uk.