Provider: Karelia Labs, Sweden ("we", "us")
Contact for privacy questions: support@karelialabs.atlassian.net
Version / date: 1.0 / 2026-10-20
1. What this policy covers
Karelia Tickets ("the Addon") is an addon for Statamic 6 websites that sells tickets for the site's events. Buyers choose tickets on the site, pay through the site operator's own Stripe account and get QR tickets by email. Staff check tickets in at the door in the site's Control Panel. This policy explains what personal data the Addon handles, where it goes, and what we, the provider, do and do not receive.
2. The short version
- The Addon runs on the site's own server. It never contacts us, sends no usage data, analytics or telemetry, and has no account with us.
- Payments happen on Stripe's own checkout page, in the site operator's Stripe account. Card details never reach the site, and they never reach us.
- Orders are stored on the site's server. We cannot read them.
3. Data handled by the Addon on the site's server
| Data | Examples | Purpose | Where | Retention |
|---|---|---|---|---|
| Buyer | Name and email address entered in the ticket form | Issue and send the tickets, answer questions about the order | One JSON file per order in storage/statamic/karelia-tickets/orders | Until the site operator deletes the order |
| Order | Event, ticket types and quantities, prices, total, currency, order number, status, times of ordering, payment and refund | Run the sale, refunds and the attendee list | The order file | As above |
| Tickets | Ticket codes, the name on each ticket, whether and when it was checked in, and by which staff member | Let ticket holders in once | The order file | As above |
| Payment references | Stripe Checkout Session ID, PaymentIntent ID, refund ID | Match the order to its payment and refund it | The order file | As above |
| Email status | When the tickets were sent, or the error if sending failed | Resend if needed | The order file | As above |
| Settings | Collections, currency, ticket note, the address that gets a copy of each order | Run the Addon | The site's addon settings | Until changed |
The ticket form uses the site's normal Laravel session to show errors; the Addon adds no tracking or advertising cookies. QR codes are made on the site's server, not by an outside service. When staff scan tickets with a phone camera, the image is read in the browser and never leaves the device; only the code is sent to the site.
4. Data sent anywhere
- Stripe (the site operator's account): the buyer's email address, the ticket names, quantities and prices, the order ID and number and the event title, so Stripe can take the payment. Refunds started in the Control Panel are sent to Stripe too. Stripe then handles the payment under the site operator's agreement with Stripe and Stripe's privacy policy.
- Email: the confirmation goes to the buyer, and a copy to the organiser address if the site sets one, through the mail service the site has configured in Laravel.
Nothing else is sent anywhere.
5. Data we receive as the provider
- Support requests: if you contact support we receive what you send us (typically name, email address, site address and the problem description). We use it to answer you and keep it as long as needed for support and legal obligations, for at most 24 months after the last message, unless a longer period is required by law (for example bookkeeping rules).
- Licences: licences are sold through the Statamic Marketplace on statamic.com. Statamic handles the checkout, taxes, receipts, licence keys and refunds under its own terms, and payments to us go through Stripe. We receive the information Statamic gives sellers about a sale, such as the buyer's name or company, email address, the licence and the amount.
- Website: the Karelia Labs website sets no cookies and uses no analytics or trackers.
We never receive ticket orders, buyers' data, payments or Stripe keys.
6. Roles and legal basis
For data handled by the Addon, the site operator (the event organiser) decides why and how it is used and is the controller. It is responsible for informing buyers, for example in its own privacy policy and terms of sale, and for its own agreement with Stripe. We do not process the site's personal data.
For our own data (support requests and sales records) we are the controller. The legal basis is our contract with you, our legitimate interest in running and supporting the Addon, and legal obligations (bookkeeping).
7. Sub-processors and recipients
We use no sub-processors for site data, because we receive none. Support requests, whether sent through our support portal or by email, are handled in Atlassian's Jira Service Management, with Atlassian as our processor under its Data Processing Addendum. Statamic and Stripe handle sales of licences and payments under their own terms.
8. International transfers
Orders stay on the site's server. Stripe may process payment data outside the EU/EEA under the site operator's agreement with Stripe. Our own support data is stored in Atlassian's cloud. Atlassian may process it outside the EU/EEA, for example in the United States, and protects such transfers with the EU Standard Contractual Clauses and its certification under the EU-U.S. Data Privacy Framework.
9. Retention and deletion
- The Addon does not delete orders by itself, because organisers often need them for bookkeeping and refunds. The site operator decides how long to keep them.
- To delete one person's data, delete their order file in
storage/statamic/karelia-tickets/orders(it is named after the order ID shown in the Control Panel). Their tickets then stop working. - Removing the Addon leaves the orders folder in place. Delete the folder to remove all orders.
- Payment records in Stripe are kept by Stripe under its own rules.
10. Security
Orders are stored outside the public web folder. Ticket pages are reached only with a long random link that is sent to the buyer, and they are marked so search engines do not index them. Stripe webhooks are accepted only with a valid signature. Stripe keys are read only from the site's .env file. In the Control Panel, sales and attendee lists need their own permission, refunds another, and door staff can be given only the check-in permission.
11. Your rights
Under the GDPR you may have the right to access, correct, erase, restrict or object to the processing of your personal data, to data portability, and to complain to a supervisory authority (in Sweden: Integritetsskyddsmyndigheten, IMY). For tickets you bought on a website that uses the Addon, please contact the organiser who runs that website, because we have no access to it. For our own data contact support@karelialabs.atlassian.net.
12. Children
The Addon is a tool for website operators and is not directed at children.
13. Changes
We will update this policy when the Addon's data handling changes and publish the new version with a new date. Material changes are announced in the changelog.