Your Stripe account, your buyers
Payments go straight to your own Stripe account, card details never touch your site, and orders stay on your server. The addon takes no fee per ticket and never contacts us.
Where your data goes
On your own server, which talks over HTTPS to api.stripe.com with your Stripe key to open Checkout, read back a payment and make refunds, and receives Stripe's signed webhooks. Buyers pay on Stripe's own checkout page. Confirmation emails go through the mail service you configure in Laravel. The addon never contacts Karelia Labs: it has no telemetry, no analytics and no account with us. Statamic itself checks licence keys with statamic.com; that is part of Statamic, not of the addon.
What is stored
Everything the addon stores is in one folder, storage/statamic/karelia-tickets, outside the public web folder.
| Data | Where and why | How long |
|---|---|---|
| Orders: the buyer's name and email, the event, ticket types, quantities, prices and status | One JSON file per order. Issue tickets, refunds and attendee lists | Until you delete the order |
| Tickets: codes, the name on each, and when and by whom each was checked in | The order file. Let each ticket in once | As above |
| Stripe references: Checkout Session, PaymentIntent and refund IDs. Never card details | The order file. Match and refund payments | As above |
| The time and type of the last webhook from Stripe | Laravel's cache. Show in the Control Panel that the webhook works | Until the cache is cleared |
| Settings: collections, currency, ticket note, a copy-to address | Statamic's addon settings. Stripe keys only in .env | Until changed |
Personal data
Orders hold the buyer's name and email address, and the names of staff who checked tickets in. Stripe receives the buyer's email, the ticket names and prices and the order number. Your site, as the event organiser, is the controller of this data. To erase a buyer's data, delete their order file.
Permissions
The addon adds three Statamic permissions in a Tickets group under Users, Roles.
| Permission | Why the app needs it |
|---|---|
| View tickets and orders | Sales, orders and attendee lists, including buyers' names and emails |
| Refund, cancel and resend orders, and add free tickets | Change orders. Needs the permission above |
| Check in attendees | The check-in page only. Shows the name on each scanned ticket |
Access control
Every Control Panel request checks these permissions on the server. Ticket pages for buyers are reached only with a 40-character random link sent to them, are marked noindex and are never cached. The Stripe webhook accepts only events with a valid signature from your endpoint secret, at most five minutes old.
Untrusted input
Ticket orders are validated on the server: the event must be on sale, the ticket type must exist and be on sale, quantities are limited by what is left and the most per order, and the checkout is rate-limited with a hidden spam trap. Prices always come from the event, never from the browser. The attendee CSV is written so spreadsheet programs do not run cells as formulas.
Dependencies
The server side depends on Statamic, Laravel and chillerlan/php-qrcode (MIT or Apache-2.0) for the QR codes, installed by Composer. Stripe is called with Laravel's HTTP client, without Stripe's SDK. The check-in page bundles qr-scanner (MIT), which reads the camera image in the browser; the image never leaves the device.
Other points
Overselling
Tickets are reserved under a lock per event, so two buyers cannot take the last seat. On several servers, use a shared cache store such as Redis so the lock is shared too.
Payments that arrive late
A buyer who pays after their hold ran out still gets the tickets they paid for, and the order is marked so you can check the capacity.
Logging
The addon writes nothing to logs during normal use. A failed email or Stripe call is reported to Laravel's log as any error would be, and a failed email is also shown on the order.
Sub-processors
None for us: we receive no site data. Stripe processes payments under your own agreement with Stripe. Licences and payments for the addon are handled by Statamic and Stripe. For the other parties involved in our own support and bookkeeping, see the privacy policy.
AI and language models
None. The addon contains no language model and sends no content to any.
Vulnerabilities
Report a suspected vulnerability to support@karelialabs.atlassian.net. Please include what you found, how to reproduce it and which version is affected, and give us a reasonable time to fix it before you publish details. We read every report.
Deleting data
Orders are kept until you delete them: delete an order's file to remove it, or the folder to remove all. Payment records in Stripe are kept by Stripe. Removing the addon with Composer leaves the orders folder in place.