Your data, plainly explained.

We collect only what's needed to sell you a ticket, get you onto the grounds safely, and reply when you write to us. The categories below are every type of data Lit Galaxy ever holds about you.

• Identity & contact: name, email, phone, postal address (only when shipping a wristband).
• Order & payment: tickets purchased, transaction IDs, billing zip. Card numbers are processed by Stripe and never touch our servers.
• Communications: the content of any email, contact-form message, or support thread you start with us.
• Site analytics: page views, referrer, anonymized IP, device type. Used to spot broken pages and slow regions.

We don't collect: government ID numbers, health records, social-media profiles, photographs, or location beyond city/country derived from IP.

Each piece of data has a single, explicit purpose. We do not use your information for anything not listed here.

• Ship your wristband and confirm your ticket.
• Send essential festival updates (gate times, weather alerts, lineup reveals if you opted in).
• Respond to your messages and support requests.
• Detect fraud and protect the box office.
• Improve the website by analyzing aggregate, anonymized traffic patterns.

We share data only with the partners required to fulfill an order, and only with the minimum data each one needs.

• Stripe — processes your payment. Holds card numbers and billing details under PCI-DSS standards.
• Canada Post — receives your shipping address and name when we mail wristbands.
• Vercel — hosts this website; sees standard request logs and anonymized analytics.
• Formspree — relays contact-form submissions to our team inbox.

We never sell your data, rent your email list, or share information with advertisers, data brokers, or marketing networks.

Under PIPEDA (Canada's federal privacy law) and equivalent rules in your jurisdiction, you have the right to:

• Access a copy of every piece of personal data we hold about you.
• Correct anything inaccurate.
• Delete your account and associated data — except records we're legally required to keep (e.g. tax receipts).
• Withdraw consent from marketing emails at any time via the unsubscribe link.
• Object or restrict our processing on specific grounds.

Email info@litgalaxy.ca with the word "privacy" in the subject and a brief description of your request. We reply within 5 business days.

We use three categories of browser storage, all opt-in where required:

• Essential — keeps your theme preference (light / dark) and your session for the cart. No third parties involved.
• Analytics — anonymized page-view tracking via Vercel Analytics. Loaded only after you accept the cookie banner.
• Functional — remembers form drafts and successful subscriptions so you don't see the same banner twice.

No advertising or social-media tracking cookies are ever set, regardless of consent. You can clear all Lit Galaxy storage from your browser's site settings at any time.

• Ticket records — 7 years, as required for Canadian tax / consumer-protection regulations.
• Newsletter subscriptions — until you unsubscribe.
• Contact-form messages — 24 months from your last reply, then purged.
• Analytics logs — 13 months in aggregated form, then deleted.

Lit Galaxy data is stored on TLS-encrypted infrastructure with at-rest encryption. Only two people on the Lit Galaxy team have direct database access, both with two-factor authentication enforced. We run quarterly permission reviews and rotate keys yearly.

In the unlikely event of a security breach affecting your data, we will notify you and the Office of the Privacy Commissioner of Canada within 72 hours.

We may update this policy from time to time. Material changes are emailed to anyone with an active account at least 30 days before they take effect. The "last updated" date above always reflects the most recent revision.