CrabGate
We keep what the shop needs. Nothing else.
No tracking, no ads, and no selling of data. Here's what we store, where it lives, and how you get it out.
Privacy. Last updated 9 October 2026.
Who we are
CrabGate is run by ALPLUS TECHNOLOGIES S.R.L., a company registered in Romania. For anything about your data, email hello@crabgate.com. A person reads it.
Company details: ALPLUS TECHNOLOGIES S.R.L., registration number (CUI) 55013997, trade register number J2026041446003, registered at Bd. Dâmbovița, nr. 60, sc. A, et. 4, ap. 14, Timișoara, Timiș, Romania.
Two kinds of people, two roles
Organizers. If you sign up to sell tickets, we decide how your account details are used. In data protection terms we're the controller.
Buyers and attendees. If you buy a ticket from a shop on CrabGate, the organizer of that event decides how your details are used. We store them on the organizer's behalf, as their processor. The organizer is the first person to ask about your ticket or your data, and we help them answer.
What we store
About organizers and their team: your organizer name, your shop address, the email address of each Admin and Door Staff member, your subscription status, and the note about your next event if you leave one when you sign up.
About buyers and attendees: the buyer's email address, the name on each ticket, answers to any questions the organizer asks at checkout, the order, the tickets, and when a ticket was checked in at the door.
Card details: we never see or store them. Payments happen on Stripe's pages. Ticket money goes straight to the organizer's own Stripe account.
Technical records: our server and our network provider process IP addresses and request details to deliver pages, stop abuse, and fix problems.
Cookies
We set one cookie, and only when you sign in. It keeps you signed in to the Back Office or the Door. There are no analytics cookies, no advertising cookies, and no third-party trackers, so there's no cookie banner.
We send the emails the shop needs: sign-in links, tickets, receipts, changes to an event, refunds, and notices about your subscription. We don't send marketing email to buyers.
Why we're allowed to
We use your details to provide the service you signed up for, to keep it secure, and to meet legal duties such as keeping invoices. For buyers and attendees, we act on the organizer's instructions.
Where it lives and who helps us
CrabGate runs on a server in Stockholm, Sweden. Backups are stored in the same region. Each organizer has its own database, and personal details in it are encrypted with a key that belongs to that organizer alone.
These companies help us run the service:
- Amazon Web Services: the server and the backups, in Sweden.
- Cloudflare: the network in front of the site, protection against attacks, and the sending of our emails.
- Stripe: payment of your CrabGate subscription. Organizers also connect their own Stripe account to sell tickets.
- Purelymail: the inbox for hello@crabgate.com.
Cloudflare and Stripe may process data outside the European Economic Area. They do so under the safeguards that European law requires.
Who at CrabGate can see your data
Nobody, by default. We can look inside an organizer's shop only when an Admin of that shop gives us access. The Admin sets how long it lasts and can take it back at any time. Everything we do while we have access is logged, and the Admin can read the log.
How long we keep it
We keep an organizer's live shop data while the subscription is active or in its 14-day payment grace period. After the subscription lapses, the shop can still check people in and Admins can export its data until deletion starts 90 days after lapse. We email the Admins 30 days, 7 days, and 1 day before that deadline.
Backup copies may remain after live data is deleted. Removing live access and the live encryption key does not make older backups immediately unrecoverable: backups can also contain the key information needed for recovery. We have not yet verified a maximum retention period for production backup copies.
An organizer can remove a buyer's personal details from an order at any time. We keep invoices for our own subscription for as long as tax law requires.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, and object to how it's used. An organizer's Admins can export the shop's data from the Back Office before deletion starts, including during the 90 days after subscription lapse.
If you bought a ticket, ask the organizer first. If you can't reach them, email us and we'll pass your request on.
If you think we've handled your data badly, tell us and we'll put it right. You can also complain to the Romanian data protection authority (ANSPDCP), or to the authority in your own country.
Changes to this page
If we change something that matters, we'll email organizers before it takes effect and update the date at the top.
See also our terms.