Privacy Policy

We collect information you give us directly when you use the site:

• —Name, email and phone number — when you buy a ticket, place a Shop order, or send us a message.
• —The drawing or photo you submit as part of the One of Us ticket challenge.
• —Payment-related details — for bank transfer, the receipt image/PDF you upload; for card payments, only the outcome (paid/failed) and a reference number. We never see or store your card number, expiry date or CVV — that's entered directly on our payment partner PAYable's own secure page.
• —Basic technical data (like IP address) that any web server logs automatically.

• —To process your ticket or order, and to verify a bank transfer against the receipt you upload.
• —To send you confirmation and status emails about your ticket or order.
• —To generate the personalised artwork ("signal") tied to your One of Us ticket.
• —To reply to messages sent through the Contact form.

We don't use your information for advertising, and we don't sell it to anyone.

• —PAYable — our payment gateway, to process card payments. They handle your card details directly; we only receive the payment result.
• —Amazon Web Services (AWS) — our hosting and storage provider (database and file storage). They store data on our behalf and don't use it for their own purposes.

We don't share your information with anyone else, except where we're required to by law.

We don't run third-party analytics or advertising trackers on this site. The only cookie in use is a session cookie for the studio's internal admin login — it isn't set for regular visitors and doesn't track you.

Your browser also remembers a couple of small settings on your own device — for example whether the One of Us challenge sounds are on. They never leave your device and you can clear them any time by clearing this site's data.

Card payments are handled entirely on PAYable's PCI-compliant checkout page — your card details never reach our servers. Bank-transfer receipts, order details and messages are stored in access-controlled infrastructure, and our admin panel is protected by a PIN behind an authenticated session.

We keep order, ticket and payment records for as long as needed for accounting, dispute-handling and legal purposes. You can ask us to delete other personal data (like a Contact form message) at any time.

You can ask what we hold about you, ask us to correct it, or ask us to delete it, by emailing info@bandittheory.com. We'll respond as quickly as we can.