Tracking, legal and security
Required information, consent and pixels, partner links and what to add to a strict Content Security Policy.
With Elements you sell on your own website. That leaves a few things with you that the shop otherwise handles.
Required information
You remain the seller. Your website therefore has to show:
- your imprint and privacy policy, as on any website.
ts-legalshows your legal details from TickySmart. - your terms of sale and the withdrawal note. Both come with
ts-termsandts-withdrawal-note. You may style them but not hide them. - the total price with fees and taxes.
ts-order-summaryshows it, andts-checkout-submitnames it on the button.
Consent and pixels
The consent banner and pixels from Marketing & tracking only run in your shop. On your website the consent is yours, because it covers your whole page. Elements set no trackers and no cookies.
If you want to measure purchases, react to the events and fire your own pixels once the visitor has consented.
For Elements to work, they store a few things in the browser. These are needed for buying:
| Storage | What | How long |
|---|---|---|
| Local storage | The order's key | 30 days |
| Local storage | Sign-in for My tickets | 30 days |
| Local storage | Chosen language | Until deleted |
| Session storage | Place in the waiting room, partner and campaign of this visit | While the tab is open |
Partner links and campaigns
If ?ref=partner or ?utm_source=… is in your page's address, the blocks remember it for this visit and pass it along with the reservation. It appears as usual in the statistics and under partner links. For a partner's website, set it permanently: data-partner="link-name" on the script.
Content Security Policy
If your website limits third-party content, Elements need these entries:
script-src https://embed.tickysmart.io https://js.stripe.com https://*.js.stripe.com
connect-src https://api.tickysmart.io https://api.stripe.com
frame-src https://js.stripe.com https://*.js.stripe.com https://hooks.stripe.com
img-src https: data:
Images come from our storage. https: for img-src is the safe choice, or you can add the address from the image links. Video players only load after a click, from www.youtube-nocookie.com or player.vimeo.com. If you show videos, add these addresses to frame-src.
Protection against abuse
- Allowed websites: Only your websites can access from the browser.
- Limits: From one address, only a limited number of tickets can be reserved and voucher codes tried within ten minutes. Normal buyers usually won't notice.
- Waiting room: A waiting room also applies with Elements. Nobody gets past the queue, not even with their own code.
- Order key: An order only opens with its key. It sits in the buyer's browser and is only valid for that one order.
Common questions
Do I have to show "Tickets by TickySmart"?
No. If you'd like to, put ts-powered-by on the page.
Can search engines read blocks?
Google runs JavaScript and reads the content. But it isn't in the page's HTML from the start. So use ts-event-seo and write important texts like the page title and description into your page yourself.