SoldOutRadar Privacy Policy

Effective date: October 27, 2026

This Privacy Policy explains what personal data SoldOutRadar collects, why we collect it, who we share it with, and the rights you have over your information. We aim to collect as little data as possible and to use it only to deliver the availability-alert service you sign up for.

1. Who we are

SoldOutRadar ("SoldOutRadar," "we," "us," or "our") is an independent availability-alert service. We monitor official ticketing calendars around the clock and notify you by email and push notification when a sold-out spot becomes available again. Our first service watches Statue of Liberty Crown access on the official ticketing site, Statue City Cruises (statuecitycruises.com).

We sell the monitoring and the alert (the information) only. We never sell, resell, or book tickets, and we never touch your reservation. When we alert you that a spot has opened, you book the ticket yourself, in your own name, on the official site.

We are independent. SoldOutRadar is not affiliated with, endorsed by, or sponsored by Statue City Cruises, City Experiences, the National Park Service, or any ticketing provider. All trademarks belong to their respective owners.

SoldOutRadar is operated by NR Studio – Nicolas Renaldi EI, the French sole proprietorship (entrepreneur individuel, micro-entreprise) of Nicolas Renaldi, trading as NR Studio, RCS Marseille 131 411 803 (SIRET 131 411 803 00011), registered at 330 Chemin du Vallon des Gavots, 13400 Aubagne, France. Our service is aimed at users in the United States, but because the operator is based in the European Union (France), we comply with the EU General Data Protection Regulation (GDPR) in addition to applicable U.S. state privacy laws.

The "data controller" for the personal data described in this policy is NR Studio – Nicolas Renaldi EI, at the address above. For any privacy question or to exercise your rights, contact us at hello@soldoutradar.com.

2. Data we collect

We collect only the information needed to set up and deliver your alerts:

• Email address — to create your account, send you sign-in codes and alerts, and contact you about your watches.
• Push notification subscription (optional — only if you turn on push alerts on a device) — the technical address and keys your browser gives us for that device, and its browser and device type. We use them only to send your alerts. You can remove a device anytime from your account.
• Travel dates — the date or date range you want us to watch.
• Departure point — your starting location (New York/Battery Park, New Jersey/Liberty State Park, or both), used to match relevant availability.
• Group size — the number of people in your party, so we can match availability that fits your group.
• Technical and log data — information automatically generated when you use the site, such as IP address, browser type, device information, and timestamps. This is used to operate, secure, and troubleshoot the service.
• Ad click information — only if you reach our site through a link that carries it, such as one of our ads: the click identifier the ad platform adds to the link (for Google: gclid, gbraid or wbraid), the campaign labels in the link (utm tags) and the page you landed on. We save them with your free test or order.

What we do NOT collect

We never see or store your payment card numbers. All payments are handled directly by Stripe, our payment processor. Your card details are entered on Stripe's secure systems, not ours, and we only receive a confirmation that a payment succeeded along with limited billing metadata (such as a payment status). Because our plans are a one-time fee per watch and not a recurring subscription, we do not store recurring billing profiles. We do not collect government IDs, precise GPS location, or any special categories of sensitive personal data.

3. Why we use your data and our legal bases

Under the GDPR, we must have a valid legal basis for each use of your personal data. Our uses and legal bases are:

• To deliver alerts and operate your account (email, push subscription, travel dates, departure point, group size) — legal basis: performance of a contract with you. Without this data we cannot provide the service you requested.
• To process payment (billing metadata from Stripe) — legal basis: performance of a contract and compliance with our legal and accounting obligations.
• To operate, secure, and improve the service (technical and log data) — legal basis: our legitimate interests in keeping the service running, preventing abuse, and protecting against fraud and security threats.
• To measure which ads and links bring free tests and orders (ad click information and, for paid orders, the time, amount and number of the order) — legal basis: our legitimate interests in measuring our advertising, so we only pay for ads that work. You can object at any time, wherever you live, by emailing hello@soldoutradar.com: we will delete this information and withdraw your order from our Google ad reports if we already sent it.

4. Who we share data with (sub-processors)

We do not run all of our infrastructure ourselves. We share limited personal data with carefully selected service providers ("sub-processors") who process it on our behalf, under contract, and only to provide their service to us:

• Stripe — payment processing. Receives the billing information needed to charge you. Stripe handles your card details directly; we never see them.
• Brevo (formerly Sendinblue) — email delivery. Receives your email address to send your alerts and account messages.
• Supabase — database and authentication hosting. Stores your account and watch data securely.
• Vercel — website and application hosting. Serves the SoldOutRadar site and processes technical/log data.
• Cloudflare — bot protection (Turnstile) on our free-test and checkout forms, which processes technical data such as your IP address and browser signals to stop bots (Cloudflare's privacy policy).
• GitHub — backup storage. Stores our weekly database backups in a private space. Each backup is deleted after 90 days.

Two more kinds of service are involved without a contract with us:

• Apple, Google, Mozilla or Microsoft — push notification delivery. The push service built into your browser or device delivers the notification. It receives the device address and the encrypted alert, not your email address.
• Google Fonts and jsDelivr — our pages load their fonts from Google and, on the account pages, one code library from jsDelivr. Your browser fetches these files directly, so these providers see technical data such as your IP address.

Google (Google Ads). If you came from one of our Google ads and then pay for a watch, we tell Google that this ad click led to an order, so that it counts in our ad reports. We send the click identifier, the time and amount of the order, and our order number — never your email address or any other contact detail. Under U.S. state privacy laws, Google handles this data as our service provider. Under EU law, Google is an independent controller of it, under Google's privacy policy.

We never sell your personal data, and we do not share it with third parties for their own marketing purposes.

5. Alert channels

Alerts are delivered by email and, if you turn them on, by push notification. We do not sell your email address or push subscription, and we do not share them with any third party for that third party's own marketing.

6. International data transfers

The operator of SoldOutRadar is located in the European Union (France), while most of our customers are in the United States. As a result, your personal data may be transferred to, stored in, and processed in countries outside your own, including the United States and the EU/EEA, depending on where our sub-processors operate.

When personal data is transferred out of the EU/EEA, we rely on appropriate safeguards recognized under the GDPR, such as the European Commission's Standard Contractual Clauses, to ensure your data continues to receive an adequate level of protection.

7. How long we keep your data (retention)

We keep your personal data only as long as we need it:

• We retain your account and watch data while your watch is active and you have an account with us.
• After a watch ends or your account is closed, we keep the associated data for a limited additional period to handle support requests, resolve disputes, and meet legal, tax, and accounting obligations, after which it is deleted or anonymized.
• Technical and log data is kept for a shorter period needed for security and troubleshooting.
• Our database backups are deleted after 90 days.
• Ad click identifiers are deleted 120 days after we save them. Campaign labels and the landing page are kept as long as the watch they belong to.

You can ask us to delete your data sooner (see Section 8), subject to any obligations that require us to retain certain records.

8. Your rights

Your rights under the GDPR (all users)

Because we are based in France, the GDPR covers all our users, wherever they live. You have the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction — ask us to limit how we process your data in certain circumstances.
• Objection — object to processing based on our legitimate interests, such as ad measurement.
• Portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent — where we rely on consent, withdraw it at any time. You can also stop the emails of a watch using the link at the bottom of those emails (this stops the watch). Withdrawing consent does not affect processing carried out before withdrawal.

You also have the right to lodge a complaint with your local data protection authority. In France, this is the CNIL (www.cnil.fr).

If you are in California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, the right to delete the personal information we hold about you, the right to correct inaccurate personal information, and the right to opt out of the "sale" or "sharing" of your personal information. We do not sell or share your personal information as those terms are defined under California law, so there is nothing to opt out of. We will not discriminate against you for exercising any of your privacy rights.

How to exercise your rights

To exercise any of these rights, email us at hello@soldoutradar.com. We may need to verify your identity before acting on your request, and we will respond within the timeframes required by applicable law. These rights are free to exercise, subject to legal limits.

9. Cookies and analytics

The SoldOutRadar site sets no cookies of its own. Your sign-in is kept in your browser's local storage. On the live calendar, your browser also remembers your departure filter, how often you visit that page and the last date you opened there, so we can show you that date first when you come back; if you start a watch, it remembers the watch's last day, so the calendar doesn't offer you one you already have. None of this is sent to us. The visit count and last date reset after 30 days without a visit, and you can clear all of it at any time in your browser settings. Stripe's payment page, which is on Stripe's own site, uses Stripe's cookies. We do not use advertising cookies or sell data to advertisers.

We currently use no third-party advertising or cross-site tracking cookies. We use Vercel Web Analytics to understand aggregate, non-identifying usage of the site (such as page views, referring site, country, browser and device type). It also records which buttons and steps of the site are used (for example, opening the purchase window or using the calendar), without your email address or any other personal identifier. It is cookieless: it does not store anything on your device, does not follow you across sites, and the data we see is aggregated, never tied to you as an individual. If we later add any tool that identifies you or follows you across sites, we will ask for your consent where required by law.

Ad clicks. If you arrive through a link that carries a click identifier added by an ad platform, or campaign labels (utm tags), for example from one of our ads, we read them from the page address, carry them from page to page in our own links, and save them with your free test or order. We use no cookie or other browser storage for this: they simply stay in the page address. Our analytics tool never receives the click identifier. If your browser sends a Global Privacy Control signal, we don't keep the click identifier, so your order is not reported to Google.

10. Children

SoldOutRadar is not intended for anyone under 18 years of age, and our service is available only to users who are 18 or older. We do not knowingly collect personal data from children. If you believe a minor has provided us with personal data, contact us at hello@soldoutradar.com and we will delete it.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our service, technology, or legal requirements. When we make material changes, we will update the effective date at the top of this page and, where appropriate, notify you by email. We encourage you to review this policy periodically.