Cookies Policy
Version 2.2 · Effective 16 September 2026 · Previous versions
1. What this policy covers
This policy explains how Tessera Pte. Ltd. ("Tessera", "we", "us") uses cookies and similar technologies — including pixels, tags, local storage and software development kits — across:
- our websites, including yourtessera.com
- our organiser dashboard
- Tessera-hosted event pages and checkout flows, including those served under an organiser's own branding
It sits alongside our Privacy Policy, which explains everything else we do with personal data.
A note on why this matters. Cookies and similar technologies can identify your device and build a record of your behaviour over time. Both the EU/UK ePrivacy rules and Singapore's PDPC treat that as personal data. We therefore ask for your consent before setting anything that is not strictly necessary — and we do not set it unless you say yes.
2. What these technologies are
Cookies are small text files a website stores on your device so it can recognise it on a later visit.
Pixels and tags are small pieces of code, often loaded as an invisible image or script, that report back to a third party that you visited a page and what you did there.
Local storage and session storage hold data in your browser in a similar way to cookies, but are not automatically sent to the server with each request.
SDKs are third-party code libraries embedded in our applications that may collect device or usage information.
Throughout this policy, "cookies" means all of the above.
First-party means set by Tessera on a Tessera domain. Third-party means set by another company. Note that a cookie can be first-party in technical terms while the data still flows to a third party — where that happens, we say so explicitly in the tables below, because the domain alone would mislead you.
3. The four categories, and how we treat each
| Category | What it does | Do we ask consent? | Legal basis |
|---|---|---|---|
| Strictly necessary | Delivers a service you have actively requested — keeping you logged in, holding your basket during checkout, routing traffic, blocking fraud and abuse, remembering your cookie choices | No — these are exempt, and the Services will not work without them | Necessary for the performance of a contract; ePrivacy strictly-necessary exemption; PDPA deemed consent for services you request |
| Functional | Remembers preferences that improve your experience but are not essential — language, region, interface settings, live chat | Yes | Consent |
| Analytics | Helps us understand how the Services are used so we can improve them — pages viewed, features used, errors encountered, performance | Yes | Consent |
| Advertising | Measures and targets advertising, including advertising run by Tessera and by event organisers, and links your activity to advertising profiles held by third parties | Yes | Consent |
Nothing in the functional, analytics or advertising categories loads before you have given consent for that category. Consent is collected per category, not as a single all-or-nothing choice. Refusing is exactly as easy as accepting — the banner presents "Reject all" with the same prominence as "Accept all".
We do not use cookie walls. Refusing non-essential cookies does not prevent you from browsing, buying a ticket, or attending an event.
4. Your choices
Setting or changing your preferences. Use the Cookie Settings link in the footer of any page. This opens the preference centre, where you can turn each category on or off individually.
Withdrawing consent. Use the same link. Withdrawal takes effect immediately for future processing. Cookies already set in a category you have switched off are deleted or expire, and we stop sending data to the associated third parties.
Your browser. Most browsers let you block or delete cookies through their settings. Doing so is not a substitute for using our preference centre — browser settings alone do not constitute valid consent under GDPR or under PDPC guidance, and blocking strictly necessary cookies will break checkout.
Global Privacy Control. We honour the Global Privacy Control (GPC) signal. If your browser sends it, we treat it as a refusal of the advertising and analytics categories, and our banner reflects that.
Do Not Track. We do not respond to legacy Do Not Track headers, which lack an agreed standard. Use GPC or our preference centre instead.
Consent records. We keep a record of the consent you give — the categories, the timestamp, and the policy version — for 12 months, as evidence that consent was validly obtained. This record does not identify you by name.
How long consent lasts. We will ask you again after 12 months, or sooner if we add a materially new purpose or provider.
5. The cookies we use
5.1 Strictly necessary — set without consent
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| Session / authentication cookies | Tessera | Keeps you signed in and maintains your session across pages | First-party | Session |
| CSRF and security tokens | Tessera | Prevents cross-site request forgery and session hijacking | First-party | Session |
| Checkout and cart state | Tessera | Holds your ticket selection through the purchase flow | First-party | Session |
| Consent preferences | Tessera | Remembers your cookie choices so we do not ask again | First-party | 12 months |
__stripe_mid, __stripe_sid | Stripe | Payment processing and fraud prevention on checkout | Third-party | 1 year / 30 minutes |
__cf_bm | Cloudflare | Bot management — distinguishes human visitors from automated traffic | Third-party | 30 minutes |
cf_clearance | Cloudflare | Records that a security challenge (Turnstile) was passed, so you are not challenged repeatedly | Third-party | 30 minutes |
__cflb | Cloudflare | Load balancing — directs your request to the correct server | Third-party | Up to 24 hours |
| Chat widget cookies | Chatbase | Operates our customer support chat assistant and remembers your conversation | Third-party | Session |
cf_clearanceduration is our default assumption — confirm against the actual Cloudflare config and correct if it differs.
Note on Chatbase. Our website chat is a customer support channel, not a marketing tool — it is operated by Chatbase and treated as strictly necessary on that basis, so it loads without asking for your consent. Anything you type into it is received by Chatbase as our service provider. Please do not enter payment details or sensitive personal information into the chat — use dpo@yourtessera.com for anything of that nature.
5.2 Functional — set only with consent
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| Language and region preference | Tessera | Remembers your display preferences | First-party | 12 months |
| Frill widget cookies | Frill | Powers the feedback and roadmap widget in the organiser dashboard | Third-party | Session |
Note on Frill. Frill only appears to organisers who have already accepted our Terms of Service. Accepting that contract is a separate legal act from cookie consent — one does not stand in for the other — so the Frill widget still only loads once you have given functional consent.
5.3 Analytics — set only with consent
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
ph_* | PostHog | Product analytics — which features are used, where users encounter friction, funnel and conversion analysis | First-party cookie, third-party recipient. Served through our own domain i.yourtessera.com, but data is processed by PostHog in the United States | 12 months |
| New Relic browser cookies | New Relic | Application performance monitoring — page load times, JavaScript errors, real user monitoring | Third-party, EU data region | Session |
_ga, _ga_* | Google Analytics | Website analytics — traffic sources, pages viewed, aggregate audience measurement | Third-party | 2 years |
| — (no cookie set) | Cloudflare Web Analytics | Website analytics — aggregate traffic and performance measurement | Third-party beacon — sets no cookie and stores nothing on your device | Not applicable |
Why PostHog is listed as first-party. We serve PostHog through our own subdomain so that it is not blocked by browser tracking protection. This is a deliberate engineering choice for data quality, and we disclose it because the technical first-party appearance would otherwise understate what is happening: the data is processed by PostHog, not only by us.
Why Cloudflare Web Analytics is listed even though it sets no cookie. It stores nothing on your device and creates no visitor identifier, so it falls outside the strict scope of cookie rules. We list it and place it behind analytics consent anyway, because we would rather apply one consistent rule than ask you to trust an exception.
5.4 Advertising — set only with consent
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
_fbp, fr | Meta (Facebook) | Measures the performance of Tessera's advertising and enables audience targeting on Meta platforms | Third-party | 90 days |
_gcl_*, conversion tags | Measures the performance of Tessera's advertising campaigns | Third-party | 90 days | |
IDE, test_cookie | Google (DoubleClick) | Ad measurement, frequency capping and targeting via Google's advertising network | Third-party | 13 months / 15 minutes |
| Organiser-configured tracking | Varies — see section 6 | Advertising and analytics measurement for the specific event you are viewing | Third-party | Varies by provider |
Google Consent Mode v2. Where Google tags are present, we implement Consent Mode v2. Before you consent, Google tags receive only signals that carry no identifiers. After you consent, full measurement is enabled. If you refuse, Google receives only cookieless signals for aggregate modelling.
6. Tracking configured by event organisers
This section describes something specific to how our platform works, and it is worth reading if you are buying a ticket.
6.1 Supported providers
Tessera allows event organisers to connect their own tracking to the event and checkout pages for their own events, so they can measure whether their advertising is selling tickets. We support:
| Provider | What it is |
|---|---|
| Meta Pixel | Browser-based advertising measurement, run under the organiser's Meta account |
| Meta Conversions API | Server-side advertising measurement to the same Meta account — see 6.3 |
| TikTok Pixel | Browser-based advertising measurement, run under the organiser's TikTok account |
| Google Analytics (GA4) | Analytics, run into the organiser's own GA4 property |
| Google Ads | Browser-based advertising measurement, run under the organiser's Google Ads account |
In every case, the organiser supplies their own account identifier (a pixel ID, measurement ID or similar), and the tag fires under their account, into their property — not ours.
Consent category. Meta Pixel, Meta Conversions API, TikTok Pixel and Google Ads are gated behind the advertising category. Google Analytics (GA4) is gated behind the analytics category. If you refuse the relevant category, the corresponding organiser tracking does not fire and no data is sent.
6.2 Whose data this is
This is the organiser's data, not ours. Tessera does not receive the reports these tools generate, does not read the audiences they build, does not combine this data with anything else we hold, and does not use it for any purpose of our own.
That said, the organiser and Tessera are joint controllers for the collection and transmission of your data by that tag, following the CJEU decision in Fashion ID (C-40/17). These two statements are not in tension: not using the data ourselves does not remove our joint responsibility for the moment your data is collected and sent. In practice:
- Tessera is responsible for asking for your consent and for telling you this is happening.
- The organiser is responsible for what the third party does with the data afterwards, and for having its own lawful basis.
- You can exercise your rights against either of us. Contact dpo@yourtessera.com and we will handle it or route it, and tell you which.
- We require organisers to have a lawful basis for their advertising, to maintain their own privacy notice, and to comply with the platform obligations in our organiser terms.
Because organiser tracking varies by event, we cannot list specific pixel or measurement IDs here. Your preference centre shows the specific third parties active on the page you are viewing.
6.3 Server-side measurement (Meta Conversions API)
Where an organiser has enabled the Meta Conversions API ("CAPI") for their event, our servers send a purchase event directly to Meta for every confirmed purchase, alongside the browser-based Meta Pixel described above.
What this means for you:
- What is sent. The event type (a purchase), the order value, and hashed matching identifiers (such as a hashed email address) used to match the event to a Meta account. We do not send your name, card details, or ticket contents.
- Who receives it. Meta, under the organiser's own Meta account — the same account the browser pixel reports into.
- What Tessera receives back. Nothing. We do not receive the resulting measurement, reports or audiences, for the same reason set out in 6.2.
- Consent. This send is subject to exactly the same consent as the browser pixel — the advertising category. Sending an event from our servers instead of your browser is not a way around a refusal, and we do not treat it as one. If you have refused the advertising category, the server-side event is not sent.
7. Regional differences
Our approach is the same everywhere: nothing non-essential loads without consent. Some specifics differ.
European Economic Area and United Kingdom. Prior opt-in consent is required for all non-essential cookies under the ePrivacy Directive and the UK Privacy and Electronic Communications Regulations. Our banner blocks all non-essential technologies until you choose.
Singapore. The PDPC's guidance treats cookies that collect personal data as requiring consent. Consent may be deemed for cookies necessary to a service you have expressly requested — which is why the strictly necessary category is exempt. Personalised advertising requires explicit opt-in, and browser settings alone are not consent. We apply the same opt-in standard as the EEA.
Hong Kong. We apply the same standard under the PDPO collection and use principles.
Elsewhere. We apply the opt-in standard globally rather than varying it by jurisdiction. It is simpler for you and simpler for us.
8. Changes to this policy
We review this policy whenever we add or remove a cookie or a provider, and at least every six months. The version number and effective date at the top of this page tell you which version you are reading. Previous versions are archived in our policy archive.
If we add a new purpose or a new category, we will ask for your consent again rather than assuming your previous choice covers it.
9. Contact
Questions about this policy, or about any cookie you have found on our site:
Data Protection Officer, Tessera Pte. Ltd., 68 Circular Road, #02-01, Singapore 049422
Tessera Pte. Ltd. · UEN 202344374N · Version 2.2 · Effective 16 September 2026