Privacy policy.

mirabelleartists.com is run by MILA LIVES LTD, trading as Mirabelle Artists, based in Nairobi, Kenya (“we”, “us”). We sell tickets to our live shows and book our artists for events. For the personal data described on this page, we are the data controller.

For any privacy question or request, email mirabelleartists@gmail.com. Please use email for privacy requests so we both have a written record.

Tickets and payments

When you buy a ticket we ask for:

• your full name, email address and mobile number (used for M-Pesa);
• the ticket type and quantity, and, where we offer a choice, how you want to pay;
• for Magic Royale, optionally, how many children under 4 are coming with you — a head count only. We never ask for children's names.

Our system also records, automatically: your IP address and your browser and device details (the “user agent” your browser sends), Meta's browser cookies (_fbp, _fbc) if your browser has them, and a referral code if you came through a partner's link. We save this record every time a checkout is started, whether or not payment is completed.

Why: to take your payment, match it to your order, issue and email your tickets, check you in at the door, help with questions about your order, keep accounting records, and measure which adverts lead to ticket sales (see Advertising below).

Your name appears on your ticket page, your PDF ticket and your ticket email. At the venue our door team scans your QR code and sees your name and ticket status. Anyone who has your ticket link can open it, so please keep it private. For premium (Front Row and Reserved Front Row) seats we may phone you or send you a WhatsApp message by hand before the show and note your expected arrival time, seat preference and any requests. For Reserved Front Row seats we also save the name you ask us to put on your seats; it appears on your ticket, at the door and on the cards on your seats.

We never receive your card number or your M-Pesa PIN — you enter those only with the payment provider or on your own phone. We keep the payment confirmation code so we can match your payment.

Booking inquiries

The booking form asks for your name, organisation, email, phone or WhatsApp number, the artist, event type, date, location, audience size and your message. It is emailed to our inbox so we can reply and send a quote. It is not saved in our database. Our hosting provider's technical logs keep only a short note of it: the artist, event type and date, and the last three digits of your phone number. Your name, email and phone number appear in those logs only if the email to our inbox fails, so that we can still reply; your message never does.

Why: to answer your inquiry and arrange the booking.

WhatsApp updates you ask for

If you use the “WhatsApp me the details” box on an event page, we save your name and phone number, the advert campaign that brought you to the site (if any), your website session ID (see Analytics) and when we contacted you. We use your number only to message you about the event you asked about. Messages are sent by a person on our team, not automatically. Reply STOP at any time and we will stop.

If you use “Booking for 15+ people or a company?” on an event page, we save your name, phone number, email, group size and company (if you give one), the advert campaign that brought you (if any) and your website session ID, and we email the same details to our bookings inbox so the team can reply. The WhatsApp message that opens afterwards is sent by you, from your own phone; nothing is sent automatically.

Unfinished checkouts

If you start buying a ticket but don't finish paying, a member of our team may send you a WhatsApp message about completing your purchase. These messages are sent by hand, never automatically, and only for recent checkouts that were not paid later. If you don't want them, tell us and we will stop.

Emails and messages from us

Once your payment is confirmed we email your tickets. We may also email you to tell you about another of our shows, and after a show we may email you, or send you a WhatsApp message by hand, to ask for a review. We keep a record of which of these emails we sent you. If you don't want these messages, reply STOP or write to mirabelleartists@gmail.com and we will add you to our do-not-contact list.

Our own website analytics

We run our own simple analytics. We do not use Google Analytics or any similar third-party analytics service. A cookie (mira_sid) holds a random ID, and with it we record:

• the pages you view (the page address only, without anything after the “?”);
• steps such as choosing a ticket type or reaching checkout, and the name of any checkout field that needs correcting — never what you type into it;
• taps on things like the WhatsApp button, a video, a ticket download, the rating prompt (with the star you chose) or our review link;
• the website that sent you (its domain name only) and any campaign tags in the link;
• your approximate country and city, which our hosting provider works out from your IP address (we don't store your IP address in analytics);
• whether you are on a mobile or a desktop screen.

This is not anonymous. If you go on to buy a ticket or ask for WhatsApp updates, your analytics record is linked to your order or request.

Why: to understand which pages and adverts work and to find problems in checkout.

Advertising: the Meta Pixel and Conversions API

We advertise on Facebook and Instagram, which are run by Meta. The Meta Pixel is a piece of Meta code that runs on our event ticket page and our order confirmation page. It tells Meta when you view the page, start checkout (with the ticket value and quantity) and complete a purchase. Like any content loaded from Meta, it also sends Meta the page address, your IP address and your browser details. Meta sets its own cookie (_fbp). If you arrive by clicking a link on Facebook or Instagram, including one of our ads, our site saves the click ID in a cookie (_fbc).

When an order is paid, our server also reports the purchase to Meta directly (the “Conversions API”). It sends: your email address and phone number in hashed form (scrambled with SHA-256, so the originals are not sent), your IP address and browser type, the two Meta cookies above, the order reference, the page address, the amount and currency, and which show. We do not send your name.

Meta uses this to match purchases to our ads, to measure results, and to build audiences — for example “people who visited our ticket page”, so we can show them our ads, and “people who already bought”, so we can stop showing them ads. We do not upload customer lists to Meta. Meta handles this data under its own terms and privacy policy, and you can manage the ads you see in your Facebook or Instagram ad settings.

Videos, posts and Google

Some pages, including our artist pages and our shows page, show videos and posts from YouTube, Instagram and TikTok. Some of these load as soon as you open the page, and YouTube video thumbnails load from Google's servers when you view a page. These services may receive your IP address and set their own cookies, under their own privacy policies. Our click-to-play videos use YouTube's privacy-enhanced mode.

The Google reviews shown on our site are fetched by our own server, so no information about you is sent to Google to display them. The Google Maps and calendar buttons only take you to Google if you tap them. Our fonts are served from our own site.

Referral partners

If you are one of our referral partners, we keep your name, phone number and email address so we can credit ticket sales made through your link and pay your commission. Your partner stats page shows your first name and your sales totals to anyone who has your partner link. Partners never see the names or contact details of people who buy through their link — only counts and totals.

Our legal reasons

We use your data: to perform our contract with you (selling and delivering your tickets, handling your booking); to meet legal obligations (tax and accounting records); with your consent (WhatsApp updates you asked for); and for our legitimate interests (running and improving the site, matching payments, asking for a review after a show, and measuring which adverts lead to ticket sales).

Emails about our other shows, WhatsApp follow-ups on an unfinished checkout, and Meta showing our ads to people who visited our ticket page are marketing. You can opt out of all marketing at any time: reply STOP, or write to mirabelleartists@gmail.com, and we will stop. You can also withdraw consent or object to any of the uses above — see Your rights.

We do not sell your personal data.

These are the cookies a visitor to our public pages can receive:

mira_sid

Us · 180 days

A random ID for our own website analytics (see above).

_fbc

Us, or Meta's Pixel · 90 days

Remembers the click ID when you arrive from a link on Facebook or Instagram (including our ads), so a purchase can be matched to that ad.

_fbp

Meta's Pixel · Set by Meta

Meta's browser ID, set on pages that load the Pixel. We read it at checkout, store it with your order and send it to Meta with paid orders.

mira_ref

Us · 30 days

Remembers a referral partner's link so a ticket sale is credited to that partner.

Our team uses a few more cookies to sign in to internal pages; they are never set for ordinary visitors. YouTube, Instagram and TikTok may set their own cookies when their content loads (see above).

We also keep some information in your browser itself. While you check out, your name, email, phone, ticket choice and any under-4s count are kept in that browser tab so the form isn't lost if the page reloads; this copy is cleared when you close the tab and is never sent anywhere (your details reach us only when you press Pay). The campaign tags of your visit are kept for the length of your visit and sent with our analytics (see above). Small markers remember things like whether you dismissed a rating prompt, confirmed your age for an 18+ show, or whether a purchase has already been reported.

You can delete or block cookies and stored site data in your browser settings at any time.

We share personal data only with the services we need to run the site, sell tickets and reply to you:

• Payment providers. Which one handles your payment depends on which payment route is working when you check out. IntaSend(online checkout, where you pay by M-Pesa or card on IntaSend's own page) receives your name, email, phone number, the amount, the order reference and the show and ticket type. NCBA Bank(M-Pesa payments to our till) receives your phone number, the amount and the order reference. NCBA's payment notification to us includes the payer's M-Pesa name and number; we match the payment by its order reference. If a payment can't be matched automatically, our hosting logs record the payer's initials and the last three digits of the number, not the full name or number. Safaricom processes M-Pesa payments. If you pay by bank transfer, you pay from your own bank into our bank account, and our bank receives the details your bank sends with the payment. If you send us your M-Pesa confirmation message on WhatsApp, we see the name and number in it.
• Email. Resend delivers our ticket emails, our other emails to buyers, and booking inquiries to our inbox. Our inbox is a Gmail account, so emails you send us are stored by Google.
• Meta (Facebook and Instagram), through the Pixel and Conversions API, as described above. When we message you on WhatsApp, the message is carried by WhatsApp, which Meta also owns.
• Google, Instagram and TikTok, when their videos or posts load on our pages.
• Hosting and database. Vercel hosts the website, keeps technical logs and tells us your approximate location. Neon runs our database.

Referral partners see only counts and totals of the sales made through their link, never your details.

We will also disclose information where the law requires it, for example under a court order.

Some of these providers store or process data outside Kenya. Our database (Neon) is hosted on Amazon Web Services in the United States, and our website host (Vercel), our email delivery service (Resend), Meta and Google also operate outside Kenya. This means your personal data is transferred outside Kenya when you use the site.

We send each provider only the data it needs for its job, and we use established providers that publish their own security and data-protection terms.

We keep personal data only as long as we need it for the purpose we collected it for, and for our tax and accounting obligations.

• Paid tickets and payments are kept as part of our accounting records for as long as the law requires.
• Unfinished checkouts, WhatsApp requests, analytics records, notes about your visit and booking emails are kept while they are useful for the purposes above. We do not currently delete these automatically on a fixed schedule, so if you would like yours removed sooner, ask us and we will delete them — see How to delete your data.
• Technical logs are kept by our hosting provider under its own settings.

The site is served over an encrypted connection (HTTPS). Your card number and M-Pesa PIN never reach us, and we send your email address and phone number to Meta only in hashed form. Our internal pages that show buyer details are open only to our team.

No system is perfectly secure. If a breach puts your personal data at risk, we will notify the Office of the Data Protection Commissioner and, where the law requires, tell you.

You can help by keeping your ticket links and ticket emails private.

Under the Kenya Data Protection Act, 2019, you have the right to:

• be told how your personal data is used — this page;
• access the personal data we hold about you;
• have data that is wrong or misleading corrected;
• have your data deleted — see How to delete your data;
• object to our use of your data, including for marketing messages and advertising measurement;
• ask us to restrict (pause) our use of your data, for example while you contest its accuracy;
• withdraw any consent you have given, such as for WhatsApp updates;
• receive your data in a commonly used electronic format and have it moved to another service, where this right applies.

To use any of these rights, email mirabelleartists@gmail.com. We may ask you to confirm it is you — for example by writing from the email address, or confirming the phone number, you used with us. We do not charge for these requests. We will respond to a request for access within 7 days; to a request for correction, restriction, objection or deletion within 14 days; and to a request to move your data within 30 days, as the Data Protection (General) Regulations, 2021 require.

If you are unhappy with how we have handled your data, you can complain to the Office of the Data Protection Commissioner (ODPC) at odpc.go.ke. We would welcome the chance to put things right first, but you can go to the ODPC at any time.

Tickets are meant to be bought by adults. Our family shows welcome children, but we do not ask for children's names or details — only, for Magic Royale, the number of children under 4 coming, as a head count.

We do not knowingly collect personal data from children. If you think a child has given us personal data, email mirabelleartists@gmail.com and we will delete it.

We post on our Facebook Page and Instagram account, and our artists appear on Instagram, TikTok and YouTube. When you follow, comment, message or otherwise interact with us on those platforms, the platform's own privacy policy applies to the data it collects.

We use an automated tool, connected to Meta, to publish our own posts to our own Facebook Page and Instagram account. It does not read comments, messages or insights, and it processes no data about visitors to this website.

We do not offer “Log in with Facebook”, and our Meta app does not receive data from your Facebook or Instagram account.

Email mirabelleartists@gmail.com with the subject “Delete my data”. In the email, tell us:

• the phone number and/or email address you used with us (for tickets, WhatsApp updates or a booking);
• your order reference, if you have one — it helps us find everything quickly.

Please write from that email address if you can. We may ask you to confirm the request, so that nobody can delete someone else's data.

What we delete:records of unfinished (unpaid) checkouts; WhatsApp update requests; website analytics records linked to you; notes our team made about your visit; booking inquiry emails; and referral-partner details. We also stop all marketing emails and WhatsApp messages to you. Copies in our hosting provider's technical logs expire under its own settings.

What we must keep: records of paid tickets and payments (your name, what you bought, the amount, the date and the payment reference), because tax and accounting law requires us to keep them. We keep them only for that purpose and stop using them for anything else. We also keep your email address or phone number on our do-not-contact list, only so that we never contact you again.

Data held by others:Meta controls the data it received through the Pixel and Conversions API. You can see and clear it in your Facebook or Instagram settings, under “Your activity off Meta technologies”. Payment providers keep their own transaction records under their own legal obligations. Our Meta app holds no data from your Facebook or Instagram account, so there is nothing to delete there.

Our commitment: we will complete your request and reply within 14 days, confirming what we deleted and anything we had to keep, and why.

Email a deletion request

We will update this page when the way we handle personal data changes, and change the “Last updated” date below. If a change is significant, we will say so clearly at the top of this page.

Last updated: 10 October 2026