Privacy Policy

1. Introduction

Placrd Platform ("Placrd," "we," "us," or "our") operates the placrd.appwebsite and related services (collectively, the "Platform"). This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our Platform, whether as an event organizer, participant, voter, or guest.

By accessing or using the Platform, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Platform.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your name, email address, and authentication credentials. You may also provide optional profile information such as a display name, avatar image, bio, tagline, location, and social media links. If you sign in through a third-party provider (such as Google), we receive your name and email address from that provider.

2.2 Event and Registration Data

When you create or register for events, we collect information related to the event, including event details, entry descriptions, registration form responses, and class or category selections. Event organizers may configure custom registration fields, and the information you provide in those fields is collected and stored.

2.3 Payment Information

We use Stripe to process payments. When you make a payment or set up payouts as an organizer, Stripe collects your payment card details, bank account information, and billing address directly. We do not store your full payment card number on our servers. We receive limited transaction information from Stripe, such as the last four digits of your card, transaction amounts, and payment status.

2.4 Photos and Media

You may upload photos of entries, event covers, organization logos, profile avatars, and other images. These images are stored using Cloudflare Images and are associated with your account or event.

2.5 Voting Data

When you vote at events, we collect your ballot selections and associated metadata. Voting may be accessed by scanning QR codes at event venues. Depending on the event configuration, voting may require an account, check-in verification, or may be available to anonymous or guest users.

2.6 Guest and Anonymous Session Data

You can register for events and vote without creating a full account. In these cases, we create a temporary anonymous session to facilitate your participation. We may collect limited information such as an email address or phone number provided during guest registration, as well as session identifiers. If you later create an account with the same email or phone number, your guest activity may be linked to your account.

2.7 Device and Usage Data

We automatically collect information about how you access and use the Platform, including your IP address, browser type, operating system, device identifiers, pages visited, actions taken, and timestamps. We use PostHog for product analytics, which may include session replay (recording of your interactions with the Platform such as clicks, scrolls, and page navigation) to help us understand usage patterns and improve the user experience. Session replay does not capture passwords or payment information.

2.8 Location Data

Some events may require location verification to confirm you are physically present at the venue before voting. If you participate in such an event, we request access to your device's location through your browser. Location data is used solely to verify your proximity to the event venue and is not stored beyond the verification check.

2.9 Device Fingerprint Data

Event organizers may enable device uniqueness verification to prevent duplicate voting. When enabled, we collect a device fingerprint (a combination of device and browser characteristics) to identify unique devices. This data is used solely for voting integrity purposes.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Platform and its features
• Process event registrations and manage entries
• Process payments and facilitate organizer payouts
• Enable and secure the voting process
• Generate leaderboards, results, and event analytics
• Send transactional communications about your events, registrations, and account
• Provide customer support
• Analyze usage patterns to improve the Platform
• Detect and prevent fraud, abuse, and violations of our terms
• Comply with legal obligations

4. Legal Basis for Processing (EEA/UK Users)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases:

• Contract performance: Processing necessary to provide the Platform services you requested, such as account creation, event registration, payment processing, and voting.
• Legitimate interests: Processing necessary for our legitimate interests, such as improving the Platform, preventing fraud, and ensuring voting integrity, where those interests are not overridden by your rights.
• Consent: Processing based on your consent, such as location verification for venue-based voting. You may withdraw consent at any time.
• Legal obligation: Processing necessary to comply with applicable laws and regulations.

5. Data Sharing and Third Parties

We do not sell your personal information. We share your information only in the following circumstances:

5.1 Service Providers

We use the following third-party services to operate the Platform:

• Stripe: Payment processing and organizer payouts. Stripe processes payment data under its own privacy policy.
• PostHog: Product analytics and session replay to understand how users interact with the Platform.
• Supabase: Database hosting, authentication, and file storage infrastructure.
• Cloudflare: Image hosting and delivery for uploaded photos and media.
• Resend: Transactional email delivery for account notifications, event updates, and registration confirmations.

5.2 Event Organizers

When you register for an event, the event organizer may see your registration information, including your name, email address, and any responses you provide in custom registration forms. Organizers use this information to manage their events.

5.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental regulation, or if we believe disclosure is necessary to protect the rights, property, or safety of Placrd, our users, or the public.

6. Offline Data and Local Storage

The Platform uses offline-first technology (PowerSync) for the voting experience. This means your voting data may be temporarily stored on your device and synchronized with our servers when an internet connection is available. Data stored locally on your device is subject to your device's security settings. Clearing your browser data will remove any locally stored Platform data.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. Specific retention periods include:

• Account data: Retained until you delete your account or request deletion.
• Event and registration data: Retained for the duration of the event and a reasonable period afterward to support results, disputes, and organizer reporting.
• Payment records: Retained as required by applicable tax and financial regulations (typically 7 years).
• Voting data: Retained for the duration of the event and results period.
• Anonymous session data: Retained for a limited period to support guest participation and is periodically purged.
• Analytics data:Retained according to our analytics provider's retention policies.

When you delete your account, we will delete or anonymize your personal information within 30 days, except where retention is required by law.

8. Your Rights

8.1 Rights Under GDPR (EEA/UK Users)

If you are in the EEA or UK, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data in certain circumstances.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

8.2 Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act:

• Right to know: Request the categories and specific pieces of personal information we have collected about you, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to delete: Request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to opt-out of sale: We do not sell your personal information. We do not and will not sell personal information to third parties.
• Non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at [email protected].

9. Children's Privacy

The Platform is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected], and we will take steps to delete such information.

10. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

• Essential cookies: Required for Platform functionality, including authentication, session management, and security.
• Analytics cookies: Used by PostHog to understand usage patterns and improve the Platform. These cookies track page views, feature usage, and user interactions.
• Preference cookies: Used to remember your settings and preferences, such as theme selection.

You can control cookie preferences through your browser settings. Disabling essential cookies may affect Platform functionality.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of sensitive data at rest
• Row-level security policies on database tables
• Rate limiting on authentication and API endpoints
• Regular security reviews and access controls

While we strive to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

12. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. Our service providers may operate servers in the United States and other jurisdictions. Where required, we ensure appropriate safeguards are in place for international data transfers, such as standard contractual clauses.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Platform with a revised "Last updated" date, and where appropriate, by sending you an email notification. Your continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

• Email: [email protected]
• Address: [Mailing address pending]

For more information about how we use the Platform, please see our Terms of Service.