Privacy Policy

This Privacy Policy describes how IDARDIRECT LLC ("Company", "we", "us", "our") collects, uses, and protects information about you when you use Pass Studio (the "Service"). By using the Service, you agree to the practices described in this policy.

We are committed to handling your data responsibly. We do not sell your personal information to third parties.

1. Information We Collect

Account information. When you register, we collect your name, email address, and authentication credentials. If you sign in via Apple or Google, we receive only the information those providers share with us (typically name and email).

Pass content. We store the pass designs, images, barcodes, field values, and distribution settings you create through the Service. This content is necessary to operate the Service on your behalf.

End-customer data processed on behalf of merchants. When a merchant connects an e-commerce platform such as Shopify, we receive and process limited data about that merchant's customers in order to provide the Service to the merchant: customer identifiers, name and email address, order references, discount-code usage, and loyalty activity (points earned and rewards redeemed). We process this data solely as a service provider (data processor) acting on the merchant's instructions — to issue and personalise wallet passes, deliver pass installation links, maintain loyalty balances, and match customers to their pass at the point of sale. We do not use end-customer data for advertising or for any purpose of our own, and we never sell it. The merchant remains the data controller for their customers' data; our processing is governed by our Data Processing Addendum.

Usage and analytics data. We collect information about how passes are downloaded and used — including timestamps, device platform (Apple or Google), IP-derived geography (country, region, city), user agent, and UTM attribution parameters. This data is used to power the analytics dashboard we provide to you.

Billing information. Payments are processed by Stripe. We do not store full card numbers or CVCs. We retain transaction records and the Stripe customer ID associated with your account for billing and support purposes.

Communications. If you contact us by email, we retain the content of your message and your contact information in order to respond.

Log data. Our servers automatically record information when you use the Service, including your IP address, browser type, pages visited, and error events. This data is used for security monitoring and debugging.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process transactions and manage your subscription
• Generate the analytics and reporting features available to you
• Send transactional emails (account confirmations, billing receipts, service notices)
• Respond to support requests and communications
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations
• Improve and develop the Service

We will not use your data for purposes materially different from those listed above without first obtaining your consent.

3. Information We Share

We do not sell, rent, or trade your personal information. We share data only in the following limited circumstances:

• Service providers. We use trusted third-party vendors to operate the Service, including Google Cloud (infrastructure and data storage), Firebase (authentication and database), Stripe (payment processing), Resend (transactional email delivery), and Google BigQuery (analytics). These providers access data only as necessary to perform services on our behalf and are contractually obligated to protect it.
• Apple and Google Wallet. When a pass holder adds a pass to their wallet, their device communicates with Apple or Google servers directly. Those interactions are governed by Apple's and Google's own privacy policies.
• Legal compliance. We may disclose information if required to do so by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of IDARDIRECT LLC, our users, or the public.
• Business transfers. If IDARDIRECT LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

4. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, in accordance with the principles of the General Data Protection Regulation (GDPR) and applicable data protection laws. Our retention periods are as follows:

• Account and pass content. Retained for the duration of your account. If you delete your account, we will delete or irreversibly anonymise all personal data associated with it within 30 days, except where retention is required by law (e.g. financial records, which may be kept for up to 7 years).
• Individual analytics events (pass download records containing identifiers such as IP-derived location or user agent) are retained for a maximum of 13 months from the date of the event. After this period, individual event records are deleted or aggregated into non-identifiable statistics.
• Aggregated, non-identifiable statistics (e.g. monthly download totals by platform and country, with no link to individual users or devices) may be retained indefinitely for product analytics and reporting.
• End-customer data received from connected platforms (e.g. Shopify) is retained while the merchant's integration remains active, and is deleted or irreversibly anonymised within 30 days of the integration being disconnected, the merchant's account being deleted, a merchant deletion request, or a valid platform-issued redaction request.
• Billing and transaction records are retained for up to 7 years as required by applicable financial and tax regulations.
• Support communications are retained for 24 months from the date of last contact, after which they are deleted.

If you request deletion of your account or specific data, we will action your request within 30 days and confirm once completed.

5. Data Security

We implement industry-standard security measures to protect your information, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. However, no method of transmission or storage is 100% secure. We encourage you to use a strong, unique password and to notify us immediately if you suspect any unauthorised access to your account.

6. Cookies and Tracking

We use session cookies to keep you signed in to the Service. We do not use third-party advertising or tracking cookies. Our analytics are first-party and server-side — we do not embed third-party analytics scripts on our pages.

7. Your Rights and Choices

Depending on your location, you may have rights regarding your personal data, including the right to access, correct, export, or delete it. To exercise any of these rights, please contact us at info@idardirect.com.

You may delete your account at any time from your account settings or by contacting us. Deleting your account will permanently remove your pass designs and associated data, subject to our retention obligations.

If you are a customer of one of our merchants (for example, you hold a loyalty pass issued through Pass Studio), please direct requests to access, correct, or delete your data to that merchant — they are the controller of your data. We assist our merchants in fulfilling such requests and honour deletion and redaction requests forwarded by the merchant or the connected platform.

8. Children's Privacy

The Service is not directed to children under the age of 13, and we do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under 13, we will take steps to delete it promptly.

9. International Data Transfers

IDARDIRECT LLC is based in the United States. If you access the Service from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate. By using the Service, you consent to such transfers.

10. Third-Party Links

The Service may contain links to third-party websites or services. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party sites you visit.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email or by a prominent notice within the Service. Your continued use of the Service after any change becomes effective constitutes your acceptance of the revised policy. The "Effective date" at the top of this page indicates when this policy was last updated.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

IDARDIRECT LLC
info@idardirect.com