Privacy Policy

1. Introduction

This Privacy Policy describes how CS Creative Concepts LLC, doing business as HowlTicket ("Company," "we," "us," or "our"), a New Jersey limited liability company, collects, uses, discloses, and protects your personal information when you use our ticketing platform and related services, including our mobile application HowlTicket Business (available on Google Play and the Apple App Store), our web-based portals, and our embeddable booking widgets (collectively, the "Service").

Our Service is a software-as-a-service (SaaS) platform that enables entertainment venues, escape rooms, haunted attractions, and similar businesses ("Clients") to sell tickets and manage bookings. When you purchase tickets or interact with our platform, you are both our user and a customer of our Client.

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide Directly

Account & Booking Information:

• Full name (first and last)
• Email address
• Phone number
• Billing address (street, city, state, postal code, country)

Payment Information:

• Payment card type (e.g., Visa, Mastercard)
• Last four digits of payment card
• Payment transaction identifiers

We do not store complete credit card numbers. All payment processing is handled by Stripe, our PCI-DSS compliant payment processor.

Waiver & Consent Information:

• Digital signature (captured as image)
• Date of birth (for age verification where required)
• Waiver acceptance timestamp

Communications:

• Survey responses
• Customer support inquiries
• Comments or notes you provide during booking

2.2 Information Collected Automatically

Device & Browser Information:

• IP address
• Browser type and version
• Operating system
• Device type (mobile, desktop, tablet)
• Language preferences
• User agent string

Usage Information:

• Pages visited
• Actions taken (bookings, check-ins)
• Date and time of access
• Referring website or source

Location Information:

• Approximate geographic location derived from IP address (country, region, city)
• Precise location (latitude/longitude) when using in-app Tap-to-Pay card payment features, as required by our payment processor Stripe for regulatory compliance. Precise location is accessed only during active payment transactions and is not stored by us.

We collect this information for fraud prevention, security, and service improvement purposes.

2.2.1 Mobile App — Device Permissions and Sensor Data

When you use the HowlTicket Business mobile app, we may request access to certain device features. Each permission is used only for the specific purpose described below and can be managed through your device's settings at any time.

Camera:

We access your device camera for two purposes, both opt-in and tightly scoped:

1. QR / barcode scanning during event check-in (HowlTicket Business app and the HowlTicket Station app). No photos or video are captured, stored, or transmitted for this use. Camera data is processed locally on-device in real time and discarded immediately after the code is read.
2. Clock-in / clock-out photo capture on shared station devices (HowlTicket Station app only, and only when your employer has enabled the optional RequireClockPhoto setting for your venue). When enabled, the station captures a single still image from the front-facing camera at the moment you tap "Clock In" or "Clock Out". The image is uploaded to our secure storage and attached to the corresponding time-clock record as a forensic aid against buddy-punching (a coworker clocking someone else in or out). The station shows a live preview of the camera feed during clock-in so it is always visually obvious the camera is on. Images are not run through face recognition or other biometric processing; they are stored as ordinary photographs and visible only to authorized managers of your venue. The feature is disabled by default and your employer is responsible for notifying staff before enabling it. You may request access to or deletion of these images at any time per the rights described in Section 7.

Push Notifications (Firebase Cloud Messaging):

With your permission, we send push notifications to your device for booking confirmations, check-in alerts, schedule reminders, and operational updates. To deliver these notifications, we collect a Firebase Cloud Messaging (FCM) device token — a unique identifier assigned to your device by Google's Firebase service. This token is stored on our servers and associated with your staff account. You can disable push notifications at any time through your device settings or the app.

NFC (Near Field Communication):

On supported Android devices, we access NFC hardware for processing contactless Tap-to-Pay card payments via Stripe Terminal. NFC is activated only during a payment transaction and is not used for any other purpose. iOS Tap-to-Pay support is planned for a future release.

Biometric Authentication:

On Android devices, the app may offer fingerprint or face unlock for secure login using the system BiometricPrompt API. Biometric data is processed entirely on your device and never leaves it. We never receive, transmit, or store your biometric data — we receive only a pass/fail authentication result from your device. Biometric login on iOS is planned for a future release.

2.3 Information from Third Parties

We may receive information about you from:

• Stripe: Payment confirmation, fraud signals, chargeback data
• Google Firebase: Push notification delivery status, device token updates
• Our Clients: Event details, venue information
• Geolocation services: Approximate location data from IP address

3. How We Use Your Information

3.1 Provide and Operate the Service

• Process ticket purchases and bookings
• Send booking confirmations and digital tickets
• Manage check-ins at events
• Process refunds and exchanges

3.2 Communications

• Send booking reminders (with your consent)
• Send post-event follow-up emails (with your consent)
• Respond to customer support requests
• Send SMS notifications (with your explicit opt-in)
• Send push notifications for booking confirmations, check-in alerts, and operational updates (with your permission)

3.3 Security and Fraud Prevention

• Verify identity and prevent fraud
• Collect payment evidence for chargeback disputes
• Monitor for suspicious activity
• Maintain audit logs for security purposes

3.4 Legal Compliance

• Comply with legal obligations
• Enforce our Terms of Service
• Maintain records as required by law

3.5 Service Improvement

• Analyze usage patterns to improve the Service
• Conduct internal analytics and reporting
• Develop new features

3.6 AI-Assisted Features

Our platform offers optional AI-powered business insights ("Luna") to help Clients analyze operational data such as revenue trends and booking patterns. When a Client opts in to Luna:

• All entity names and identifiers are replaced with anonymous pseudonyms (e.g., XENT_001) before any data is sent to the AI service.
• No personally identifiable information (PII) — such as customer names, emails, or phone numbers — is ever transmitted to the AI provider.
• Only aggregated, anonymized business metrics are processed.
• AI processing is provided by Anthropic. See Anthropic's Privacy Policy.

Luna features require explicit opt-in from each Client. Customer-facing users (ticket purchasers) are not directly affected by this feature.

4. Legal Bases for Processing (EEA/UK Users)

If you are located in the European Economic Area (EEA) or United Kingdom (UK), we process your personal data under the following legal bases:

5. How We Share Your Information

5.1 With Our Clients

When you book tickets through our platform, we share your booking information with the venue or event operator (our Client) so they can:

• Verify your booking at check-in
• Contact you about your reservation
• Provide customer service

5.2 With Service Providers (Subprocessors)

We use third-party service providers to help operate our Service:

5.2.1 Third-Party SDK Data Collection

Our mobile app integrates third-party software development kits (SDKs) from the providers listed above. These SDKs may independently collect diagnostic data, crash reports, and performance metrics as described in their respective privacy policies:

• Stripe SDK — may collect device information and fraud signals. See Stripe's Privacy Policy.
• Firebase SDK — may collect app instance identifiers for push notification delivery. See Firebase's Privacy Information.

We do not control the data these SDKs collect independently. Their data collection practices are disclosed in our Apple App Store and Google Play Store privacy nutrition labels.

5.3 For Legal Reasons

We may disclose your information if required to:

• Comply with applicable law, regulation, or legal process
• Respond to valid legal requests from public authorities
• Protect our rights, privacy, safety, or property
• Enforce our Terms of Service

5.4 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal information.

6. Data Retention

We retain your personal information for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce agreements.

7. Your Rights and Choices

7.1 All Users

• Access and Portability — You may request a copy of your personal data.
• Correction — You may request correction of inaccurate data.
• Deletion — You may request deletion of your personal data, subject to legal retention requirements. You can request account deletion through the app or by emailing support@howlticket.com. Upon request, we will delete your account and associated personal data within 30 days, except for records we are legally required to retain (e.g., transaction records for tax purposes).
• Opt-Out of Marketing — You may unsubscribe from marketing emails using the link in any email, or by contacting us.
• SMS Opt-Out — Reply STOP to any SMS message to opt out.
• Push Notification Opt-Out — You may disable push notifications at any time through your device's notification settings or by revoking the notification permission for the HowlTicket Business app.

7.2 EEA/UK Users (GDPR Rights)

If you are in the EEA or UK, you have additional rights:

• Right to Object — Object to processing based on legitimate interests
• Right to Restrict Processing — Request limitation of processing
• Right to Withdraw Consent — Withdraw consent at any time
• Right to Lodge a Complaint — File a complaint with your local data protection authority

7.3 California Residents (CCPA Rights)

California residents have the right to:

• Know what personal information is collected
• Know whether personal information is sold or disclosed
• Say no to the sale of personal information
• Access personal information
• Request deletion of personal information
• Not be discriminated against for exercising rights

We do not sell personal information.

7.4 Exercising Your Rights

To exercise any of these rights, contact us at support@howlticket.com. We will respond within 30 days (or sooner if required by applicable law).

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption in transit (TLS 1.2+)
• Encryption at rest for sensitive data
• Access controls and authentication
• Regular security assessments
• Employee training on data protection

9. International Data Transfers

Our servers are located in the United States. If you are located outside the United States, your information will be transferred to and processed in the United States.

For EEA/UK users, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Your explicit consent for certain transfers

10. Children's Privacy

Our Service is not directed to children under 13 (or 16 in the EEA/UK). We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

For ticket purchases that include minors, the adult purchaser is responsible for providing consent and information.

11. Cookies and Tracking Technologies

We use cookies and similar technologies for authentication, preferences, and analytics. See our Cookie Policy for details on:

• Types of cookies we use
• How to manage cookie preferences
• Third-party cookies

11.1 Tracking and Advertising

We do not track you across other companies' apps or websites. Specifically:

• We do not use Apple's Advertising Identifier (IDFA) or Google's Advertising ID (GAID).
• We do not participate in cross-app or cross-site tracking for advertising purposes.
• We do not share your data with advertising networks, data brokers, or information resellers.
• We do not display third-party advertisements within our app.

12. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these websites. We encourage you to review their privacy policies.

13. Apple App Store

The HowlTicket Business mobile application is available on the Apple App Store. This section provides additional information specific to Apple's privacy requirements.

13.1 App Tracking Transparency

HowlTicket Business does not track you across apps or websites owned by other companies. We do not use Apple's App Tracking Transparency framework because we do not engage in any form of tracking as defined by Apple. No ATT permission prompt is displayed because none is required.

13.2 Privacy Nutrition Labels

Apple requires developers to disclose the types of data their apps collect. The following table summarizes the data HowlTicket Business collects and how it is used, consistent with our App Store privacy labels:

Data Not Used to Track You: None of the data collected by HowlTicket Business is used to track you across apps or websites owned by other companies.

13.3 Account Deletion

In compliance with Apple App Store guidelines, you can request deletion of your account and associated personal data through the HowlTicket Business app or by contacting us at support@howlticket.com. Upon requesting deletion:

• Your account will be deactivated immediately.
• Personal data will be permanently deleted within 30 days.
• Certain records (e.g., transaction history) may be retained as required by law (see Section 6).
• You will receive a confirmation email when deletion is complete.

13.4 Third-Party SDKs

The HowlTicket Business iOS app includes third-party SDKs that may collect data independently. Each SDK includes an Apple-required privacy manifest (PrivacyInfo.xcprivacy) declaring its data collection practices:

• Stripe iOS SDK — payment processing, fraud detection
• Firebase iOS SDK — push notification delivery

Details of SDK data collection are reflected in our App Store privacy nutrition labels above.

14. Google Play Store

The HowlTicket Business mobile application is also available on Google Play. This section provides additional information specific to Google's privacy requirements.

14.1 Data Safety Declaration

Google requires developers to disclose data collection, sharing, and security practices in the Data Safety section of the Google Play listing. The following summarizes our declaration, consistent with this Privacy Policy:

14.2 Data Handling Practices

• Data encrypted in transit: Yes (TLS 1.2+)
• Data can be deleted: Yes — users can request account and data deletion (see Section 7.1)
• Independent security review: Payment processing is PCI-DSS compliant via Stripe

14.3 Families Policy

HowlTicket Business is not directed at children under 13 and does not participate in Google Play's Designed for Families program. See Section 10 (Children's Privacy) for details.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website
• Updating the "Last Updated" date
• Sending email notification for significant changes

Your continued use of the Service after changes constitutes acceptance of the updated policy.

16. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us:

State-Specific Disclosures

Residents of Virginia (VCDPA), Colorado (CPA), and Connecticut (CTDPA) have rights similar to those described for California residents above. Contact us to exercise these rights.

This Privacy Policy is provided in English. Translations may be provided for convenience, but the English version governs.