1. Information We Collect
We collect the following types of information:
- Account Information: Email address, first name, last name, phone number, and language preference when you register.
- Payment Information: Payment processing is handled entirely by Stripe. We store only your Stripe customer ID and payment intent IDs, never your card details.
- Usage Data: QR code redemptions, partner visits, benefit usage history, and pass activity.
- Location Data: Approximate location when redeeming benefits (used for proximity verification). This is only collected with your permission at the time of redemption.
- Device Information: Browser type, device type, and IP address for security and service improvement.
2. How We Use Your Information
- To provide and maintain the Caribbean Pass service
- To process your pass purchases and payments
- To verify QR code redemptions and prevent misuse
- To send transactional emails (purchase confirmations, pass expiry reminders)
- To improve the Service and develop new features
- To comply with legal obligations
3. Information Sharing
We share your information only in the following circumstances:
- Partner Businesses: When you redeem a benefit, the partner sees your first name to confirm the redemption. Partners do not receive your email, phone, or other personal details.
- Payment Processor: Stripe processes your payments under their own Privacy Policy.
- Service Providers: We may use third-party services for email delivery, error monitoring, and analytics.
- Legal Requirements: We may disclose information when required by law or to protect our rights.
4. Data Security
We implement industry-standard security measures to protect your data, including:
- HTTPS encryption for all data in transit
- JWT-based authentication with token rotation
- Encrypted QR tokens with 60-second expiry
- Password hashing using industry-standard algorithms
- Rate limiting to prevent brute-force attacks
5. Data Retention
We retain your account data for as long as your account is active. Pass purchase and redemption history is retained for 2 years for business reporting purposes. You may request deletion of your account and associated data at any time.
6. Your Rights
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your account and data
- Export your data in a portable format
- Withdraw consent for location data collection
7. Cookies
We use essential cookies and local storage for authentication (JWT tokens). We do not use third-party tracking cookies or advertising cookies. No cookie consent banner is required as we only use strictly necessary cookies.
8. Children's Privacy
The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children.
9. International Data Transfers
Your data may be processed in servers located outside of the Cayman Islands. We ensure appropriate safeguards are in place for any international data transfers.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes via email. The "last updated" date at the top indicates when the policy was last revised.
11. Contact Us
For privacy-related questions or to exercise your data rights, contact us at privacy@caribbeanpass.app