Privacy Policy

1. Introduction

Daly Planet Productions LLC ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services at gatherandgasp.com (the "Service").

This policy applies to all users worldwide, including those in the European Economic Area (EEA), United Kingdom, and California.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, and password when you create an account
• Payment Information: Billing address and payment details (processed securely by Stripe)
• Mystery Preferences: Theme choices, player counts, and customization options
• Communications: Messages you send to our support team

2.2 Information Collected Automatically

• Device Information: Browser type, operating system, device identifiers
• Usage Data: Pages visited, features used, time spent on site
• Log Data: IP address, access times, referring URLs
• Cookies: See our Cookie Policy for details

2.3 Information from Third Parties

• OAuth Providers: If you sign in with Google, we receive your name and email
• Payment Processor: Stripe provides transaction confirmations

3. How We Use Your Information

We use your information to:

• Provide and maintain the Service
• Process your purchases and deliver mystery kits
• Send transactional emails (order confirmations, password resets)
• Respond to your inquiries and support requests
• Improve our Service and develop new features
• Send marketing communications (with your consent)
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. Legal Basis for Processing (EEA/UK)

If you are in the EEA or UK, we process your data based on:

• Contract: To fulfill our agreement with you (providing the Service)
• Consent: For marketing communications and non-essential cookies
• Legitimate Interests: To improve our Service and prevent fraud
• Legal Obligation: To comply with applicable laws

5. Information Sharing

We do not sell your personal information. We may share your data with:

• Service Providers: Companies that help us operate (Railway for hosting and database, Resend for email)
• Analytics Partners: PostHog for usage analytics (anonymized), Google Analytics (GA4) for website analytics and conversion tracking, and Meta Pixel for advertising conversion tracking and optimization
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale

6. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Specifically:

• Account Data: Until you delete your account
• Purchase History: 7 years (for tax/legal compliance)
• Support Communications: 3 years after resolution
• Usage Analytics: 26 months (anonymized after)

7. Your Rights

7.1 All Users

You can:

• Access and update your account information
• Delete your account
• Opt out of marketing emails
• Request a copy of your data

7.2 EEA/UK Users (GDPR)

You also have the right to:

• Rectification: Correct inaccurate personal data
• Erasure: Request deletion ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a portable format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent at any time
• Lodge Complaint: File a complaint with your supervisory authority

7.3 California Residents (CCPA)

Under the CCPA, you have the right to:

• Know: What personal information we collect and how it's used
• Delete: Request deletion of your personal information
• Opt-Out: Opt out of the sale of personal information (we do not sell)
• Non-Discrimination: Not be discriminated against for exercising your rights

To exercise any rights, email privacy@gatherandgasp.com or use the settings in your account.

8. International Data Transfers

Your data may be transferred to and processed in the United States. We use appropriate safeguards including:

• Standard Contractual Clauses approved by the European Commission
• Data Processing Agreements with all service providers
• Encryption in transit and at rest

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• TLS encryption for all data in transit
• AES-256 encryption for data at rest
• Regular security audits and penetration testing
• Access controls and authentication requirements
• Employee training on data protection

While we strive to protect your data, no method of transmission over the Internet is 100% secure. You are responsible for keeping your password confidential.

10. Children's Privacy

Our Service is not intended for children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately.

11. Third-Party Links

Our Service may contain links to third-party websites. We are not responsible for the privacy practices of these sites. We encourage you to read their privacy policies.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will also send an email notification.

13. Contact Us

For privacy-related inquiries or to exercise your rights:

Email: privacy@gatherandgasp.com

Data Protection Officer: dpo@gatherandgasp.com

Address: Daly Planet Productions LLC, Colorado