Privacy Policy

Who this covers

Drawcard is a referral system built on physical NFC cards, operated by One Inch Punch, a division of Bryton Interactive, LLC. Three different kinds of people touch it, and only the first has an account with us:

• Businesses: our customers. A salon, spa, or clinic that buys cards and publishes offers.
• Advocates: people a business gives a card to. Your name and email reached us because a business you know entered them. You have no account with us.
• People who tap a card: you picked up a friend's card and held your phone to it. You have no account, and we do not know your name.

Each section below says which of the three it is about.

If you tapped a card

This is the shortest section, because we collect very little from you.

When you tap a card, we record:

• which card was tapped, and therefore which business and which advocate
• the date and time
• your browser's user-agent string, the standard line every website receives, naming your browser and device model, not you

We do not record:

• your name, email address, or phone number
• your IP address
• your location, precise or approximate

If you claim a code, your browser generates a random value and keeps it. We store only a one-way hash of it, and it does one job: it lets us recognise the same browser asking for the same offer twice, so we hand back the code you already have instead of minting a second one. It is not linked to your identity, it is scoped to a single business, and it cannot be used to follow you anywhere else.

We do not build a profile of you, we do not track you across businesses, and we do not sell or share any of this with advertisers or data brokers.

If you were given a card

A business you have a relationship with entered your name and, usually, your email address so it could give you a card and know that referrals through it were yours. We hold that information on that business's behalf, and we use it only to:

• send you a short message when you are given a card, explaining what it is
• send you a message if that business sends you a thank-you or a gift
• attribute taps and redemptions from your card to you, so the business can see them

We do not market to you on our own behalf, we do not add you to any other list, and we do not pass your details to anyone else.

To be removed: ask the business directly, or email us at support@ohm.cards and we will remove your details and tell the business we did. You do not need an account to ask, and we will not require you to create one.

If your business uses Drawcard

We collect:

• your business details, and the names, email addresses and roles of the people you give access to
• your artwork, offers, and the settings that control where your cards resolve
• billing and shipping information needed to sell you cards and a subscription
• the advocate details you enter, and the tap, claim and redemption records that follow

For the advocate and customer information you enter, you are the controller and we are the processor: it is your data, we hold it on your instructions, we do not use it for our own purposes, and we return or delete it when you ask. Please read the Advocate Information section of our Terms of Service . It sets out what you are promising us about the people whose details you upload.

Who we share information with

We share information only with service providers who need it to run Drawcard, and only for that purpose:

• hosting and database infrastructure
• an email delivery provider, for the messages described above
• a payment processor, for subscription and card orders, and we never see or store full card numbers
• a shipping carrier, for delivering physical cards

We may also disclose information where required by law, or in connection with a merger or sale of the business, in which case this policy continues to apply until replaced with notice to you.

We do not sell personal information, and we never have.

How long we keep it

• Business account data: for as long as the account is open, and 30 days after it closes so you can export it.
• Advocate details: until the business removes them, the account closes, or the advocate asks us to remove them.
• Tap and redemption records: these are how a business measures the programme, so we keep them for the life of the account.
• Claim hashes: for the life of the offer they belong to.

Your rights

Depending on where you live, you may have the right to access the information we hold about you, correct it, delete it, obtain a copy, or object to how it is used. Residents of California, and of jurisdictions covered by the GDPR, have these rights by statute.

Email us and we will act on your request without charging you and without making you create an account. If the information belongs to a business that uses us, we will pass your request to them and tell you we have, but for a deletion request about an advocate we will act ourselves. We will not exercise your rights against you for asking.

Cookies and analytics

Our marketing site and dashboard use cookies necessary to keep you signed in and to understand how the site is used. The value stored by your browser when you claim a code, described above, is not an advertising cookie and is not shared. See our Cookie Policy.

Security

Data is encrypted in transit and at rest with our infrastructure providers, access is limited to people who need it, and each business's data is separated so one account cannot reach another's. No system is perfectly secure; if a breach affects your information we will notify you as required by law.

Children

Drawcard is not directed at children under 13 and we do not knowingly collect their information. If you believe we have, contact us and we will delete it.

Changes to this policy

We may update this policy. For material changes we will email account holders before the change takes effect, and update the date at the top of this page.

Contact Us

This Privacy Policy is governed by the laws of the State of Georgia, United States.