Privacy Policy

1. What we collect

We keep things minimal. Here's what we store:

• Venue owners and organisations: Email address and password (via Firebase Authentication), venue or organisation name, and logo if you upload one. If you create an account on behalf of a company or club, we store the details you provide during registration.
• Ticket buyers: Name and phone number (if provided). This is entered by venue staff at the point of sale or by the buyer when purchasing online. Ticket buyers do not need to create an account.
• Payments: All payment processing is handled by Stripe. We do not store credit card numbers, bank account details, or other financial information on our servers. Stripe's privacy policy governs the handling of payment data.

2. How we use it

We use the information we collect to:

• Run your drawdrops, manage tickets, and select winners.
• Display the public drawdrop page with prize details, countdown, and venue branding.
• Show the winner's first name and ticket number on the drawdrop page after a draw.
• Notify the winner via text message if a phone number was provided.
• Communicate with venue owners about their account, billing, or platform updates.
• Maintain and improve the platform.

We do not use your data for marketing to third parties, and we do not sell your information to anyone.

3. Who sees your data

Venue owners can see the names and phone numbers (if provided) of ticket buyers for their own drawdrops. They cannot see data from other venues.

The publiccan see the winner's first name and ticket number on the drawdrop page after the draw has been completed. Full names and phone numbers are not displayed publicly.

We do not sell, rent, or share your personal information with third parties for their own purposes. We only share data with the service providers described in section 4 to the extent necessary to operate the platform.

4. Third-party services

We rely on the following third-party services to operate Drawdrop:

• Firebase / Google Cloud: Authentication, database, and hosting. Data is stored on Google Cloud infrastructure. Google's privacy policy and data processing terms apply.
• Stripe: Payment processing for drawdrop creation fees and online ticket sales. Stripe handles all card and banking data. Stripe's privacy policy applies to payment information.

We do not use third-party analytics, advertising networks, or tracking services.

5. Data storage & security

Your data is stored in Firebase (Google Cloud) and Stripe. Both are industry-standard platforms with strong security practices, including encryption in transit and at rest.

We take reasonable steps to protect your information from unauthorised access, alteration, or destruction. However, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.

Data may be stored on servers located outside of Australia, in jurisdictions where Google Cloud and Stripe operate. By using Drawdrop, you consent to the transfer of your data to these locations.

6. Cookies

We use essential cookies for authentication only — to keep you logged in while you use the platform. We do not use tracking cookies, analytics cookies, or advertising pixels.

7. Data retention

Account data: We retain your account information for as long as your account is active. If you close your account, we will delete your data within 30 days, except where we are required by law to retain it.

Drawdrop and ticket data: Draw results, ticket records, and winner information are retained for record-keeping purposes. Completed drawdrop data may be retained for up to 2 years after the draw date to support dispute resolution and regulatory requirements.

Payment data: Payment records are retained by Stripe in accordance with their data retention policies and applicable financial regulations.

8. Your rights

Under the Australian Privacy Principles (APPs), you have the right to:

• Access: Request a copy of the personal information we hold about you.
• Correction: Ask us to correct any inaccurate or incomplete information.
• Deletion: Request that we delete your personal information, subject to any legal obligations to retain it.

Venue owners can delete their account and associated data by contacting us. If you are a ticket buyer and want your name removed from a past draw, contact the venue directly or email us and we will assist.

To exercise any of these rights, email hello@drawdrop.app

9. Children

You must be at least 18 years of age to create a Drawdrop account. There is no age restriction on purchasing raffle tickets through the platform, unless imposed by the venue or organisation running the draw, or required by applicable law.

We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete it promptly.

10. Business & company accounts

If you create a Drawdrop account on behalf of a company, club, or organisation, the organisation is the data controller for any personal information collected through its drawdrops (such as ticket buyer names and phone numbers).

The organisation is responsible for ensuring that its collection and use of personal information through Drawdrop complies with the Australian Privacy Principles and any other applicable privacy laws. This includes providing appropriate notice to ticket buyers about how their information will be used.

Drawdrop acts as a data processor on behalf of the organisation for ticket buyer data. We process this data only as necessary to provide the platform and run drawdrops.

11. Changes to this policy

We may update this privacy policy from time to time. If we make significant changes, we will notify you via email or through the platform. Continued use of Drawdrop after changes are posted means you accept the updated policy. We encourage you to review this policy periodically.

12. Contact

Privacy questions or data requests? Email hello@drawdrop.app