loading...
loading...
Last updated: 2 August 2026
Drawdrop is operated by Madaket Labs Pty Ltd (ABN 88 688 376 712). This policy describes how we collect, use, store, and protect personal information when you use the Drawdrop platform. Drawdrop is available to users in Australia and the United States.
We collect only the information necessary to operate the platform. Here is what Drawdrop stores:
What we do not store: Credit card numbers, bank account details, and other financial information are handled entirely by Stripe and are never stored on Drawdrop servers. SMS delivery is handled by Twilio and email delivery is handled by SendGrid — contact details are passed to these services solely to deliver notifications and are not retained by them for marketing purposes.
We use the information we collect to:
We do not use your data for marketing to third parties, and we do not sell your information to anyone.
Venue owners can see the names, phone numbers, email addresses, bid amounts, and donation amounts of participants in their own events. They cannot see data from other venues.
The publiccan see the winner's first name and ticket number on the event page after the draw has been completed. In silent auctions, current bid amounts may be visible to other bidders. Full names, phone numbers, and email addresses are not displayed publicly.
We do not sell, rent, or share your personal information with third parties for their own purposes. We only share data with the service providers described in section 4 to the extent necessary to operate the platform.
We rely on the following third-party services to operate Drawdrop:
We use essential cookies for authentication only. Specifically, we use the __session cookie set by Firebase Authentication to maintain your logged-in session while you use the platform. This cookie is strictly necessary for the platform to function and is not used for tracking or advertising.
We do not use tracking cookies, analytics cookies, advertising pixels, or any third-party cookies.
To protect the platform from abuse, Drawdrop implements rate limiting on API endpoints. As part of this process, your IP address may be temporarily processed to enforce request limits. IP addresses used for rate limiting are not stored permanently, are not linked to your account or personal information, and are not used for any purpose other than platform security.
When a venue owner schedules an auto-draw, a server-side cron job processes the draw at the specified time. This automated processing accesses ticket records, selects a winner using the random selection algorithm, updates the event record with the result, and triggers winner notifications via SMS and/or email. No human intervention is involved in the auto-draw process.
Your data is stored in Firebase (Google Cloud) and Stripe. Both are industry-standard platforms with strong security practices, including encryption in transit and at rest.
We take reasonable steps to protect your information from unauthorised access, alteration, or destruction. All API routes are secured with Firebase Authentication verification. However, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security.
Data may be stored on servers located outside of Australia, in jurisdictions where Google Cloud and Stripe operate (including the United States). By using Drawdrop, you consent to the transfer of your data to these locations.
Venue owners can export their event data at any time through the platform dashboard. Exports are available in CSV format and include ticket records, buyer information, bid history, donation records, and sales summaries.
Once exported, the data is under your control. You are responsible for the secure handling, storage, and disposal of exported data in compliance with applicable privacy laws.
Drawdrop computes analytics for venue owners based on event data stored on the platform. This includes revenue totals, payment method breakdowns (cash vs card vs online), staff sales performance, ticket sales over time, and event comparison metrics. Analytics are computed on-demand from raw event data and are not shared with third parties.
Account data: We retain your account information for as long as your account is active. If you close your account, we will delete your data within 30 days, except where we are required by law to retain it.
Event and ticket data: Event results, ticket records, bid history, donation records, and winner information are retained for record-keeping purposes. Completed event data may be retained for up to 2 years after the event date to support dispute resolution and regulatory requirements.
Payment data: Payment records are retained by Stripe in accordance with their data retention policies and applicable financial regulations.
Notification data: SMS and email delivery records are retained by Twilio and SendGrid respectively, in accordance with their data retention policies.
Under the Australian Privacy Principles (APPs) and applicable US privacy laws, you have the right to:
Venue owners can delete their account and associated data by contacting us. If you are a ticket buyer, bidder, or donor and want your information removed from a past event, contact the venue directly or email us and we will assist.
To exercise any of these rights, email hello@drawdrop.dev
Drawdrop is available to users in Australia and the United States. US-based venues process transactions in USD, and US phone numbers are supported for SMS notifications. Regardless of your location, your data is processed and stored in accordance with this privacy policy.
If you are located in the United States, your use of Drawdrop is subject to applicable US federal and state privacy laws. If you are located in Australia, the Australian Privacy Principles apply.
You must be at least 18 years of age to create a Drawdrop account. There is no age restriction on purchasing raffle tickets or event tickets through the platform, unless imposed by the venue or organisation running the event, or required by applicable law.
We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete it promptly.
If you create a Drawdrop account on behalf of a company, club, or organisation, the organisation is the data controller for any personal information collected through its events (such as ticket buyer names, bidder details, donor information, and phone numbers).
The organisation is responsible for ensuring that its collection and use of personal information through Drawdrop complies with the Australian Privacy Principles, applicable US privacy laws, and any other relevant privacy legislation. This includes providing appropriate notice to participants about how their information will be used.
Drawdrop acts as a data processor on behalf of the organisation for participant data. We process this data only as necessary to provide the platform and run events.
We may update this privacy policy from time to time. If we make significant changes, we will notify you via email or through the platform. Continued use of Drawdrop after changes are posted constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.
Privacy questions or data requests? Email hello@drawdrop.dev