Privacy Policy

1. Who this policy covers

In shortTwo groups: staff who sign in to the app, and guests who scan a QR code. Staff accounts are created by their employer, not by signing up.

• Authorized users — employees, contractors and venue staff who sign in to the app or web dashboard. A venue operator or employer (the “Operator”) creates these accounts and decides what each one may see; the app has no self-service sign-up.
• Guests — visitors who scan the QR code on a machine to report a problem. No account, and no app, required.

For authorized users we act as a service provider to the Operator, which decides why work data is processed. For guest reports and our website, we are the controller.

2. At a glance

In shortWe do not sell your data, advertise to you, track you, or read your location. What we collect exists to run maintenance tickets.

3. Information we collect

In shortFrom the app: your account, your ticket activity, and photos you choose to attach. From the guest form: how to reach you and what went wrong. Nothing beyond that.

3.1 Authorized users of the app

The app does not access your contacts, calendar, health data, precise location, microphone, browsing history, or any photo other than the images you choose to attach.

3.2 Guests using the QR report form

3.3 Website, waitlist and cookies

If you join the early-access waitlist we collect your name, email address and any message you write, and use them only to contact you about Arcade Aid Pro. Ask us to remove you at any time.

Our website sets only strictly necessary cookies — one to keep you signed in and one to protect forms against cross-site request forgery. No advertising cookies, no cross-site trackers, no third-party analytics. The app uses no cookies for tracking.

4. Device permissions the app requests

In shortThree permissions, all optional, all revocable in system settings. The ticket workflow works without any of them.

Change or withdraw any of these in iOS Settings › Arcade Aid Pro, or the equivalent Android permission screen. Turning notifications off stops delivery immediately; signing out also deletes that device's push token from our servers.

5. How we use information

In shortTo run tickets, let a venue follow up with you, keep accounts secure, and fix bugs. That is the whole list.

• Create, route, update and close maintenance tickets, and keep a service history per machine.
• Let venue staff follow up with a guest about a report, using the contact method the guest chose.
• Authenticate users, enforce what each account may access, and support two-factor authentication.
• Send operational messages — push alerts about your tickets, plus emails such as password resets and report confirmations.
• Give Operators aggregate reporting on issue volume and machine reliability. That reporting is about equipment, not individuals.
• Keep the Service secure: detect and prevent fraud and abuse, and rate-limit sign-in and upload endpoints.
• Diagnose failures, fix bugs and improve reliability.
• Comply with legal obligations and enforce our terms.
• Contact you about availability, if you joined the waitlist.

We do not build advertising profiles, train machine-learning or AI models on personal information, or make decisions with legal or similarly significant effects about you by solely automated means.

6. Legal bases (EEA / UK)

In shortIf the GDPR applies to you: contract for the core service, legitimate interests for security, legal obligation where required, and consent for anything optional.

• Contract — providing the app to authorized users and handling a guest's report.
• Legitimate interests — securing the Service, preventing fraud and abuse, diagnosing failures, and running our business, balanced against your rights.
• Legal obligation — records we must keep, and responding to lawful requests.
• Consent — notifications, camera and photo access, waitlist emails, and any photo you attach. Withdraw it at any time; that does not undo processing already carried out.

7. Who we share information with

In shortOnly the venue operator, its ticketing system, and the providers that host and deliver for us. Each is contractually bound to protect your data as we do.

We do not sell personal information, do not share it for cross-context behavioral advertising, and do not disclose it to data brokers.

8. How long we keep information

In shortEach kind of data has an end date. Nothing is kept indefinitely, and photos that never get attached are deleted within a day.

We may keep specific records longer where the law requires it, or where they are needed for an unresolved dispute or investigation. Those are isolated and used for nothing else. A ticket filed into an Operator's own system is also subject to that Operator's retention schedule.

9. How we protect information

In shortEncrypted in transit, passwords hashed and never readable, two-factor available, and every account scoped to its own venues.

• All traffic between the app, the website and our servers is encrypted with TLS.
• Passwords are stored only as salted one-way hashes; two-factor secrets and recovery codes are encrypted at rest.
• Access is scoped by role and by venue, so an account only ever loads records it is authorized to see. Optional two-factor authentication is available to every account.
• Photo uploads use signed URLs that expire in 15 minutes and are bound to the declared file type, so images are never exposed through a shared public path.
• Sign-in, upload and report endpoints are rate-limited, and access tokens are individually revocable.

No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as applicable law requires.

10. Your rights and choices

In shortEmail us and you can find out what we hold, correct it, get a copy, have it deleted, or withdraw consent. Notifications and photo access you can switch off yourself.

Depending on where you live, you may have the right to:

• Know and access what we hold about you and how we use it, and receive a copy in a portable format.
• Correct information that is wrong or incomplete.
• Delete your information — see section 11.
• Object to or restrict processing based on legitimate interests, and withdraw consent at any time.
• Not be discriminated against for exercising any of these rights.

Making a request

Email support@arcadeaidpro.com with the subject “Privacy Request”. So we do not hand your data to the wrong person, write from the work address on your account if you are an authorized user, or from the address you entered on the form if you are a guest — and in that case include the approximate date and the venue so we can find the submission.

We respond within 30 days, or 45 where a US state law allows an extension, and tell you if we need longer. An authorized agent may act for you with written proof. If we cannot verify your identity we will say so rather than guess. Unhappy with our answer? Reply to it to appeal, and you may also complain to your local data protection authority.

Turning things off yourself

Notifications, camera and photo access live in iOS Settings › Arcade Aid Pro. Waitlist emails have an unsubscribe link. Operational messages that are part of the Service — password resets, security alerts, confirmation of a report you filed — cannot be switched off separately while your account is active.

11. Account and data deletion

In shortBecause accounts are created by employers rather than in the app, deletion runs by email. We act within 30 days, and signing out already cuts that device off immediately.

Authorized users

Email support@arcadeaidpro.com from your work address with the subject “Delete my account”, or ask your venue administrator. Once verified we disable sign-in and revoke every access and push token, then delete or anonymize your account within 30 days. Tickets and comments you created stay in the machine's service record with your name removed, because the venue needs an intact maintenance history.

Guests

Filing a report creates no account. To have your report, contact details and any attached photo deleted, email support@arcadeaidpro.com from the address you used, with the approximate date and venue. We delete it within 30 days of verifying the request. If your report is still open, we will tell you what has to stay until it closes and delete the rest.

What you can do right now

Signing out of the app immediately revokes that device's access token and removes its push token from our servers. Deleting the app stops all further collection from that device.

We may retain a limited record where the law requires it or an unresolved dispute or investigation needs it; those are isolated, used for nothing else, and deleted once the need ends. Where your employer controls your work data, we notify them of a deletion request as we are required to do.

12. International transfers

In shortEverything is hosted in the United States. Transfers out of Europe rely on the Standard Contractual Clauses.

We operate from the United States, and our servers and photo storage are there. If you use the Service from elsewhere, your information is transferred to and processed in the United States, under laws that may differ from your own. For transfers out of the European Economic Area, the United Kingdom or Switzerland we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum where applicable, plus additional safeguards where needed. Email us for a copy of the relevant safeguards.

13. Children's privacy

In shortThe app is a workplace tool for adults. If a child under 13 filed a report, a parent can email us and we will delete it.

The app is intended solely for adults authorized to service arcade equipment. It is not directed to children, and we do not knowingly collect personal information from children under 13. The guest report form is likewise meant to be completed by an adult. If you believe a child under 13 submitted a report, a parent or guardian may email support@arcadeaidpro.com and we will delete it promptly. Where local law sets a higher age of digital consent, we apply that age.

14. US state privacy rights

In shortCalifornia and other state residents can know, correct, delete and get a copy of their data. There is nothing to opt out of, because we neither sell nor share it.

Under the California Consumer Privacy Act, as amended, the categories of personal information we collected in the past twelve months are: identifiers (name, email, phone number, IP address, account identifiers); customer records; commercial information (the report or ticket you submitted, including partial card digits where a guest supplied them); internet or network activity (app and server log data); visual information (photos you attached); and, for authorized users, professional or employment-related information. Sections 3, 5 and 7 set out the sources, purposes and recipients for each.

In that period we did not sell personal information and did not share it for cross-context behavioral advertising, and we do not do so today. We do not knowingly sell or share the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes that carry a right to limit — in particular, we never use it to infer characteristics about you.

California residents may exercise the rights to know, access, correct, delete, obtain a portable copy, opt out of sale or sharing, and limit the use of sensitive personal information, without discrimination in price or service. Use the process in section 10. If you work for an Operator, that Operator also provides its own notice at collection for the work data it controls.

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have comparable rights, including opting out of targeted advertising, sale and certain profiling — none of which we perform — and, in several states, appealing a refused request. Use the same process in section 10; our response will name the appeal route.

15. Changes to this policy

In shortThe date at the top always reflects the current version, and we give notice before a material change takes effect.

We may update this policy as the Service evolves or the law changes. If a change materially affects how we handle your personal information, we will give notice before it takes effect — by email, an in-app notice, or a prominent notice on this page — and ask for your consent where the law requires it. Continuing to use the Service after a change takes effect means you accept the updated policy.

16. How to contact us

In shortOne address for every privacy question or request, answered within 30 days.

This is the privacy policy referenced in the Arcade Aid Pro App Store listing. It is publicly accessible without signing in, and is linked inside the app under Settings › Privacy Policy.