Privacy Policy

We collect the following categories of personal information:

• Information you give us. Your legal name (which must match your photo ID, because partner staff verify it at redemption), email address, mobile phone number, ZIP code, and account password. If you join through a partner pizzeria link, we record which partner referred you.
• Payment information. Your card details are entered directly into our payment processor’s hosted checkout and are never transmitted to or stored on DoughPass servers. We receive and store only the card brand, last four digits, expiration date, and a processor-issued token used to bill your subscription.
• Service usage. Redemptions you make (which pizzeria, date, and time), receipt photos you choose to upload, referral activity, and support correspondence.
• Technical information. IP address, browser and device type, pages viewed, and approximate location derived from IP address, collected through cookies and similar technologies.

We do not collect Social Security numbers, government ID numbers, financial account numbers, precise geolocation, biometric data, health information, or information about your race, religion, sexual orientation, or political views. We do not knowingly collect information from anyone under 18.

• To create and administer your account and verify your identity at redemption.
• To bill your recurring membership fee and manage renewals, cancellations, and refunds.
• To operate the redemption system, including generating your rotating redemption code.
• To reimburse participating pizzerias for redemptions you make.
• To send transactional messages — receipts, renewal notices, account and security alerts.
• To send marketing messages, where you have not opted out.
• To prevent fraud and abuse, enforce our Terms, and comply with law.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose information only as follows:

• Participating pizzerias. When you redeem, the pizzeria sees your first name, last initial, and membership status — enough to verify you against your ID. They do not receive your email, phone number, or payment information.
• Service providers. Payment processing, database and application hosting, transactional and marketing email delivery, and analytics. These vendors may use your information only to perform services for us.
• Legal and safety. Where required by law, subpoena, or court order, or to protect the rights, property, or safety of DoughPass, our members, or the public.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

Payment card processing is performed by a PCI DSS Level 1 certified payment processor. Card details are collected on the processor’s hosted checkout page and tokenized by the processor. DoughPass never receives, transmits, or stores your full card number or security code.

We use strictly necessary cookies to keep you signed in and to secure the Service, and analytics cookies to understand how the Service is used. Most browsers let you refuse or delete cookies; the Service may not function correctly without strictly necessary cookies. We do not respond to “Do Not Track” browser signals, but we honor Global Privacy Control (GPC) signals as opt-out requests where applicable law requires.

You may opt out of marketing email at any time using the unsubscribe link in any marketing message or by emailing hello@doughpass.com. Transactional messages about your account, billing, and membership are not marketing and will continue while your account is open.

Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal information, and to opt out of sale or sharing (we do neither). Residents of California, Colorado, Connecticut, Virginia, Utah and other states with comprehensive privacy laws have these rights under those laws.

To exercise a right, email hello@doughpass.com from the address on your account. We will verify your identity and respond within the time required by law (generally 45 days). We will not discriminate against you for exercising a privacy right. If we deny your request, you may appeal by replying to our response.

We keep account and redemption records for as long as your account is active and for up to seven years afterward, to meet tax, accounting, chargeback, and legal-defense obligations. Aggregated or de-identified data that cannot reasonably identify you may be kept indefinitely.

We protect your information with encryption in transit (TLS) and at rest, row-level access controls on our database, hashed passwords, and multi-factor authentication on administrative access. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.

The Service is for adults 18 and older. We do not knowingly collect personal information from children. If you believe a child has given us information, email us and we will delete it.

We may update this Policy. If we make a material change, we will post the updated Policy here with a new effective date and, where required, notify you by email. Continued use of the Service after the effective date means you accept the updated Policy.

DoughPass, a trade name of KBSO LLC
New York, NY
Email: hello@doughpass.com