CONCESSIONS.ONLINE
Privacy notice
Version: 2026-10-14 · Private-pilot draft · replaced by the 2026-10-31 notice
Scope and contact
This notice describes the current private pilot of Concessions. The platform operator administers this deployment, and each operating organization manages its own staff, stands and concession operations. For privacy questions, contact the operator through the channel used to provide you access, or contact your organization administrator. This notice is a draft for review before public or commercial release; operator identity, direct privacy contact and deployment-specific practices must be confirmed for that release.
Information processed
Accounts: names and email addresses supplied for registration, invitations and sign-in; passkey public keys and session records; and accepted policy versions. Passkeys replace passwords: your fingerprint, face or device PIN is checked on your own device and never reaches the service. Organizations: profiles, venues, stands, events, menus, roles, staff access, volunteer shifts and positions. Orders: items, options, notes, totals, pickup names, payment method and status, and fulfillment history, and for each online order the email address you give for its receipt and private link. Payments: the organization’s payment processor (Stripe or Square) receives your card details on its own payment page; the service receives the payment’s status, amounts and fees and, for an online card payment, the processor’s card fingerprint, never the card number. Shared stand tablets: each tablet’s stand and the person responsible for it, and which person, chosen from the stand’s roster, did each action on it. Security: network addresses, request metadata and audit records. Avoid entering unnecessary sensitive information in free-text fields.
Email addresses and codes
A one-time code sent to your email address proves the address before you set up a passkey or confirm an order; the code is stored only as a hash and expires after ten minutes. A guest’s email address is stored encrypted on the order. It is used only for the order’s receipt and the alerts you ask for, and, as a one-way hash, to check the organization’s records of orders that weren’t picked up. It doesn’t create an account or add you to a mailing list. A customer who saves a passkey keeps a customer record with their encrypted address so the passkey can confirm it later.
Orders that aren’t picked up
When staff mark an online order as not picked up, the organization keeps a one-way keyed hash of the order’s email address and, for a card payment, of the card fingerprint. These let the organization apply its limits on future online orders, such as requiring payment by card; ordering in person is never affected. The organization sets these limits and the amount it keeps from a card payment, which checkout shows before you order. The records stay within that organization.
How information is used
Information is used to sign people in and confirm email addresses; to deliver codes, invitations, receipts, order alerts and notices to people responsible for tablets; to calculate, take payment for and fulfill orders; to apply each organization’s permissions and its limits on orders that aren’t picked up; to investigate problems; and to keep security and audit records. The service doesn’t do advertising, build advertising profiles or sell personal information.
Who can access information
Organization information is available to its authorized users according to their current role and stand access. Authorized internal administrators can access organization administration records, and their access is audited. Service providers process what they need: Cloudflare delivers email (receiving the recipient’s address and the message) and checks that requests for codes come from a person (receiving network and browser information); Stripe or Square processes payments; browser push services deliver order alerts you turn on; and hosting providers run the service. Other disclosures may be necessary to comply with applicable legal obligations or protect the service and its users.
Security
The service uses passkeys, server-side access controls, encrypted email addresses on orders, hashes for codes and device credentials, and audit records. Sensitive actions on a shared tablet need the person’s own passkey. No system can guarantee absolute security. Keep your devices and private order links private and report suspected misuse. The service never receives raw payment-card information.
Retention and deletion
Emailed codes expire after ten minutes and are deleted a day later. A guest’s email address and the related card hash are deleted 30 days after the order is finished (collected, cancelled, refunded, failed or not picked up); push and email alert destinations, and copies of the messages, go 30 days after the order. Records of orders that weren’t picked up, with their hashed keys, are deleted 90 days after the order. A shared tablet stops working after 90 days without use; its pairing requests and passkey checks are deleted a day after they expire. Orders and audit records are otherwise retained, and organization deletion requests place records on hold rather than erasing them at once. Contact the operator to request review of information, correction, access removal or deletion; the operator must assess applicable obligations and retained records.
Choices and requests
You may ask the operator or your organization administrator about information held about you and request correction, access changes or deletion review. Identity verification may be required before a request is fulfilled. Order alerts are optional. Removing an organization membership does not delete a shared identity or memberships in other organizations. Rights and response obligations may vary under applicable law.
Changes and deployment details
This version replaces the notice of 2026-09-14, which named a different email provider and described passwords and authenticator apps the service no longer uses. A new notice receives a new version identifier, and registration records retain the accepted version. Before a public launch, the operator must review actual hosting locations, service-provider arrangements, retention practices and applicable privacy obligations. This notice does not assert a particular hosting country, international-transfer arrangement or legal compliance certification.