Privacy notice

WalletPassAPI is run by [Company name], a company registered in [country of registration] with company number [company number], whose registered office is at [registered address]. In this notice, "we", "us" and "our" mean [Company name].

We're registered with the UK Information Commissioner's Office under number [ICO registration number]. [EU representative under Article 27 GDPR, if one is required]

This notice covers WalletPassAPI's website, dashboard and API. It doesn't cover other companies' websites we link to, or the businesses that issue passes with us: they have their own.

For anything about your personal data, email wesley@xumagazine.com.

Data protection law treats us differently depending on whose data it is.

• We're the controller for our own customers and visitors

  We decide how and why we use the data of the people who use our dashboard and API (our customers' staff), visitors to this website, people who try the live demo, and people who ask us for access. For that data, this notice is the one that applies.

• We're a processor for pass holders

  When a business uses WalletPassAPI to issue passes, it decides what goes on them and who gets them. That business is the controller of its pass holders' data; we process it only on its instructions, to make, deliver and update its passes.

People who use the dashboard or API

• Your email address

  It's how you sign in: there are no passwords. We email you a one-time code, which we store only in a scrambled (hashed) form and which stops working after 10 minutes. We don't ask for your name.

• Your sign-in sessions

  When you sign in we set a session cookie. We keep a hashed copy of its token, the browser's user agent (the text a browser sends to describe itself), the country you signed in from (as Cloudflare sees it, not your address), whether you connected over IPv4 or IPv6 (not the address itself), the workspace you're working in, and when the session started and ends. They go when the session ends. Our own support staff can see your open sessions' device and country, to help keep your account safe.

• Your organizations and workspaces

  Their names, who's a member and in which role, invitations (including the invitee's email address), and handovers between organizations.

• An activity log

  When someone changes access, credentials or the team, or does something that reaches pass holders, we record who did it (their email address), what they did, when, a request ID and whether they connected over IPv4 or IPv6. It never holds secrets or IP addresses.

• What you set up

  API keys (stored only as a hash), Apple and Google credentials you upload (encrypted), webhook endpoints, templates, images, install-page branding, custom domains and usage counts.

• Emails we send you

  Sign-in and email-change codes, invitations, notices about workspace handovers, certificate expiry warnings and usage warnings at 80% and 100% of a limit. We don't send marketing email.

• Billing details

  Paid plans aren't available yet, so we hold none. When they are, we'll update this notice before collecting any.

To stop anyone flooding an inbox or guessing codes, we count sign-in code requests per email address (those counts are deleted after 2 days), and Cloudflare briefly counts requests per IP address for us at the edge. We don't store those IP addresses.

Website visitors

We don't use analytics, advertising or tracking cookies, and the site loads no third-party analytics or advertising scripts. Like any website, your browser's requests pass through Cloudflare, which sees your IP address and browser details to deliver pages and protect the service from attacks (see Who we share it with).

Our own request logs record which kind of page or API route was asked for, the response and how long it took, with a request ID. They never record headers, bodies or IP addresses, and the parts of web addresses that can carry secrets are removed or not logged.

People who try the live demo

• You don't type anything: you choose a kind of pass and a colour. Every word on a demo pass is fixed, and it says "Demo member".
• Before a pass is made, Cloudflare Turnstile checks that you're a person. It runs in your browser and is provided by Cloudflare, under Cloudflare's Turnstile privacy notice.
• To limit each visitor to a few demo passes an hour, we use a one-way hash of your IP address mixed with a secret that changes every day. We never store or log the address itself, and the hashed counts are deleted within 2 days.
• If you add the pass to your phone, the same device details as for any pass are involved (see pass holders below). The pass expires after 24 hours, is withdrawn then, and is erased with everything about it 24 hours later.
• We count demos only as daily totals (demos started, passes added, changes sent), never per person.

People who ask us for access

While WalletPassAPI is invite-only, you can ask us for access. The form asks for your name, email address, company, website and what you'd like to use passes for. It's protected by Cloudflare Turnstile, and what you send is emailed to us so we can reply.

People who email us

If you email us, we keep your message, your email address and our reply so we can deal with it and refer back to it.

Pass holders (on behalf of the businesses that issue passes)

• What's on the pass

  Whatever the issuing business puts on it, such as a name, a member or ticket number, points, a barcode, and sometimes an email address. The business decides this.

• Apple Wallet

  When a pass is added to an iPhone or Apple Watch, the device registers with us: we store a device library identifier and a push token that Apple Wallet generates, so we can tell the device when the pass changes. The push token is stored encrypted. We don't learn who you are from these.

• Google Wallet

  The pass's content is sent to Google so it can appear in Google Wallet, and Google tells us when the pass is saved or removed. We keep that saved or removed state.

• The install page

  Each pass has a page at a long, unguessable link where it can be added to a wallet. It sets no cookies, and we don't log visits to it unless something goes wrong.

Our customers agree not to put sensitive information on passes, such as health data, full payment card numbers or government identity numbers.

All the data we keep, including account details, passes, pass holder data, images and uploaded files, is stored in the EU. Our database and file storage were created with Cloudflare's EU jurisdiction setting, which guarantees they stay in the EU.

We use these providers to run the service. Each handles only what it needs for its job.

• Cloudflare, Inc.

  Hosting, running our code, database and file storage (stored in the EU), protection against attacks, Turnstile checks on the demo and access form, custom domains for install pages, and, before launch, controlling who can open the dashboard.

• Postmark (ActiveCampaign, LLC)

  Sending our emails: sign-in codes, invitations and service notices. It receives the recipient's address and the message.

• Apple Inc.

  Delivering Apple Wallet pass updates through the Apple Push Notification service. Apple receives a device's push token and the pass type, not the pass's content; the device then fetches the updated pass from us.

• Google LLC

  Showing passes in Google Wallet. Google receives the pass's content and tells us when it's saved or removed.

When a business uses its own Apple or Google developer account to issue passes, Apple and Google also act under that business's own agreements with them. Businesses can also send pass events to their own systems through webhooks they set up; where those go is their choice.

We'll update this list before adding a provider that handles personal data. [Link to a sub-processor list with notice of changes, if offered to customers]

Anyone else

Beyond those providers, we share personal data only:

• when the law requires it, such as a court order or a lawful request from an authority, and only what it requires;
• to protect people, our customers or the service from harm, fraud or abuse;
• if WalletPassAPI or the company that runs it is sold or merged, with the new owner, who must keep to this notice. We'll tell you before your data moves.

Cloudflare, Postmark, Apple and Google are based in the United States and may process data there and elsewhere. Where personal data leaves the UK or the EU, it's protected by the safeguards the law provides, which for each provider are:

You can check a company's certification on the Data Privacy Framework list at dataprivacyframework.gov. You can ask us for a copy of the safeguards at wesley@xumagazine.com.

We delete data when we no longer need it. Most of this happens automatically, every day.

When a pass is erased, we keep only a small stub (its identifier and that it was erased), so the same identifier can't be reused by mistake. Everything on it, its holder's details and its device registrations go.

We use only what's needed for the service to work. There are no analytics, advertising or tracking cookies, so we don't ask you to accept any.

• wpp_session

  Keeps you signed in to the dashboard. Set when you sign in, lasts 30 days or until you sign out. Not readable by scripts on the page.

• wpp_last

  Remembers which workspace you last used, so switching organization brings you back to it. Lasts a year. Not readable by scripts on the page.

• Cloudflare cookies

  Before launch, Cloudflare Access sets a cookie on the dashboard to check you're allowed in. Cloudflare may also set security cookies, for example during a Turnstile check, to tell people from automated traffic.

• Local storage

  Your browser remembers a few preferences on your own device, such as the programming language you picked in the docs and help notes you've dismissed in the pass editor. They're never sent to us.

The only third-party script we load is Cloudflare Turnstile, on pages with the live demo or the access form. Pass install pages set no cookies.

• Encrypted, everywhere

  Everything travels over encrypted connections, and stored data is encrypted at rest.

• Credentials kept apart

  Apple and Google credentials are encrypted, kept in a separate part of the system, and used only to sign the business's own passes. They're never shown again or exported.

• Secrets stored as hashes

  Sign-in codes, session tokens and API keys are stored only as hashes.

• Every business kept separate

  Each query is limited to the workspace it belongs to.

• Logs that leave things out

  Our logs leave out IP addresses, headers, request bodies and secrets.

Under UK and EU data protection law you can ask us to:

• See it

  Give you a copy of your personal data (access).

• Correct it

  Put it right if it's wrong (rectification).

• Delete it

  Erase it (erasure).

• Limit it

  Limit how we use it, for example while we check a correction (restriction).

• Object

  Stop using it where we rely on legitimate interests (objection).

• Take it with you

  Give it to you, or someone else, in a machine-readable form (portability).

Email wesley@xumagazine.com. We'll reply within one month, and may ask you to confirm who you are first. These rights have some limits, and we'll explain if one applies. If your question is about a pass a business issued to you, please contact that business. We'll help it answer you.

WalletPassAPI is a service for businesses and isn't directed at children. We don't knowingly collect children's data for our own purposes. Businesses that issue passes to children are responsible for doing so lawfully.

We'll update this notice when what we do changes, and change the date at the top. If a change matters, we'll tell customers by email or in the dashboard before it takes effect.