NFTD, Inc. (“Receipts,” “we,” “our,” or “us”) understands that privacy is important to our users. This Privacy Policy describes how we collect, use, share, and protect your personal information in connection with the Receipts website at receipts.xyz (the “Website”), our mobile applications, and all related services, products, and offerings (collectively, the “Services”). It also explains the rights and choices you have regarding your personal information and how to contact us.
By using or accessing the Services, you agree to this Privacy Policy. If you do not agree with our policies or practices, you should not use or access the Services or provide us with any personal information.
For information about how users with disabilities can access this Privacy Policy in an alternative format, please contact us at hello@receipts.xyz.
Who We Partner With
Throughout this policy we refer to two distinct types of partners, because your information is treated differently for each:
- Venues — the gyms, studios, clubs, and other fitness locations that host our tap-to-verify pucks.
- Brands — companies that offer rewards, discounts, and activations through Receipts. When you redeem or activate a brand offer, that brand receives certain personal information needed to fulfill the offer, as described in “How We Disclose or Share Your Information.”
Personal Information We Collect
We use “personal information” to mean information that reasonably identifies, relates to, describes, or can be associated with you. De-identified or aggregated data that cannot reasonably be linked back to you is not personal information. The precise definition may vary by jurisdiction, but we take the same general approach to protecting your privacy everywhere, subject to any additional measures required by applicable law.
We collect the following categories:
- Identifiers, such as your name, email address, and mailing address you input for physical goods.
- Device and online identifiers, including internet protocol (IP) address, mobile advertising identifiers, and data collected from cookies and similar technologies.
- Health and fitness data from your connected wearable device (see below).
- Check-in and location data generated when you tap a puck (see below).
- Demographic data, such as date of birth, sex, etc.
Health and Fitness Data
With your permission, we collect physical activity information from your connected wearable device. Depending on your device, this may include activity type, duration, and intensity; energy output; running and cycling distance; heart rate; sleep data; exercise minutes; step count; and similar metrics.
We support direct integrations with Apple Watch, WHOOP, Garmin, Oura, and Coros. Other wearables may connect through Apple Health. We collect this information while your device is connected, and we stop when you disconnect the device or delete your account.
Check-in and Location Data
When you tap a puck at a venue, store, or park, we record that check-in, including the location of the puck, the time of the check-in, and your punch-card progress. We collect location only at the moment you tap a puck. We do not collect continuous or background location data, and we do not track your movements between check-ins. We may also derive approximate location from your IP address for security and service purposes.
Sensitive Personal Information
Some of the information we collect is treated as “sensitive personal information” under certain state laws, including your health and fitness data and the precise geolocation captured at check-in. We use and disclose this information only to provide and improve the Services, to power the reward and activation features you choose to use, and for other purposes permitted by law. Where required, you may limit our use of your sensitive personal information as described in “Your Choices.”
How We Collect Your Personal Information
Information you provide. We collect information you give us directly, such as when you register or create a profile; connect a wearable; contact us; respond to a survey; enter a contest or promotion; carry out a transaction; or otherwise provide information through the Services.
Information we collect automatically. When you use the Services, we collect certain information using cookies and similar technologies. Cookies are small pieces of information placed on your device that help us recognize you, understand how you use the Services, and improve them.
From our partners. We may receive information about you from venues and brands in connection with your use of the Services, which we associate with your account.
How We Use Your Personal Information
We use the categories of personal information described above for the following purposes:
- To operate and provide the Services, including creating and managing your account; recording check-ins and punch-card progress; delivering rewards, discount codes, and brand activations; enabling you to transact with venues and brands; and administering contests and promotions.
- To communicate with you, including responding to your inquiries and providing customer support, and sending you emails and updates you have chosen to receive.
- For analytics and personalization, including understanding how you use the Services, identifying trends, improving our products and marketing, and personalizing your experience and the offers we show you.
- For security and fraud prevention, including maintaining the safety and integrity of the Services; detecting and preventing malicious, deceptive, or illegal activity; and investigating suspected violations of our policies or the law.
- To comply with legal obligations, including responding to lawful requests, exercising or defending legal claims, and acting in connection with a merger, acquisition, or similar transaction.
If you specifically consent to additional uses of your personal information, we may use it consistent with that consent.
How We Disclose or Share Your Information
Venues. Venues that host our pucks may be able to see check-in activity and aggregated wearable activity for their visitors.
Brands. When you redeem or activate a brand offer through Receipts — for example, by tapping to fill a punch card that unlocks a brand reward — we provide that brand with the information needed to recognize and fulfill the activation. This may include your name, email address, aggregated activity data, and check-in data. We provide this information as part of a specific, opted-into activation; we do not sell or provide bulk data feeds to data brokers, advertising exchanges, or information resellers.
Under the California Consumer Privacy Act and similar laws, our disclosure of personal information to brands in exchange for payment may be considered a “sale,” and our disclosure of information for the brand’s own advertising may be considered a “share.” You can opt out of the sale or sharing of your personal information at any time — see “Your Choices” below.
Service providers. We share information with third-party service providers that perform functions on our behalf, such as hosting, data analysis, infrastructure, customer service, email delivery, and payment processing. They may access personal information only as needed to perform services for us and are not permitted to use it for their own purposes.
Legal compliance and protection of rights. We may disclose information where we believe it is necessary or appropriate to comply with applicable law or legal process; respond to lawful requests from public and government authorities; enforce our Terms of Service; protect our operations, rights, privacy, safety, or property, or those of our users or others; or pursue available remedies.
Business transfers. We may disclose information in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of some or all of our assets, in which case information about our users may be among the transferred assets.
De-identified and aggregated data. We may share de-identified or aggregated information — which cannot reasonably be linked back to you — with venues, brands, and others.
Links to Other Sites and Social Media
The Services may contain links to, or integrations with, third-party websites and services, including those of our venues and brands. We are not responsible for the privacy practices of those third parties, and this Privacy Policy applies only to your use of our Services. We encourage you to review the privacy policies of any third-party sites or services you use.
Any information you voluntarily post in a publicly accessible area may be viewed and used by others. By using such features, you assume the risk that your information may be viewed and used by third parties.
How We Protect Your Personal Information
We maintain personal information on our servers or those of our service providers, accessible by authorized personnel as necessary for the purposes described in this policy. We use reasonable and appropriate physical, technical, and organizational safeguards designed to protect the confidentiality, integrity, and availability of personal information. However, no method of safeguarding information is completely secure, and we cannot guarantee absolute security. If you believe your interaction with us is no longer secure, please contact us immediately at hello@receipts.xyz.
Data Retention
We retain your personal information for as long as your account is active or as needed to provide you with the Services, and for a reasonable period thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements. We stop collecting information from your connected wearable when you disconnect the device or delete your account. Even after deletion, we may retain de-identified or aggregated information.
Your Choices
Marketing emails. You may unsubscribe from marketing emails using the unsubscribe link in any such message or by emailing hello@receipts.xyz.
Opt out of the sale or sharing of personal information. You have the right to opt out of the sale or sharing of your personal information. You can do this through the “Your Privacy Choices” link on our Website or by emailing hello@receipts.xyz. We also honor Global Privacy Control (GPC) signals as a valid opt-out of sale or sharing. We do not respond to other “Do Not Track” signals.
Limit the use of sensitive personal information. Where applicable law provides this right, you may request that we limit our use and disclosure of your sensitive personal information to what is necessary to provide the Services.
Disconnect your wearable. You can disconnect your wearable device at any time in the app, which stops our collection of your health and fitness data going forward.
Cookies. You can adjust your browser settings to restrict or delete cookies. Some features of the Services may not function properly if you do. Note that cookie-based opt-outs must be set on each browser and device you use.
Financial Incentives
We offer rewards, discounts, discount codes, store credit, experiences, and brand activations in connection with connecting your wearable, logging verified workouts, and completing check-ins and punch cards. These programs may be considered a “financial incentive” under certain laws. Participation is voluntary, you may withdraw at any time, and the value of these incentives is reasonably related to the value of the information you provide in connection with them.
California Privacy Rights
The California Consumer Privacy Act, as amended by the California Privacy Rights Act, and other applicable U.S. state privacy laws (“Applicable Privacy Laws”) provide certain rights regarding your personal information. This section describes those rights and how to exercise them.
Right to know. You may request that we disclose the categories and specific pieces of personal information we have collected about you; the categories of sources; our purposes for collecting, selling, or sharing it; and the categories of third parties with whom we disclose it.
Right to delete. You may request that we delete personal information we collected from you, subject to certain exceptions.
Right to correct. You may request that we correct inaccurate personal information we maintain about you.
Right to data portability. You may request a copy of the personal information we have collected about you in a readily usable format.
Right to opt out of the sale or sharing of personal information. You have the right to opt out of the sale or sharing of your personal information, as described in “Your Choices.” We do not sell or share the personal information of consumers we know to be under 16 without affirmative opt-in consent, and we do not share any personal information of users under 18 with brands.
Right to limit the use of sensitive personal information. You may direct us to limit our use and disclosure of your sensitive personal information as described above.
Right to non-discrimination. We will not discriminate against you for exercising any of your rights, including by denying you goods or services, charging different prices, or providing a different level or quality of service (except where a difference is reasonably related to a financial incentive you have chosen).
Exercising your rights. To exercise these rights, email us at hello@receipts.xyz. We will take steps to verify your identity before responding, which may require you to provide information such as your name, email, phone number, and address so we can match it against our records. Only you, or an agent legally authorized to act on your behalf, may make a request; authorized agents must provide proof of authorization. We will respond within the time required by law, generally within 45 days, and will let you know if we need additional time.
California “Shine the Light.” California residents may request information about categories of personal information we have disclosed to third parties for their direct marketing purposes. To make such a request, email hello@receipts.xyz.
Other U.S. State Privacy Rights
Depending on your state of residence, you may have additional rights, including the right to access, correct, delete, or obtain a copy of your personal information, and to opt out of targeted advertising, the sale of personal information, and certain profiling. Where applicable, we honor recognized universal opt-out signals such as Global Privacy Control. To exercise these rights, email hello@receipts.xyz.
Nevada Privacy Rights
If you are a Nevada resident, you have the right to opt out of the sale of certain personal information that we have collected or may collect from you. To exercise this right, email us at hello@receipts.xyz with the subject line “Nevada Do Not Sell Request.”
Cross-Border Data Transfers
If you submit personal information to us, it may be processed in the United States or other jurisdictions where privacy laws may differ from those in your country of residence. By using the Services, you consent to the transfer, storage, and processing of your information in the United States and other jurisdictions. Personal information transferred to the United States may be subject to access by law enforcement.
Children’s Privacy
The Services are intended for users age 13 and older. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take reasonable steps to delete it. If you believe we may have information from a child under 13, please contact us at hello@receipts.xyz.
We do not share the personal information of users under 18 with brands, and we do not sell or share the personal information of users we know to be under 16 without affirmative opt-in consent.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting an updated policy or other notice on the Website. Changes are effective when posted unless otherwise stated. We will not use your personal information in a materially different manner than described at the time of collection without your consent. Your continued use of the Services after an update constitutes your acceptance of the revised policy.
Contacting Us
If you have questions about our privacy or security practices, please contact us at hello@receipts.xyz.