Privacy Policy

The Services are operated by PastPort, Inc., a Delaware corporation with principal offices at 39 Karen Road, Waban, MA 02468, USA. If you have any questions about this Privacy Policy or your information, contact us at support@pastport.live.

We collect the following categories of information:

• Phone number. We use phone-number sign-in to create and secure your account. We collect your mobile phone number and the verification status of that number.
• Account and profile information. You may optionally add details to your account profile, such as your name, email address, and mailing address. We collect this information when you provide it and associate it with your account. You can edit or remove these details at any time from your profile settings.
• Purchase information. When you buy an experience or add-on through our website, we record the items purchased, the amount, the date, and the resulting access authorizations. Payment card details are collected and processed directly by our payment processors (Stripe for web purchases, and Apple for in-app purchases). We do not store your full card number.
  
  For App Store purchases and offer-code redemptions, Apple provides signed transaction records, product and transaction identifiers, amounts and currencies, and an app-specific identifier associated with your Apple Account. We use these records to verify purchases, associate access with your PastPort account, prevent duplicate claims, and process revocations. We do not receive your Apple Account password or full payment-card number.
• Redemption and referral codes. If you create, share, or redeem a referral or add-on share code, we record the code, its status, and the associated redemption or attribution events.
• Location information. The PastPort AR mobile app uses your device’s precise location to detect when you enter the geographic area of an experience and to trigger augmented reality content on location. You can control location access through your device settings, though the AR features will not work without it. Depending on your settings and use of the Services, we may receive limited location-related information, such as whether an experience location was activated or completed, but we do not collect continuous location history unless we specifically notify you and obtain any required permission.
• Camera and AR sensor data. The app may use your device camera and motion sensors to display AR content. Unless we specifically ask for permission and notify you otherwise, we do not record, store, or upload camera images, video, or AR sensor data. A screenshot you choose to attach to feedback is the one exception; see "Customer feedback information" below. We do not collect or generate facial geometry, faceprints, voiceprints, or other biometric identifiers, and we do not perform facial recognition, unless we clearly disclose and obtain any consent required at the time.
• Recorded voice data. If you grant the app access to your microphone and subsequently provide voice input to one of our experiences that is able to process that input, the app will use your microphone to capture and record your voice and then transmit the recording to our or a third party server which will then interpret your spoken words and use that information to provide a response. We or our service providers may retain that recording of your voice after such a response has been provided in order to improve the quality of our voice interpretation. However, neither we nor our service providers will associate such a retained voice recording with your account.
• Device and usage data. We and our service providers automatically collect technical and activity data such as device type, operating system, app version, IP address, device and app identifiers, your PastPort account identifier, general diagnostic and log data, crash data, and your interactions with the Services, including registrations, purchases, referral activity, and experience activations.
• Cookies and similar technologies. Our website and service providers may use cookies, local storage, pixels, or similar technologies to operate the website, support checkout, prevent fraud, analyze usage, and improve the Services. You can control cookies through your browser settings, but some features may not work properly without them.
• Customer-support information. If you contact us, we collect the information you provide so that we can respond to and resolve your request.
• Customer feedback information. If you provide us with feedback or suggestions on improving our products, we collect the information you provide so that we may utilize that information to improve our products. If you choose to attach a screenshot to your feedback, we receive and store that image with your feedback.
• Notification information. If you enable notifications, we may collect device tokens or similar information needed to send transactional or service-related notifications.

We may use or share the information we collect to:

• create and authenticate your account and keep it secure;
• process your purchases and grant access to the experiences and content you buy;
• deliver AR experiences at the correct locations;
• personalize the AR experiences you receive;
• provide customer support and respond to your requests;
• operate, maintain, analyze, and improve the Services, and understand how people use them;
• notify you of additional PastPort experiences you may be interested in (including by email and, where you have separately opted in, by text message) or ask for your feedback on PastPort experiences you have had;
• personalize the communications and offers we send you, and measure which of our marketing campaigns lead to app installs and purchases;
• detect, prevent, and address fraud, abuse, and security issues or enable service providers to help us do so; and
• comply with legal obligations and enforce our Terms of Service.

We also use information to send transactional, service-related, security, and account messages; administer referral, redemption, promotional, or add-on sharing features; and maintain accounting, tax, compliance, and business records.

If you provide your mobile phone number, we may send you text messages. We treat account, security, and transaction texts — for example, one-time passcodes to sign in, purchase confirmations, and service notices — as necessary to provide the Services, and you receive them because you have an account. These messages do not contain marketing content.

We send promotional or marketing text messages (for example, news about new experiences, offers, or reminders) only where you have separately opted in to receive them. Providing your phone number to sign in or make a purchase is not, by itself, consent to receive marketing texts. Where you opt in, we keep a record of your consent, including when and how it was given.

You can opt out of marketing texts at any time by replying STOP to any marketing message, or by contacting us at support@pastport.live; reply HELP for assistance. After you opt out we may send a single confirmation and will then stop sending marketing texts to that number, though we may continue to send account, security, and transaction messages. Message frequency varies, and message and data rates may apply.

We retain consent records for as long as necessary to demonstrate compliance with applicable law, typically for the duration of your account plus a reasonable period thereafter.

We do not sell personal information, and we do not currently share personal information for cross-context behavioral advertising. We use attribution services to measure our own campaigns, not to enable advertising partners to target you across other apps or websites. If you allow tracking on iOS, our attribution provider may report installs and purchases attributed to our own advertising to the platform that ran the ad, using the advertising identifier and app-specific event data. We may require that platform to use this information only to provide services to us.

We share information only as needed to run the Services, including with the following categories of service providers who process data on our behalf:

• Firebase (Google) — authentication, database and file storage, hosting, diagnostics, and crash reporting.
• Stripe — payment processing for web purchases.
• Apple — payment processing, receipt validation, and signed purchase and offer-redemption records for purchases made through the App Store (in-app purchases).
• CleverTap — account-linked analytics, engagement messaging, and personalization.
• AppsFlyer — install and campaign attribution and advertising measurement.
• Anti-fraud and customer-support providers — if used, to help us operate, secure, measure, and improve the Services.

Depending on the service and your choices, these providers receive identifiers, technical information, and activity such as registrations, purchases, and experience activations. They process this information on our behalf and under contractual restrictions.

We may also disclose information if required by law, to protect the rights, safety, or property of PastPort or others, with your consent, or in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets. In any such transaction, we will continue to protect your information consistent with this Policy unless we notify you otherwise.

If we experience a security incident affecting your personal information, we will notify you and applicable regulators to the extent required by applicable law.

We retain your information for as long as your account is active or as needed to provide the Services, comply with applicable law or our legal obligations, resolve disputes, and enforce our agreements. When information is no longer needed, we delete or de-identify it.

For example, we retain:

• purchase, refund, referral, and limited anti-fraud records for as long as needed for accounting, tax, dispute resolution, and preventing duplicate redemptions, and for as long as required by applicable law, including after you delete your account; these may include a record linking an app-specific Apple identifier to the PastPort account that claimed an offer;
• account information while your account remains active;
• records of your text-message consent choices, including your phone number, as described in “Text messages (SMS)” above, including after you delete your account; and
• diagnostic logs for a limited period, unless a longer period is needed for security, fraud prevention, troubleshooting, or legal compliance.

You can delete your account at any time from the Account screen in the PastPort AR app or the My Profile page on our website. When you do, we promptly delete your account and profile information and your experience access, and we ask our analytics providers to delete the analytics profile linked to your account. The records listed above are kept for the periods stated.

Deleted information may persist for a limited time in backups before it is permanently removed in the ordinary course. Deleting an account does not transfer its purchases or redeemed offers to another account.

We use administrative, technical, and organizational safeguards designed to protect your information, including access controls on our database and encryption in transit. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Payment information is handled by Stripe or Apple, and we do not store full payment-card numbers.

PastPort is operated from the United States, and our service providers may process information in the United States and other countries. By using the Services, you understand that your information may be transferred to and processed in countries whose data-protection laws may differ from those in your jurisdiction.

If you are located in the EEA, United Kingdom, or Switzerland, we process your information as a controller for the purposes described in this Policy, including to perform our contract with you, comply with legal obligations, protect our legitimate interests, and, where required, with your consent. Where we transfer personal information out of the EEA, United Kingdom, or Switzerland, we rely on appropriate safeguards recognized under applicable law, including the European Commission’s standard contractual clauses and, for UK transfers, the UK International Data Transfer Addendum, in each case where required.

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of your personal information, or to object to or restrict certain processing. You can exercise these rights, or ask us to close your account and delete your data, by contacting support@pastport.live. You can also manage location and notification permissions through your device settings.

On iOS, you can also allow or deny tracking permission through your device settings (Privacy & Security, then Tracking). Apple controls access to the advertising identifier through that permission. Changing these permissions limits what identifiers are available to us and our providers, but does not by itself stop the collection of account-linked usage data described in Section 2 or delete your account or analytics records. You can delete your account from the Account screen in the app or the My Profile page on our website, or by contacting support@pastport.live.

Precise location, and in some cases other information you provide, may be treated as “sensitive personal information” under certain state privacy laws. Because location is central to the app, we use it to deliver the experiences you request and related functions, and not to infer characteristics about you. Where applicable law gives you the right to limit the use of sensitive personal information, you may contact us at support@pastport.live. Limiting this use may prevent AR features from functioning.

Depending on your state, you may also have the right to opt out of the “sale” or “sharing” of personal information for cross-context behavioral advertising. As noted above, we do not sell personal information and do not currently share it for cross-context behavioral advertising. Denying tracking permission on iOS, as described above, also prevents your advertising identifier from being used for attribution reporting to advertising platforms. Where our website supports it, we honor recognized opt-out preference signals, such as Global Privacy Control. You can opt out of marketing text messages as described in “Text messages (SMS)” above.

We may need to verify your identity before fulfilling certain requests. You may also designate an authorized agent where required by applicable law. We will not discriminate against you for exercising privacy rights protected by applicable law.

The Services are intended for a general audience and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If we obtain actual knowledge that a user is under 13 we will take appropriate steps to limit further collection and delete personal information as required by applicable law. Parents or guardians are responsible for supervising a minor’s use of the Services, including any location-based features. If you believe a child under 13 has provided us with personal information, contact us at support@pastport.live.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above, and, for material changes, provide additional notice as appropriate. Your continued use of the Services after an update means the revised Policy applies to your use of the Services going forward.

PastPort, Inc.
39 Karen Road, Waban, MA 02468, USA
support@pastport.live