ParadeWorks LLC, a limited liability company organized under the laws of the Commonwealth of Virginia ("we," "us," or "our"), operates the ParadeWorks web platform at paradeworks.co (the "Service"). This Privacy Policy applies to all information collected through the Service, including our website, APIs, email communications, and any related services.

This policy should be read together with our Terms of Service, which govern your use of the platform, including dispute resolution and governing law.

Account information. When you create an account, we collect your name, email address, and password. If you sign up on behalf of an organization, we also collect the organization name and your role within it.

Profile information. You may optionally provide additional information such as a phone number, mailing address, or profile photo.

Parade and event data. Information you enter while using the Service, including parade routes, unit details, volunteer records, sponsor information, communications, documents, and scheduling data.

Payment information. If you subscribe to a paid plan or process payments through Stripe Connect, Stripe collects and processes your payment details (such as credit card numbers and bank account information) directly. ParadeWorks does not store your full payment card details — see Section 6.

Participant data. When parade participants (volunteers, applicants, sponsors) submit information through forms hosted on the Service, that data is collected on behalf of the parade organizer — see Section 5.

Usage and device data. We automatically collect information about how you interact with the Service, including IP address, browser type, operating system, referring URLs, pages visited, and timestamps. This data is collected through server logs, cookies, and our product analytics provider, PostHog. Analytics cookies and feature-level usage tracking are enabled only if you accept analytics cookies in our consent banner — see Section 7 for details.

Communications. If you contact us via email or our contact form, we retain the content of your messages, your email address, and our responses.

We use the information we collect to:

• Provide, maintain, and improve the Service
• Create and manage your account
• Process subscriptions and payments
• Send transactional emails (account verification, password resets, payment receipts)
• Send service-related communications (feature updates, maintenance notices, security alerts)
• Respond to your support requests and inquiries
• Monitor and analyze usage patterns to improve performance and user experience
• Detect, prevent, and address fraud, abuse, and security issues
• Comply with legal obligations

Legal bases for processing. We process your information under the following legal bases: Contractual necessity — account management, service delivery, and payment processing, which are necessary to perform our contract with you. Legitimate interest — security monitoring, fraud prevention, and service improvement, where our interests do not override your rights. Consent — marketing communications and analytics cookies, which you may withdraw at any time by unsubscribing or updating your cookie preferences. Legal obligation — tax and financial record retention, and compliance with law enforcement requests.

Marketing communications. We will only send you marketing emails (such as product updates and announcements) with your prior opt-in consent. Every marketing email includes an unsubscribe link. You can also manage your preferences through the unsubscribe link in any marketing email or your account settings. We will never sell your email address to third parties for marketing purposes.

We do not sell, rent, or trade your personal information. We share your data only in the following circumstances:

Service providers. We use third-party services to operate the platform. These providers process data on our behalf and are subject to their respective privacy policies and, where applicable, data processing agreements:

• Stripe — payment processing (subscription billing and Stripe Connect transactions)
• Resend — transactional and marketing email delivery
• DigitalOcean — cloud hosting and data storage
• Cloudflare — DNS, CDN, and DDoS protection
• PostHog — product analytics (page views and feature usage; full analytics only with your cookie consent — see Section 7)
• Google Workspace — business email used to receive and respond to support and contact inquiries

Organization members. If you belong to an organization on ParadeWorks, other members of that organization may see your name, email, and role within the organization, as determined by the organization's administrator.

Parade organizers. If you submit information through a public parade form (such as a volunteer application, parade unit application, or sponsor interest form), the parade organizer will have access to the information you provide.

Legal requirements. We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers. If ParadeWorks is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service before your information becomes subject to a different privacy policy.

ParadeWorks as controller. For account holders and website visitors, ParadeWorks is the data controller. We determine the purposes and means of processing your account information, usage data, and communications.

ParadeWorks as processor. When parade organizers collect information from participants (volunteers, applicants, sponsors) through forms on the Service, the organizer is the data controller and ParadeWorks acts as a data processor. We process participant data only as necessary to provide the Service to the organizer.

If you are a parade participant and have questions about how your data is used, you should contact the parade organizer directly. If you need help identifying the organizer or exercising your rights, contact us at [email protected].

If a parade organizer is unresponsive or no longer active on the platform, ParadeWorks will make reasonable efforts to fulfill participant data requests directly within 30 days.

Data Processing Agreement. Organizers who require a formal Data Processing Agreement (DPA) for compliance with GDPR or other data protection regulations may request one by contacting us at [email protected].

All payment processing is handled by Stripe. When you enter payment details (credit card numbers, bank account information), that data is transmitted directly to Stripe and is subject to Stripe's privacy policy.

ParadeWorks does not store your full credit card number or bank account details. We receive and store only limited information from Stripe, such as the last four digits of your card, card brand, expiration date, and billing address, for display and record-keeping purposes.

For organizers using Stripe Connect to collect payments from participants, Stripe processes those transactions under its own Connected Account Agreement.

ParadeWorks uses cookies and similar technologies for the following purposes:

You can change your analytics cookie choice at any time: manage cookie preferences.

We do not use third-party advertising cookies or tracking pixels. We do not participate in ad networks or sell data to advertisers.

We do not track users across third-party websites. Because the Service does not engage in cross-site tracking, we do not respond to Do Not Track (DNT) browser signals.

Cloudflare, which provides our CDN and security services, may set its own cookies for bot detection and performance optimization. These are governed by Cloudflare's Privacy Policy.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using the Service.

Your data is stored on servers located in the United States. We implement reasonable technical and organizational measures to protect your information, including:

• Encryption in transit (TLS/HTTPS for all connections)
• Encrypted database storage volumes
• Encrypted session cookies
• Database access restricted to the application server
• Key-based server authentication
• Firewall rules limiting exposed services
• Automated daily database backups with 14-day retention
• Automated intrusion detection and prevention

International data transfers. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we implement appropriate safeguards for those transfers where required by applicable law, such as the European Commission's Standard Contractual Clauses. For more information about our transfer safeguards, contact us at [email protected].

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If we become aware of a security breach that affects your personal information, we will notify you and any applicable regulators without undue delay, consistent with the timelines required by applicable law.

We retain your information for as long as your account is active or as needed to provide the Service. Specific retention periods:

• Account data — Retained while your account is active. After account termination, we retain your data for 90 days to allow retrieval, then permanently delete it (unless termination was due to illegal activity or abuse).
• Server logs — Retained for up to 14 days and then automatically rotated.
• Database backups — Retained for 14 days and then automatically deleted.
• Support communications — Retained for up to 2 years, or longer if related to an unresolved dispute or legal matter.
• Payment records — Retained as required by applicable tax and financial regulations.

You may request deletion of your data at any time by contacting us (see Section 13). Some data may be retained as required by law or legitimate business interests (such as fraud prevention).

Depending on your location and applicable law, you may have the following rights regarding your personal information:

• Access — Request a copy of the personal information we hold about you
• Correction — Request correction of inaccurate or incomplete information
• Deletion — Request deletion of your personal information
• Data portability — Request your data in a structured, machine-readable format
• Objection — Object to processing of your personal information in certain circumstances
• Withdraw consent — Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may ask you to verify your identity before fulfilling your request.

California residents. Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), you have additional rights regarding your personal information:

• Categories of personal information collected: Identifiers (name, email, IP address), commercial information (subscription and payment records), internet activity (usage data, pages visited), and professional information (organization name, role).
• Sources: Directly from you (account registration, forms), automatically (server logs, cookies), and from third parties (payment processors such as Stripe).
• Business purposes: Providing and improving the Service, processing payments, communicating with you, and ensuring security (see Section 3 for full details).
• Third parties: Service providers (Stripe, Resend, DigitalOcean, Cloudflare) and parade organizers (when you submit data through parade forms). See Section 4 for full details.

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising. You have the right to know, access, correct, delete, and port your personal information, and the right to non-discrimination for exercising your privacy rights. To submit a request, email us at [email protected].

Virginia and other U.S. states. If you reside in Virginia, Colorado, Connecticut, or another state with a comprehensive consumer privacy law, you may have similar rights to access, correct, delete, and obtain a copy of your personal information, and to opt out of targeted advertising, sale of personal data, and certain profiling. ParadeWorks does not sell personal data or use it for targeted advertising. To exercise these rights, contact us at [email protected]. If we decline your request, you may appeal by replying to our response and stating that you wish to appeal; if your appeal is denied, you may contact your state's attorney general.

EEA and UK residents. If you are located in the European Economic Area or the United Kingdom, you have the right to lodge a complaint with your local data protection supervisory authority if you believe your personal data has been processed in violation of applicable law. A list of EEA supervisory authorities is available at edpb.europa.eu. For the UK, you may contact the Information Commissioner's Office (ICO).

Email preferences. You can manage your marketing email preferences at any time through the unsubscribe link in any marketing email or your account settings. Transactional emails (account verification, security alerts, payment receipts) cannot be opted out of while your account is active.

ParadeWorks accounts are for adults. You must be at least 18 years old to create an account, and the Service is not directed to children.

Parade rosters and participant records submitted by organizers may include information about minors (for example, members of youth marching bands, scout troops, or dance teams). ParadeWorks processes that information as a data processor on behalf of the organizer (see Section 5), and the organizer is responsible for obtaining any parental or guardian consents required by applicable law before submitting it.

We do not knowingly collect personal information directly from children under 13. If we learn that a child under 13 has provided personal information directly to us, we will delete it promptly. If you believe this has occurred, please contact us at [email protected].

We may update this Privacy Policy from time to time. For material changes, we will notify you via email or through a prominent notice on the Service at least 30 days before the changes take effect. The "Effective Date" at the top of this policy indicates when it was last revised.

Your continued use of the Service after changes become effective constitutes acceptance of the updated policy. If you do not agree, you must stop using the Service.