1. The short version
GridMagik helps operators run attractions — bookings, payments, waivers, CRM. To do that we store data you and your guests give us. We do not sell it. We do not use it to train external AI models. You can export or delete it at any time.
2. Data we collect
- Account data — operator name, email, role, workspace preferences.
- Guest data — name, email, phone, booking history, preferences, and any waivers signed through GridMagik. Provided by your guests during booking.
- Payment data — payment amounts, card type, and last-4 digits. Full card numbers never touch our systems; they are tokenized by our payment processor (SpeedPay, Stripe, Adyen, etc.) under PCI DSS Level 1.
- Usage data — pages visited, features used, and errors encountered. Used to improve the product, never sold or shared.
3. How we use it
- To operate the GridMagik service (scheduling, payments, messaging, reporting).
- To send transactional communications (confirmations, waivers, password resets). We do not send marketing email from your guest list on your behalf unless you explicitly configure a campaign.
- To secure the service (fraud detection, abuse prevention, incident response).
- To comply with legal obligations (tax, subpoena, accessibility standards).
4. Sharing
We share data only with sub-processors needed to run the service (payment processors, email/SMS providers, cloud infrastructure, error monitoring). A current list is available on request. We do not sell personal data. We do not share it with advertisers or data brokers. Ever.
5. Your rights
- Access — you can export your full workspace data as CSV or via API.
- Correction — your guests can request corrections to their profile; you, as the operator, can also edit on their behalf.
- Deletion — you can delete a guest profile in one click; a 30-day recovery window applies to undo accidental deletion. Legal holds (e.g., waiver retention for liability) may extend retention where required by law.
- Portability — full export, in open formats (CSV, JSON).
- Objection — GDPR, CCPA, and CPRA opt-outs honored. Honored globally, not just in the jurisdictions that require it.
6. Data residency
US workspaces are stored on US infrastructure. EMEA workspaces are stored on EU infrastructure (Frankfurt). Cross-region replication is only used for disaster recovery and respects the source region.
7. Retention
Workspace data is retained for as long as the account is active. After account cancellation, data is retained for 30 days (to allow recovery), then permanently deleted. Waiver records have statutory retention (typically 7 years) and are retained accordingly.
8. Security
All traffic is TLS 1.2+ in transit and AES-256 at rest. Our payments flow is PCI DSS Level 1. SOC 2 Type II audit is in progress. See our security page for the full posture.
9. Children
Minor waivers are signed by a guardian; we do not collect data directly from minors under 13. If a parent or guardian believes a minor has provided data directly, contact us and we will delete it.
10. Changes
We update this policy when we change how we handle data. Material changes are announced in-product with 30 days’ notice. Non-material changes (clarifications, typo fixes) may be made without notice; the “last updated” date always reflects the most recent revision.
11. Contact
Questions, requests, or complaints: use our contact form. For formal data subject requests, subject your message with “DSR” and we will respond within 30 days (or whatever applicable law requires, whichever is shorter).