Privacy Notice

BlackCards acts as a controller for website, account, billing, security, and sales-contact data. For loyalty-member data submitted by a business customer, BlackCards generally acts as that customer’s processor or service provider under the applicable data-processing terms.

Depending on the interaction, we process:

• Account identity, organization, role, locale, authentication, and session data.
• Plan, subscription, invoice, payment status, and provider references; full card details remain with the payment processor.
• Loyalty member, pass, balance, visit, redemption, consent, and campaign data supplied by a customer.
• Support, audit, security, and operational event data.
• Demo-request name, work email, company, optional website, requirements, locale, and contact consent.
• Consent-gated first-party page-view and conversion events linked only to an opaque visitor digest.
• With a separate ads-measurement choice, OpenAI / ChatGPT advertising attribution and conversion data, including eligible page visits and confirmed paid subscriptions.

We use data to provide and secure the service, authenticate users, enforce tenant and plan boundaries, process billing, issue and update passes, provide support, respond to requested sales contact, meet legal obligations, prevent abuse, and—only with consent—understand public-site conversion.

A separate optional checkbox permits Microsoft Clarity session replay on eligible public pages only. It records page layout, clicks, scrolling and technical browser information, not a video of your device. Text and fields are masked; checkout, account, enrollment and demo-form pages are excluded. Existing analytics consent alone does not enable replay. Microsoft processes these recordings; access requires an authorized Clarity account and its retention limits apply. Withdraw via Cookie settings to stop future collection; contact us about deletion of previously collected data.

Essential cookies support security, sessions, locale, and consent preferences. Optional analytics and advertising measurement are disabled by default. You may choose essential cookies only, analytics only, or analytics and ads measurement. A previous analytics choice does not permit ads measurement. If analytics is allowed, BlackCards records a small allowlist of first-party events and does not store raw IP addresses or user agents in its marketing event store.

If you separately allow ads measurement, OpenAI / ChatGPT's measurement pixel may receive eligible page-view and confirmed paid-subscription events, technical browser information, and advertising-attribution cookies (__oppref and __obref). Its automatic advanced matching may use hashed information that you provide on eligible pages, such as contact information, to match conversions to ads. Hashing is not anonymization. BlackCards does not send passwords, payment-card details, loyalty balances, or member records as conversion-event fields. Events request an opt-out from future user-level personalization; this does not disable conversion measurement or matching.

You can withdraw consent using Cookie settings in the public-site footer. Withdrawal stops future optional collection in the current page and removes accessible advertising-attribution cookies, but does not erase data already sent. Optional measurement is not required to use BlackCards or complete a subscription.

Data is shared only as needed with contracted infrastructure, database, authentication, payment, communications, and wallet-service providers; professional advisers; a successor in a lawful transaction; or authorities where legally required. We do not sell personal information.

We retain data only for the service, contract, fraud-prevention, audit, tax, dispute, and legal periods that apply, then delete or de-identify it. Controls include encryption in transit, access restrictions, tenant isolation, audit logging, credential separation, and least-privilege administration. No system can promise absolute security.

Where data crosses borders, the responsible party must use an appropriate legal transfer mechanism. Depending on location, individuals may request access, correction, deletion, restriction, portability, objection, or withdrawal of consent, and may complain to a regulator. Some rights are subject to lawful exceptions.

BlackCards is a business service and is not directed to children. Material notice changes will show a revised date. Privacy requests may be submitted through the contact form; identity verification may be required.