This Privacy Policy describes how DailyAdventureBox Inc. ("DAB," "we," "us," or "our") collects, uses, protects, and shares personal data when you access our mobile app, website (www.dailyadventurebox.com), Fund Adventure Portal, Contractor Portal, self-service lockers, or any related services (collectively, the "Services").
This policy is designed to comply with all applicable U.S. federal and state privacy laws, including the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and all other current and future state data privacy laws. This policy also meets Apple App Store and Google Play Store requirements for data transparency, user consent, and third-party sharing disclosures.
We collect precise geolocation data only with your explicit permission to locate nearby DAB lockers and provide location-based services. You may revoke permission at any time through your device settings.
Payment processing is handled exclusively by Stripe, Inc., a PCI DSS Level 1 compliant processor. We do not store full credit card numbers, CVV codes, or bank account details. We receive payment metadata (last 4 digits, card type, expiration) and transaction records from Stripe.
We share limited data with the following service providers under strict confidentiality agreements and data processing addenda:
| Provider | Purpose | Data Shared |
|---|---|---|
| Stripe, Inc. | Payment processing | Name, email, payment method, transaction amounts |
| Supabase, Inc. | Database, authentication, data storage | Account data, rental/ownership records, transactions |
| Google LLC / Firebase | Analytics, social login, push notifications | Device info, usage metrics, auth tokens |
| Apple Inc. / Meta Platforms | Social login (optional) | Auth tokens, name, email (as authorized by you) |
| GitHub, Inc. | Fund Adventure Portal hosting (static) | No personal data stored |
We may also disclose personal data if required by law, court order, subpoena, or government investigation, or to protect the rights, property, or safety of DAB, our users, or the public.
DAB complies with all applicable state privacy laws nationwide, including those of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Delaware, New Jersey, New Hampshire, Nebraska, Kentucky, Maryland, Minnesota, and any state enacting privacy legislation hereafter. Rights generally include:
Contact support@dailyadventurebox.com to exercise any right. We respond within forty-five (45) days.
Our app may request access to camera, location, storage, notifications, and Bluetooth. These are used solely for locker access, rental tracking, and user experience. You may modify permissions in device settings at any time. Denying permissions may limit certain features but will not prevent use of core rental services.
We do not use advertising trackers or sell data to advertisers. Our Services do not currently respond to Do Not Track (DNT) browser signals, as no uniform standard exists.
We implement industry-standard measures including: TLS/SSL encryption in transit and at rest; secure API communications; row-level security (RLS) in Supabase; regular security monitoring and auditing; PCI DSS compliance via Stripe. No system is fully immune to threats, but we continuously monitor and test our infrastructure.
In the event of a data breach affecting your personal information, DAB will: (a) notify affected users via email within seventy-two (72) hours of confirming the breach, or as otherwise required by applicable state or federal law; (b) notify applicable state authorities as required; and (c) provide information about the breach scope, data affected, and steps taken to mitigate harm.
Our Services are not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn of such collection, we will delete it promptly. Parents/guardians may contact support@dailyadventurebox.com to request removal.
Our Services are operated from and intended for use within the United States. Data will be transferred to and processed in the United States. By using our Services from outside the U.S., you consent to this transfer.
Verified data requests will be responded to within forty-five (45) days. If additional time is needed (up to 45 additional days), we will notify you of the extension and reason.
We may update this policy by revising the "Last Updated" date. Material changes require advance notice via app alert, email, or prominent website notice. Continued use after notice constitutes acceptance.