Privacy Policy

Effective Date: May 6, 2026  |  Last Updated: August 2, 2026

This Privacy Policy describes how Haunts365 Limited Liability Corporation ("Haunts365," "we," "us," or "our") collects, uses, stores, and discloses information when you use our website, official guest mobile application, and ticketing and guest services.

Our commitment: Haunts365 will never sell your personal information. We do not sell, rent, or trade guest or customer data to data brokers, marketers, or other companies for their own commercial use. We use information only as described in this policy to run our business and serve you.

We know you choose our services with trust. We take that seriously and work to handle personal information responsibly and only as this policy describes.

1. Information We Collect

We may collect the following categories of information:

• Guest account and profile. When you create or use a Haunts365 guest account (on our website or official app), we collect information needed to identify and secure your account, such as email address, name (if you provide it or it is supplied by a sign-in provider), account identifiers, and authentication records.
• Sign-in with third parties. If you choose Google or Sign in with Apple, we receive certain information from that provider as permitted by your settings and their policies (for example, a provider subject identifier and, depending on your choices, name and email). We do not receive your third-party password.
• Email sign-in (no SMS). If you sign in with email, we may send a sign-in link or a one-time code to your email address. We process the fact of the request, delivery, and successful use of that link or code for security and audit purposes.
• Guest account profile. Optional details you provide in Guest Hub, such as phone number, pronouns, haunt intensity preference, accessibility notes, and emergency contact information (used to support your visit).
• Ticket wallet links. Confirmation emails may include a personal link to view your tickets and QR codes. These links are tied to your purchase and should be kept private — anyone with the link may be able to view those tickets until the link expires.
• Photobooth & Guest Hub media. If you use the on-site photobooth or related Guest Hub features, we may store photos and session metadata linked to your ticket or household for delivery, support, and permitted promotional use as described in our Terms.
• Bot protection. Public forms may use Cloudflare Turnstile to reduce spam and abuse. Turnstile may process technical signals (such as browser and device metadata) according to Cloudflare’s privacy policy.
• Contact information (such as name and email address) provided at checkout or in forms.
• Ticket and purchase details (event selections, ticket type, quantity, timeslot, ticket codes, order references).
• Activity tied to your account. Where you are signed in, we associate your use of guest features with your account—for example, viewing tickets, accessing your briefing or wallet-style experiences, order history, preferences, and in-product support interactions. We may also collect product and diagnostic metrics (such as app/flow usage and errors) tied to your account or device in order to operate and improve our services. We never sell this or any personal information.
• Operational and security records (ticket scan outcomes, staff actions, login attempts, and fraud-prevention logs).
• Technical data (such as IP address, browser or app user agent, device type, and request metadata where applicable).
• Video/photo/audio recordings from on-site security and operational cameras in and around the attraction.

2. How We Use Information

We use collected information to operate and improve our services, including to:

• Provide and secure guest accounts and keep website and app experiences consistent with the same Haunts365 policies.
• Authenticate you via Google, Apple, or email link/code and maintain session security.
• Associate your purchases and guest activity with your profile where permitted (for example, matching verified email or explicit linking), so you can view tickets, orders, and related content in one place.
• Process ticket transactions and deliver tickets.
• Manage admissions, fraud checks, and audit/security operations.
• Respond to customer inquiries and support requests.
• Comply with legal obligations, tax, accounting, and recordkeeping requirements.
• Monitor and investigate incidents, injuries, misconduct, theft, and property damage.
• Create and publish marketing/promotional content where permitted by our Terms & Conditions and applicable law.
• Measure and improve reliability and usability of our website and guest app using aggregated or account-associated metrics as described above.

3. Payment Processing

Online ticket purchases are processed by Stripe (or another payment processor we designate). Card details are handled by the processor; we receive limited transaction metadata (such as last four digits, card brand, and payment status) needed to fulfill orders and for accounting.

4. Cookies and Sessions

We use cookies and similar technologies to keep you signed in (staff and guest sessions), remember wallet access after you open a ticket link, and protect forms. Essential cookies are required for checkout, Guest Hub, and staff tools. You can control non-essential cookies through your browser; blocking essential cookies may prevent sign-in or ticket access.

5. Email and Communications

We use our website/email infrastructure (including GoDaddy email services) to send confirmations, service-related communications, and—when you choose email sign-in—messages containing a sign-in link or one-time code. We do not use SMS for account authentication for guest accounts as described in this policy.

6. Data Sharing

We do not sell personal information—ever. We have no business model based on selling guest or customer data. We may share information only as necessary to operate services, comply with law, protect rights/safety, prevent fraud, pursue claims involving theft/property damage, or with trusted service providers acting strictly on our behalf under confidentiality and data-processing obligations.

Authentication providers. When you use Google or Sign in with Apple, those providers process information under their respective privacy policies. We receive only what is needed to maintain your Haunts365 guest account as described in Section 1.

7. Data Retention

We keep information only as long as needed for the purposes described in this policy:

• Tax, accounting, and ticket transaction records (purchases, refunds, comps, payment references): typically 7 years after the transaction or final event season, unless a longer period is required by law or an active dispute.
• Guest Hub profile data (while your account is active): until you ask us to delete it, subject to legal holds and linked ticket records.
• Marketing and unsolicited inquiry forms (e.g. venue rental interest with no booking): typically 2 years, then deleted or anonymized unless you become a customer.
• Photobooth / Guest Hub photos: for the event season and a reasonable period afterward for guest retrieval and permitted promotional use, unless you request earlier deletion where we can honor it without breaking operational or legal obligations.
• Security, fraud, and audit logs: long enough to investigate incidents and protect the business — often several years for serious matters.

When retention periods end, we delete or anonymize data where feasible. Some records (for example, anonymized sales totals) may be kept indefinitely for reporting.

8. Minors

Guests under 18 must be accompanied by an adult and proceed together through the attraction. Where required, a parent/guardian is responsible for submitting information for minors.

9. Your Privacy Rights

Subject to applicable law, you may request access, correction, or deletion of certain personal information by contacting us at legal@haunts365.com. We may need to verify identity and may retain certain records where legally required.

10. Do Not Sell or Share

Haunts365 does not and will not sell personal information—for any purpose, including advertising monetization. We do not share personal information for cross-context behavioral advertising as those terms may be defined under applicable law. If the law ever requires us to offer an “opt out of sale” mechanism, we will comply; our default position remains that we do not sell your information.

11. Security and Surveillance

We use reasonable administrative, technical, and organizational safeguards. No internet transmission or storage system can be guaranteed 100% secure.

Our venue uses camera surveillance in and around the haunt for safety, security, and operational purposes. Recordings may be reviewed and used in investigations, legal claims, and policy enforcement.

12. International Users

We are based in the United States. If you access our services from other regions, you consent to the transfer and processing of information in the U.S. as described in this policy, subject to applicable law.

13. Changes to This Policy

We may update this Privacy Policy from time to time by posting an updated version on this page with a revised effective date.

14. Contact

For privacy questions, contact: legal@haunts365.com.