Last updated: November 12, 2026
EpassCard helps businesses create and manage digital wallet passes for Apple Wallet and Google Wallet. Many of our customers and their pass holders are in the European Union, the EEA and the UK, so we take the General Data Protection Regulation (GDPR) seriously. This page explains how we handle personal data, the rights you have, and how to use them. It complements our Privacy Policy and Cookie Policy.
Who is responsible for your data
EpassCard LLC, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States.
Privacy contact: [email protected]
- For your EpassCard account (the business using EpassCard), we are the controller.
- For the people who hold your passes (your customers, members or guests), the business that issues the pass is the controller and EpassCard is the processor. We process that data only on the business’s instructions.
What we do to protect personal data
- Consent for cookies. Analytics and support-chat cookies only run after you allow them. You can change your choice at any time from Cookie settings.
- Encryption. Data is encrypted in transit (HTTPS). Account details such as names, email addresses and phone numbers are encrypted in our database.
- Access control. Each workspace can only see its own data, and administrator access is restricted to a small number of staff.
- Account deletion. You can delete your account yourself from Account security. After a short grace period, your account data is permanently removed, except records we must keep by law (for example invoices).
- Marketing only with permission. We send marketing emails only if you opted in, and every one has an unsubscribe link.
- Careful choice of providers. We work with established service providers that offer data protection terms for their services.
Your rights under the GDPR
If you are in the EU, EEA or UK, you have the right to:
- Access the personal data we hold about you
- Correct data that is wrong or incomplete
- Delete your data (“right to be forgotten”)
- Receive a copy of your data in a portable format
- Restrict or object to certain processing
- Withdraw consent at any time, for example for cookies or marketing emails
- Complain to your local data protection authority
How to make a request
Email [email protected] from the address on your account and tell us what you would like us to do. We may ask you to confirm your identity. We reply within one month, as the GDPR requires.
If you hold a pass issued by a business that uses EpassCard, please contact that business first: they control your pass data. If you cannot reach them, write to us and we will help.
For businesses: Data Processing Agreement
If you use EpassCard to process personal data of people in the EU, EEA or UK, we offer a Data Processing Agreement (DPA) under Article 28 GDPR. Email [email protected] to request it.
Service providers we use
We share personal data only with providers that help us run the service:
- Hosting and infrastructure: DigitalOcean (servers), Cloudflare (network protection and file storage)
- Wallet passes: Apple (Apple Wallet), Google (Google Wallet)
- Notifications: Google Firebase (push notifications), email delivery providers, SMS providers
- Payments: Stripe
- Support and analytics (only with your consent): Crisp (support chat), Google Analytics, Microsoft Clarity
- Security and reliability: Google reCAPTCHA (abuse protection), Sentry (error monitoring)
- Optional AI features: AI providers, used only when you use those features
Where your data is stored
Our servers are currently in the United States. When personal data from the EU, EEA or UK is transferred there, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
EU data hosting is on our roadmap. We are preparing a separate EU hosting region so that European customers can keep their data in the EU. We will update this page when it is available.
Continuous improvement
Data protection is ongoing work. We regularly review our systems and processes and improve them. If you have a question or a suggestion, write to [email protected].
