This Privacy Policy explains how Pineapple Orange Juice, LLC collects, uses, shares and protects personal information in connection with PineappleOrangeJuice.com. It covers two different relationships, and which one applies to you determines your rights and who you should contact.
If you booked an experience at a venue — the venue is the controller of your information and decides how it is used. We are its processor and act on its instructions. Read Section 3, then direct requests about your information to the venue. See Section 11.
If you run a business that subscribes to our software — we are the controller of your account, billing and support information. Read Section 2 and Section 11.
PineappleOrangeJuice.com is booking software licensed to experience businesses such as escape rooms (“Venues”). Each Venue has an isolated workspace.
| Situation | Our role | Controller |
|---|---|---|
| A Venue’s guest, booking, participant, waiver, message and call data | Processor | The Venue |
| Venue account, staff logins, subscription and billing records | Controller | Us |
| Our marketing site, sales enquiries and support correspondence | Controller | Us |
| Security, abuse-prevention and audit logs about use of the platform | Controller | Us |
Where we act as processor, we process information under our agreement with the Venue and its documented instructions, subject to applicable law.
When a Venue registers we collect the business name, the owner’s name, a business email address and the business timezone. Within the workspace a Venue may add a business phone number, mobile number, website, postal address, locale and currency.
For each staff account: email address, display name, assigned role, active status, a securely hashed password (hashed with bcrypt — we never store passwords in readable form) and the date of last sign-in.
Our payment processor Stripe collects and holds payment card details. We receive and store a Stripe customer identifier, a subscription identifier, subscription status, the current billing period end date, whether cancellation is scheduled, and a record of billing events we have processed. We do not receive or store card numbers, expiry dates or security codes.
We record sign-in attempts, password-reset requests and signup attempts. To avoid storing more identifying information than necessary, the email address or IP address involved is stored only as a keyed cryptographic hash, together with the outcome and timestamp.
Lifecycle actions taken by our platform administrators — for example suspending or reactivating a workspace — are written to an audit log with the administrator identity, the workspace, the action, the reason and a timestamp.
Our hosting provider and application logs record IP addresses, request paths, timestamps, user-agent strings and error diagnostics, generated automatically when you use the Service.
If you contact us for support, sales or legal reasons we keep the correspondence and its contents.
The categories below are determined by each Venue’s configuration. We hold them on the Venue’s behalf and do not use them for our own purposes.
We store the payment provider used, the amount and currency, the payment status, provider reference identifiers, refund records and any provider failure message. No payment card data passes through or is stored by the Service. Guests are redirected to the provider’s own hosted checkout page.
For each message sent we retain the recipient address, subject, a snapshot of the message body as sent, the scheduled and actual send times, the number of delivery attempts, delivery status and any error returned by the email provider.
Booking emails contain an expiring signed link that lets a guest view their bookings, update contact details, open waivers, reschedule and cancel within the deadlines the Venue sets. The link contains a cryptographically signed token, not a password. The link expires after 90 days. Anyone in possession of the link can use it until it expires, so guests should treat these emails as confidential.
See Section 4.
Venues may subscribe to an optional add-on that answers their telephone line with an automated conversational assistant. Where a Venue has enabled it:
Every call begins with a spoken disclosure that the caller is speaking with an automated booking assistant, before any information is collected. The time at which the disclosure was given is recorded.
Call audio is not recorded and no audio file is created or stored.
Speech is transcribed to text in order to operate the conversation. A written transcript of the conversation is stored so that the Venue and the caller have a record of what was agreed.
| Data | Detail |
|---|---|
| Caller number | Stored in masked form for display, and as a keyed cryptographic hash and a normalised lookup value used to match the caller to an existing booking. The full number is not displayed in the interface. |
| Written transcript | Caller and assistant turns with timestamps, capped at the most recent 64 entries. On a long call the earliest turns are not retained. |
| Call metadata | Start, answer and end times, duration, status, outcome and disclosure timestamp. |
| Action audit | A record of each action the assistant took or was refused, with minimised inputs: for example the last four characters of a booking reference, a masked callback number, or the verification method used. |
| Verification challenges | Where a caller verifies by email or text code, a keyed hash of the target and of the code, plus timestamps. The code itself is not stored in readable form. |
| Usage records | Billable seconds and minutes per call. |
Conversation text is sent to OpenAI to generate replies. We send these requests with storage disabled, so the provider does not retain the conversation, and the content is not used to train models. We do not send payment card data or special-category data to the model. The assistant is instructed never to collect or repeat payment card details.
If a caller says something the system identifies as indicating an emergency, the assistant immediately ends the call and tells the caller to contact emergency services. That turn is written to the transcript. The Service is not an emergency service and must not be relied on to summon assistance.
A Venue may optionally choose to treat a matching inbound caller ID as verification of a caller’s identity. Caller ID can be spoofed. Where a Venue enables this, it accepts responsibility for that decision, and it may permit a caller presenting a matching number to view limited booking details and perform certain changes without a one-time code.
We use a small number of strictly necessary cookies and no advertising or cross-site tracking technologies.
| Cookie | Purpose | Lifetime |
|---|---|---|
staff_session | Keeps a signed-in staff user authenticated. Marked HttpOnly, Secure and SameSite=Lax. | 8 hours |
platform_session | Keeps a platform administrator authenticated. Marked HttpOnly, Secure and SameSite=Strict, and scoped to the administration path only. | 4 hours |
We do not set cookies on the public booking pages or booking widgets, do not use advertising cookies, and do not sell or share personal information for cross-context behavioural advertising. Because we set only strictly necessary cookies, no consent banner is required for the application itself.
As controller we use information to: create and administer accounts; authenticate users; take payment and manage subscriptions; provide support; secure the Service and prevent fraud and abuse; monitor and improve performance and reliability; comply with legal obligations; and communicate service and billing notices. We may send product announcements to Venue owners; you may opt out of non-essential announcements at any time, but not out of service, security and billing notices while your account is active.
As processor we use information only to provide the Service to the Venue and on the Venue’s instructions: displaying availability, creating and managing bookings, taking payment through the Venue’s provider, sending the Venue’s notifications, generating waivers and reports, and operating the telephone assistant.
We do not sell personal information. We do not use guest data for our own marketing. We do not use Venue or guest data to train machine-learning models.
| Purpose | Legal basis |
|---|---|
| Providing the Service to a subscribing Venue | Performance of a contract (Art. 6(1)(b)) |
| Processing guest data on a Venue’s behalf | The Venue’s legal basis, as controller; we act under Art. 28 |
| Billing, tax and accounting records | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
| Security, fraud prevention, rate limiting and audit logging | Legitimate interests in protecting the Service and its users (Art. 6(1)(f)) |
| Service and security notices to account holders | Performance of a contract; legitimate interests |
| Product announcements to Venue owners | Legitimate interests, with an opt-out; consent where required |
| Responding to legal requests and defending claims | Legal obligation; legitimate interests |
Where we rely on legitimate interests we have assessed that our interests are not overridden by the rights and freedoms of the individuals concerned. You may object to that processing as described in Section 11.
We share personal information with service providers that support hosting, payment processing, email delivery, telephony and AI-assisted conversations. We require providers to protect the information they receive and to process it only for the contracted service. Current information about these providers, their function and the categories of data they receive is available by contacting staff@pineappleorangejuice.com.
We do not share data between Venues. A guest who books at two Venues has two separate records, and neither Venue can see the other’s relationship with that person.
We may disclose information where required by law, subpoena, court order or other legal process, or where we reasonably believe disclosure is necessary to protect the rights, property or safety of Pineapple Orange Juice, our customers or the public. Where we are legally permitted, we will notify the affected Venue before disclosing data we hold on its behalf, so it can seek protective relief.
If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction. We will give notice before personal information becomes subject to a materially different privacy policy, and the recipient will remain bound by commitments at least as protective.
We do not sell personal information, do not share it for cross-context behavioural advertising, and do not disclose it to data brokers.
We are based in the United States, and application data is hosted and processed in the United States. The Service is initially offered only to businesses operating in the United States and does not currently offer an EU-resident or UK-resident storage option. We will update our contractual and transfer arrangements before offering the Service in additional countries.
Retention periods, and the limits of what the Service currently deletes automatically, are set out in full in our Data Retention Policy, which forms part of this Privacy Policy. In summary: security and rate-limiting records are kept for short fixed periods; password reset and verification codes expire in minutes; call transcripts are deleted on the schedule the Venue configures; and booking, customer, waiver and payment records are retained for as long as the Venue’s workspace is active, and then for a limited wind-down period after closure, subject to legal retention requirements.
The Venue is the controller of your information. Please contact the Venue directly to access, correct, delete, restrict, object to or port your data. If you contact us instead, we will forward your request to the Venue and tell you that we have done so; we cannot act on it ourselves without the Venue’s instruction. If you do not know which Venue holds your data, we will help you identify it.
Subject to applicable law, you may ask us to: confirm whether we hold personal information about you and give you a copy; correct inaccurate information; delete information; restrict or object to processing; receive information in a portable format; and withdraw consent where processing is based on consent, without affecting prior processing.
Email staff@pineappleorangejuice.com. We will verify your identity, usually by requiring you to respond from the address on file or to confirm details only the account holder would know. We will respond within 30 days, or within the shorter period required by applicable law, and may extend by a further 60 days for complex requests, telling you why.
We will not deny service, charge a different price or provide a different quality of service because you exercised a privacy right.
If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana or another state with a comprehensive privacy law, you may have rights to know, access, correct, delete, obtain a portable copy, opt out of sale or targeted advertising, and limit the use of sensitive personal information. Exercise them as described in Section 11.3.
Sale and sharing. We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act as amended, or under comparable state laws. We have not done so in the preceding twelve months, including with respect to minors under 16. Because we do not sell or share, no “Do Not Sell or Share My Personal Information” link is required.
Sensitive personal information. We do not use or disclose sensitive personal information for purposes beyond those permitted without a right to limit.
Categories. The categories of personal information we collect, the sources, purposes and categories of recipients are described in Sections 2, 3, 4, 6 and 8, and in the Sub-processor List.
Authorised agents. You may use an authorised agent, who must provide proof of authorisation; we may also contact you to confirm.
Appeals. If we decline a request, you may appeal by replying to our decision with the word “Appeal”. We will respond within 45 days. Residents of some states may also contact their Attorney General.
The Service is intended for use by businesses and by adults making bookings. We do not knowingly collect personal information directly from children.
The Service does allow a Venue to record participants who are minors on a booking roster, and to capture a guardian’s signature on a waiver. That information is provided by the booking adult or by the guardian, not collected from the child. Where we hold it, we hold it as processor for the Venue, which is responsible for having a lawful basis and any required parental consent, and for the content of its waiver.
If you believe a child’s information has been provided to us in a manner that requires deletion, contact staff@pineappleorangejuice.com and we will work with the relevant Venue to address it promptly.
Measures we currently apply include:
No system is completely secure. We cannot guarantee absolute security, and you are responsible for the strength and confidentiality of your credentials.
If we become aware of a personal data breach affecting information we hold as processor, we will notify the affected Venue without undue delay and, where the GDPR or UK GDPR applies, within 72 hours of becoming aware, providing the information required so that the Venue can meet its own notification duties. Where we act as controller, we will notify affected individuals and regulators as required by applicable law.
Report a suspected vulnerability or incident to staff@pineappleorangejuice.com. We will acknowledge within as soon as reasonably practicable. We will not pursue legal action against good-faith security researchers who report privately and do not access or alter data beyond what is necessary to demonstrate the issue.
We do not carry out automated decision-making that produces legal or similarly significant effects about individuals.
The AI Phone Operator uses an automated system to hold a conversation and, where the Venue has enabled it, to create or change a reservation. It operates within server-enforced limits: it can act only on a booking already verified during that call; it cannot take a reservation, reschedule, cancel or send a payment link without a caller’s separate explicit spoken confirmation; and it cannot access any other Venue’s data. A caller may ask to speak to a person at any time, and where the Venue has configured and enabled transfer during staffed hours, the call is transferred.
We may update this Policy. We will change the effective date above and, for material changes, give notice by email to Venue owners and by notice in the workspace at least 30 days before the change takes effect. Previous versions are available by contacting staff@pineappleorangejuice.com.
Pineapple Orange Juice, LLC
8 The Green STE A, Dover, Kent County, DE 19901, United States
Privacy: staff@pineappleorangejuice.com
Security: staff@pineappleorangejuice.com
The Service is initially offered only to businesses operating in the United States. We will update this Policy, including any required regional contacts, before offering the Service in additional countries.