Privacy Policy

Two different roles

If you are a member of an organization that uses ArtPass, that organization decides what membership information to keep about you and is responsible for it. ArtPass stores and processes it on the organization's behalf, only to run the pass service. For questions about your membership record, contact the organization first. ArtPass will help the organization answer you.

If you are staff at an organization, or someone who contacts ArtPass directly, ArtPass decides how your information is used, as described below.

What we collect

Members (pass holders)

• Name, email address, member number, membership type, membership start and expiry dates, and the organization that issued the pass.
• A record each time your pass is scanned at a venue: the date and time, the organization, the scanning station name where one is used, and which staff account or scanner code recorded it.
• If you add the pass to Apple Wallet, a device registration (a token Apple provides so we can send pass updates). We do not receive your Apple ID or your other Wallet passes.
• One-time email codes used to open your pass page. They expire after 30 minutes.
• Your communication choices, such as unsubscribing from reminder emails.

Organization staff

• Email address and name, sign-in details (email and password, or Google sign-in), and the organizations you belong to and your role.
• Actions taken in the staff dashboard that the service needs to keep, such as announcements sent and visits recorded.

People who contact ArtPass

• If you request a demo: your name, email, organization, website, role, and answers about your membership program.

Technical information

• Server logs and error records, which can include IP address and device or browser details, kept to run and secure the service.
• A sign-in session stored in your browser for staff who are signed in. ArtPass does not use advertising or cross-site tracking cookies.

Why we use it

• To issue, update and verify membership passes, and to let an organization check a pass at the door.
• To send the emails and notifications an organization has set up for its members: welcome messages, renewal reminders and announcements.
• To let an organization see who visited and when.
• To sign staff in and keep accounts secure, to bill organizations, to respond to demo requests, and to fix problems.

We do not sell personal information, and we do not use members' information for advertising.

Who else handles it

ArtPass uses these service providers to run the service. Each receives only what it needs for its part.

• Google (Firebase and Google Cloud) for hosting, sign-in, the database, file storage and background jobs.
• Resend for sending email.
• Stripe for billing organizations. Card details go to Stripe, not to ArtPass.
• Apple for Apple Wallet passes and update notifications.
• OpenStreetMap for the map shown to staff when they place a venue pin.
• Blackbaud (Raiser's Edge NXT), only for an organization that chooses to connect its own account. ArtPass then sends that organization's visit records to the organization's own Raiser's Edge and reads email addresses to match members. The organization controls the connection and can disconnect it at any time.

We may also disclose information when the law requires it, or to protect the safety and security of people or the service.

Where it is stored

ArtPass's database, uploaded files and application servers are in Canada, in Google Cloud's Montréal region. Some information still leaves Canada or is held by others: sign-in accounts (email addresses and password data) are kept by Google's authentication service, which does not let us choose a country; email is sent through Resend; Apple handles Wallet passes and update notifications; and an organization that connects Raiser's Edge sends data to Blackbaud. These providers may process information in the United States or elsewhere, where it can be accessible to authorities under that country's laws.

How long we keep it

Membership and visit records are kept while the organization uses ArtPass, so that passes keep working and the organization has its history. One-time codes expire within minutes. When an organization leaves ArtPass, or when we are asked to delete a record and the organization agrees, we delete the information, apart from copies we are required to keep for legal or accounting reasons. Staff can delete their own account from their settings.

Your choices

• You can ask to see the personal information held about you, ask for corrections, or ask us to stop using it.
• Reminder emails include an unsubscribe link.
• You can remove a pass from Apple Wallet at any time, which stops updates to that device.

For a membership record, contact the organization that issued your pass. For anything else, or if you are not sure who to ask, contact ArtPass: our contact address loads in a moment. If you are not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.

Security

Access to personal information is limited to the organization's own staff and to the ArtPass team members who need it to run the service. Data is encrypted in transit, and credentials for connected services are kept in a managed secret store. No online service can promise perfect security, so we also ask you to keep your sign-in details private.

Children

ArtPass is built for organizations and their members. It is not directed at children under 13, and we do not knowingly collect their information outside what a membership organization enters for its own members.

Changes to this policy

If we change how we handle personal information, we will update this page and its date. For significant changes affecting organizations, we will also tell them directly.