ENTRROPromoter
PromoterBusiness
Join waitlist
All users · Legal

Privacy Policy

What we collect, what we don't, and what you can do about it.

Effective: June 16, 2026 · Last updated: June 16, 2026 · Version 2.0

Wyola LLC, a Wyoming limited liability company doing business as ENTRRO ("ENTRRO," "we," "us"), operates the ENTRRO platform, including the ENTRRO promoter app, the ENTRRO Business app, scanner devices, guest landing pages/Wallet passes, and our websites (together, the "Services"). ENTRRO is a trademark and trade name of Wyola LLC. This Policy explains what personal data we collect, how we use it, who we share it with, and your rights. It is the operative privacy policy for our mobile apps and websites.

1. Who this applies to

The Services are intended for users 18 and older. We do not knowingly collect data from anyone under 18. See Section 9 (Children).

2. Data we collect

You give us: - Account data — name, email, phone, city; date of birth (to confirm 18+). - Business data (Business app) — venue name, address, business contact, and venue logo image.

Created through use of the Services: - Activity — promotions you create or share, passes issued, redemptions/scans at the door, validations, attribution, and payout/billing records. - Guest data — for guests who use a promoter's shared link: name (where supplied), email/phone (where supplied), device identifier, and click/arrival timestamps used for attribution. - Device & technical data — device identifiers, push token, app version, OS, and an anonymized IP address used for security and fraud prevention.

Payments (handled by Stripe): - Bank/card details for payouts (promoters) and charges (venues), and identity-verification (KYC/KYB) information, are collected and processed by Stripe, Inc., a PCI-DSS Level 1 / SOC 1 / SOC 2 Type II audited processor. Card details are tokenized at capture. ENTRRO never sees, stores, or logs raw card or bank numbers.

We host on Amazon Web Services (AWS) and use Twilio for SMS / phone-number verification (one-time codes). We do not use third-party analytics or advertising SDKs. [CONFIRM: whether the "nearby" feature uses device location, and whether the apps offer Apple/Google sign-in — see subprocessors.]

3. How we use data

  • Provide and operate the Services (accounts, promotions, scanning, validation, attribution, payouts, billing).
  • Verify eligibility and identity (18+; KYC/KYB via Stripe).
  • Prevent fraud and abuse and keep the Services secure.
  • Communicate with you (transactional and service messages; push notifications you can control).
  • Comply with legal and tax obligations.

We do not use your data for third-party advertising, and we do not run third-party ad trackers in the product.

4. Legal bases (GDPR/UK GDPR)

Where GDPR/UK GDPR applies, we rely on: performance of a contract (operating the Services), legitimate interests (security, fraud prevention, improving the Services), legal obligation (tax/records), and consent (e.g., push notifications, where required). You may withdraw consent at any time.

5. How we share data

We share data only as needed to run the Services: - Stripe — payments, payouts, and identity verification. - Amazon Web Services (AWS) (cloud hosting/infrastructure), Twilio (SMS / phone-number verification), and Apple Push (APNs) / Google Firebase Cloud Messaging (FCM) (push notifications), acting as our processors/subprocessors. Full list: https://entrro.com/subprocessors. - Venues and promoters — limited attribution data needed to credit a validated guest to the correct promoter. We do not disclose your guest list to other venues; your audience is yours. - Legal — when required by law, or to protect rights, safety, and against fraud.

We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising (as those terms are defined under California law).

6. International transfers

Where data is transferred outside the EEA/UK, we rely on the EU Standard Contractual Clauses (2021/914) and the UK IDTA/Addendum, as applicable. Our customer-facing Data Processing Addendum governs business-customer data.

7. Retention

We keep account data while your account is active. After account deletion, payout and tax records are retained for 7 years (legal requirement); other personal data is deleted within 30 days, subject to backups cycling out and legal holds.

8. Your rights

Depending on where you live (incl. GDPR/UK GDPR and California CCPA/CPRA), you may access, correct, delete, export (portability), restrict, or object to processing, and request deletion of your account and associated data. - In-app: you can request account closure and data deletion from within the apps. - Web: request deletion at https://entrro.com/account-deletion (no login required). - Email: privacy@entrro.com — we respond within 30 days (usually within 48 hours).

California (CCPA/CPRA): In the past 12 months we collect the categories in Section 2 (identifiers, contact, commercial/transaction, financial via Stripe, device/internet activity). We use them for the purposes in Section 3. We do not sell or share personal information. You have the right to know, delete, correct, and to non-discrimination for exercising rights. Submit requests via the channels above; we will verify your identity before acting.

9. Children

The Services are not directed to children under 18, and we do not knowingly collect their data. If you believe a minor has provided us data, contact privacy@entrro.com and we will delete it.

10. Security

Encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access with least-privilege defaults, audit logs, mandatory MFA for staff, and periodic security testing. No method is 100% secure; we work to protect your data and notify you and regulators of confirmed breaches as required by law.

11. Cookies

On our websites we use strictly-necessary cookies only (session, authentication, fraud prevention). No advertising cookies or third-party ad trackers. See our Cookie Policy.

12. Changes

We will post changes here with a new "Last updated" date and, for material changes, provide notice (e.g., email or in-app) before they take effect.

13. Contact