Privacy Policy

This policy explains what Cavline Inc. (“Cavline”, “we”) collects when you use the Cavline iOS app, the web app at cavline.app, or this website, why we collect it, who we share it with, and what you can do about it. It also covers the small amount of data we gather around a physical screen in a venue: walk-in counts and QR scans.

Short version: we collect what we need to run a marketplace and pay people; we use Stripe for payments and never see your full card number; our sensors count bodies, not faces; and you can ask for your data or ask us to delete it by emailing info@cavline.com.

Account data

Name, email address, phone number, password (stored hashed), the role(s) you hold (host, advertiser, cohost), and your notification preferences.

Business data

Business name, address, category, opening hours, photos of the venue and screen, and, for hosts and cohosts, the details needed to pay you out.

Payment data

Advertiser payments and host/cohost payouts are processed by Stripe. We do not store card numbers. We keep what Stripe returns to us: a payment method token, the last four digits and card brand, transaction amounts and status, and payout records. Stripe may ask for identity or tax information directly; that goes to Stripe under Stripe’s privacy policy.

Creatives and campaigns

The images and videos you upload as ads, which screens you booked, schedules, approvals and rejections, and dispute records.

Device and usage data

App version, device type and operating system, push notification token, IP address, crash reports, and which screens of the app you use. On the web, basic page analytics (see Cookies and analytics).

Screen location

The address and map position of each listed screen, and whether it is online. This is business location, shown to advertisers so they can choose where to book. We may ask for your device location during screen setup to place the pin; that request is optional and controlled by your phone’s settings.

QR scan analytics

When someone scans a QR code shown on a screen, we record the time of the scan, the approximate location (derived from the IP address or the screen the code was on), and the device type. We do not ask the scanner to log in or identify themselves.

Aggregate sensor counts

Where a venue has a people-counting sensor installed, we receive counts of people entering or present over a time window. These are numbers, not images or identities. See Sensors and privacy.

Messages

Messages you send through the app (to Cavline, or to a host or advertiser) and emails you send us.

Some screens on the network have a small sensor installed on the premises that counts walk-ins. We want to be very specific about what that sensor does and does not do.

• It counts presence. The output is a number of people over a period of time, which lets a host and an advertiser see how many people were in the room while an ad played.
• It does not identify anyone. There is no facial recognition, no biometric matching, no demographic estimation, and no attempt to tell one visitor from another or to recognize a repeat visitor.
• We do not store video or images of people from the sensors. What reaches Cavline’s systems are aggregate counts.
• Counts are tied to a screen, not a person. They appear in the host’s and the advertiser’s analytics as totals for that venue and time window.

Hosts are responsible for any on-premise notice their local law requires about the sensor. If you are a visitor to a venue and have a question about a sensor there, email info@cavline.com.

• To create and run your account and let you switch between roles.
• To run the marketplace: list screens, take bookings, route ads to screens, collect approvals and rejections, and play the right ad at the right time.
• To process payments, calculate revenue splits and cohost commissions, and pay out wallets.
• To produce the analytics we show you: walk-in counts, QR scans, uptime, and earnings.
• To send you service messages: approvals, a screen going offline, an open slot on a screen you watch, payout confirmations, disputes. Push notifications can be turned off on your phone; some emails are transactional and continue while your account is open.
• To review disputes and enforce the Terms and the Ad Content Policy.
• To find and fix bugs, prevent fraud, and keep the Service secure.
• To comply with law, including tax reporting.

We do not sell your personal information, and we do not use it for third-party advertising.

Service providers

Companies that process data for us, only for the purpose of running the Service:

• Stripe — payments, payouts, identity and tax verification.
• Firebase (Google) — authentication and the database that holds account, screen, and campaign data.
• Cloudinary — storage and delivery of uploaded images and videos.
• Vercel — hosting for this website and the web app, and page analytics.
• Apple Push Notification service (APNs) — push notifications to the iOS app.
• Brevo — optional SMS and email notifications.

Other users, as needed for a campaign

A marketplace only works if the two sides can see each other. A host sees the advertiser’s business name and the creative they are asked to approve. An advertiser sees the host’s venue name, address, screen details, and analytics for the screens they booked. A cohost sees the same information a host sees for the screens they manage. We do not share your personal phone number or email with the other side unless you choose to include it in a message.

Legal

We will disclose data if required by law, a court order, or a valid government request, or where we believe in good faith it is necessary to protect the safety or rights of a person, or to investigate fraud or abuse of the Service.

Business transfers

If Cavline is acquired or merges with another company, your data may transfer as part of that deal. This policy would continue to apply until you are told otherwise.

• Account and business data — for as long as your account is open, then deleted or anonymized within a reasonable period after you close it.
• Payment and payout records — for as long as tax and accounting law requires, typically seven years, even after account closure.
• Creatives — for the life of the campaign plus a period to handle disputes, after which they are deleted from media storage unless you keep them in your library.
• QR scan events and sensor counts — kept as aggregate analytics. Raw scan events may be kept to power history views; they contain no account identity.
• Logs and crash reports — for a short rolling window used for debugging and security.

Wherever you are, you can ask us to tell you what personal data we hold about you, correct it, export it, or delete it. Email info@cavline.com from the address on your account. We may ask you to confirm your identity first. Deleting your account deletes your personal data except what we must keep for payment, tax, or dispute records.

California

If you are a California resident, you have the right to know what personal information we collect and how we use and share it (this policy), to request deletion, to correct inaccurate information, and not to be discriminated against for exercising those rights. We do not sell or share personal information for cross-context behavioral advertising.

New York

Cavline is based in New York. We comply with New York’s data security and breach notification requirements. If a breach affects your personal data we will notify you as the law requires.

Cavline is for businesses and adults. You must be 18 or older to create an account. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal data, email info@cavline.com and we will delete it.

Data is encrypted in transit. Passwords are stored hashed, never in plain text. Payment details are held by Stripe, not by us. Access to production systems is limited to the people who need it. No system is perfectly secure, so if you notice something that looks wrong with your account, tell us right away at info@cavline.com.

The web app uses a session cookie to keep you logged in. This website and the web app use Vercel Analytics, which records page views and basic device information without cross-site tracking cookies. We do not run third-party advertising trackers.

The iOS app does not use cookies. It sends crash reports and basic usage events so we can find bugs.

When we change this policy we update the “Last updated” date at the top. For material changes, especially anything about sensors or sharing, we will notify you in the app or by email before the change takes effect.

Privacy questions and requests: info@cavline.com. Cavline Inc., Syracuse, New York. See also our Terms of Service and Ad Content Policy.