PRIVACY POLICY

Last updated: 12 October 2026

1. Who is the Data Controller?

The escape room venue that you are visiting (or that you operate) is the Data Controller of personal data collected through the kiosk. Cyents Limited acts as a Data Processor on their behalf, providing the Visitor Master software platform that stores and manages that data.

2. Information We Collect

From players using the kiosk:

• Full name
• Email address
• Phone number (optional)
• Instagram handle (optional)
• Marketing opt-in preference
• Digital signature confirming acceptance of the venue’s liability waiver
• Team photos taken at the end of the game
• Game results (room played, time taken, hints used)
• Post-game feedback ratings and comments

From venue staff and operators:

• Name and email address (used for login and audit trails)
• Optional Google account access (see “Google User Data” below)
• Optional MailerLite API key (for syncing marketing opt-ins)

3. How We Use Information

• To register players for escape room sessions
• To produce and store signed digital liability waivers
• To send post-game results emails (including team photos and statistics)
• To collect customer feedback and route public reviews to Google
• To enable monthly prize draws based on social engagement
• To sync marketing opt-in customers to the venue’s MailerLite account, if connected
• To provide venue staff with analytics on bookings, game performance and feedback

4. Google User Data — Limited Use Disclosure

Venues may optionally connect a Google account so that signed liability waivers are saved as PDF files to a Google Drive folder of their choosing. When a venue connects their account, Visitor Master requests thedrive.file scope, which grants access only to files created by Visitor Master — not to the rest of the user’s Drive.

Visitor Master’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, data accessed via Google APIs is:

• Used solely to save waiver PDFs to the venue’s nominated Drive folder
• Never sold to any third party
• Never used to serve advertisements
• Never used to train AI or machine-learning models
• Never transferred to others except as necessary to provide and improve the Service, comply with applicable law, or as part of a merger, acquisition or sale of assets with appropriate notice to users
• Accessed by humans only with the venue’s explicit consent, for security or legal reasons, or in aggregated, anonymised form for debugging

Venues can disconnect Google Drive at any time from the Settings page within Visitor Master, or by revoking access at https://myaccount.google.com/permissions.

5. Device Permissions (Camera & Photos)

When venue staff use Visitor Master on a mobile device or tablet to capture a team photo at the end of a game, the app requests access to the device’s camera and/or photo library. The operating system will ask for your permission the first time this happens.

• Camera access is used solely to take a team photo for the post-game results and social media features.
• Photo library access is used solely to let staff select an existing photo to use instead of taking a new one.
• We do not access the camera or photos in the background, and we only upload a photo when staff explicitly choose to save it.

You can change or revoke these permissions at any time in your device’s system settings.

6. Where Your Data is Stored

Personal data is stored on our secure cloud application platform, which provides the database and authentication infrastructure for the Service. Waiver PDFs (if Drive integration is enabled) are stored in the venue’s own Google Drive account, not on Visitor Master servers.

7. Sharing With Third Parties

We share personal data only with the third-party services required to operate the Service:

• Resend — to deliver post-game results emails on behalf of the venue
• Google Drive — to store waiver PDFs in the venue’s account (only if connected)
• MailerLite — to sync marketing opt-in contacts to the venue’s mailing list (only if connected)
• Our cloud hosting provider — the underlying hosting and database platform

We do not sell personal data.

8. Data Retention

Player records, including signed waivers and team photos, are retained for as long as the venue requires them for legal, insurance or marketing purposes. Venues may delete individual records at any time from the staff portal. If a venue closes its Visitor Master account, all associated data is deleted within 30 days unless required to be retained by law.

9. Your Rights

Under UK GDPR you have the right to:

• Request a copy of the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data (“right to be forgotten”)
• Withdraw consent to marketing communications at any time
• Object to or restrict processing
• Lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk)

To exercise any of these rights, email support@visitormaster.com. We will respond within 30 days.

10. Cookies

The Service uses essential cookies only, for authentication and session management. We do not use third-party advertising or tracking cookies.

11. Children

In line with UK GDPR, players aged 13 and over may register themselves and sign the venue’s liability waiver. Children under 13 must be registered by a parent or guardian, who provides consent and signs the waiver on the child’s behalf.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page with an updated “Last updated” date.

13. Contact

For any privacy-related questions or requests, contact Cyents Limited at:

support@visitormaster.com