Privacy Policy

Who we are

Sunday Squares is a product of Domavant Holdings LLC ("we", "us"), which operates the website at sundaysquares.org and is the controller of the personal information described here.

You can reach us at hello@sundaysquares.org, or by post at Sunday Squares, 8512 Aspen Way, Gilroy, CA 95020. A real person reads that inbox.

Organizations run their own raffles — what that means for your data

Sunday Squares is software that nonprofit organizations use to run their own raffles. The organization — a council, booster club, parish or PTA — decides who to sell tickets to, records who bought them, and awards the prizes. We provide the tools and store the records on their behalf.

So when a volunteer sells you a ticket and writes down your name and email, that organization is deciding to collect it, and it remains responsible for how it uses it. We hold that information for them, use it only to operate the service, and give you the rights described below over your own copy of it. If you want your details corrected or removed from a specific raffle, your organizer can do that directly, and usually faster than we can.

What we collect

Account information, when you create an account:

• Email address, and a password (stored only as a cryptographic hash by our authentication provider — we never see it).
• Display name, an optional phone number, and a preset avatar. There are no photo uploads.
• Your email notification preferences.

Ticket records, created when you buy a ticket or an organizer records a sale:

• The buyer's name, email address and phone number, as given to the volunteer at the point of sale.
• Which tickets are yours, when they were recorded, and whether the organizer has marked them paid — including the method (cash, check, card reader) and a check number if one was written.
• A mailing address, but only where an organization awards a physical prize that has to be posted. It is optional and entered by the organizer, not by us.

Organization information, when a group applies to run raffles:

• The organization's name, type, home state, mission, website, and its EIN where it is a nonprofit.
• The applicant's name, email and phone number.
• For organizations that file state raffle paperwork: the organization's mailing address, phone, registration numbers, and the name and title of the officer who signs the filing.

Sponsor information, where a business sponsors a raffle: contact name, email, the amount pledged or paid, and a logo link if they provide one.

Operational records, generated as the service runs:

• A log of emails and text messages sent, sign-in events, and administrative actions, used to diagnose delivery problems and to keep an audit trail. Message contents are redacted before logging so that links containing access codes are never stored in the log.
• Standard server and security logs kept by our hosting providers.

What we never collect

This is a short list, and it is deliberate:

• No payment card numbers. Raffle tickets are sold in person and the organization collects the money directly — no funds move through Sunday Squares.
• No bank account or routing numbers. Where an organization prepares a bank authorization form for a sponsor, the banking fields are left blank for the organization to complete offline.
• No Social Security numbers. Where the service prepares an IRS Form W-9 for an organization, it fills the employer identification number only and never the individual boxes.
• No advertising identifiers, no analytics trackers, no third-party marketing scripts. There are none on this site.
• No precise location data, and no biometric information.

How we use it

• To operate the service: create your account, show you which tickets are yours, and record the results of each drawing.
• To tell you things you asked to know — that numbers have been drawn, that you have won, and the weekly summary for raffles you hold a ticket in. You can turn these off individually.
• To let an organizer contact the people who bought tickets in their own raffle.
• To help an organization prepare its own state filings from figures the service already holds.
• To keep the service secure and working: diagnosing failed email, investigating misuse, and keeping an audit trail of administrative actions.
• To answer you when you write to us.

We do not use personal information to train machine-learning models, and we do not build advertising profiles.

Who we share it with

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising. We use a small number of service providers to run the product. Each may process personal information only on our instructions.

We also share information with the organization whose raffle you took part in — that is the point of the service — and with its organizers, who see the buyers of their own raffles only. Organizers never see the patrons of another organization.

We may disclose information where we are legally required to, or where it is necessary to investigate suspected fraud or protect someone's safety. If we are ever involved in a merger or sale, information may transfer with the business, and we will say so before it does.

Cookies

We use cookies for one purpose: keeping you signed in. These are set by our authentication provider and are required for the site to work. There is no cookie banner because there is nothing optional to consent to — we set no advertising or analytics cookies.

Platform administrators additionally have a short-lived cookie that records when they are viewing an organizer's console in read-only mode, so that the interface can show it plainly.

Your choices

• Email categories — turn win alerts, weekly summaries, organizer updates or product news on and off individually on your Profile page.
• Unsubscribe — every email we send carries a one-click unsubscribe link that works without signing in.
• Text messages — reply STOP to any message to stop them.
• Correcting your details — your organizer can fix the name, email, phone or address recorded against your tickets, and the change applies across every ticket you hold with that organization.

We will still send you the occasional message that is not marketing — a reply to a question you asked us, or notice of a problem with a raffle you are in. Unsubscribing always stops the rest.

Your rights, and how to use them

You can exercise the two most important rights yourself, immediately, without writing to anyone:

• Download your data — Profile → Export. You get everything we hold that is tied to your account, in a machine-readable file.
• Delete your account — Profile → Delete account. This removes your account and the personal details attached to it. If you are the sole owner of an organization, you will be asked to transfer or close it first, so that a group is never left stranded.

You also have the right to know what we hold, to have it corrected, and to complain to a regulator. Write to hello@sundaysquares.org and we will respond within 30 days.

Deleting your account does not erase the organization's own record that a ticket was sold and a prize awarded, where it needs that record for its accounts or a state filing. That record is the organization's, and its retention obligation, not ours to delete.

California privacy rights

If you are a California resident, the CCPA as amended by the CPRA gives you the rights to know, delete, correct, and to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising them.

We have not sold or shared personal information in the preceding twelve months, and we do not use or disclose sensitive personal information for any purpose other than providing the service. The categories we collect are identifiers (name, email, phone, postal address) and commercial information (which tickets you hold and whether they are paid) — described in full above. Use the export and delete tools on your Profile page, or write to us; we do not require an account to make a request.

How long we keep it

• Account information: until you delete your account.
• Ticket and prize records: for as long as the organization needs them for its own accounts and filings. Charitable raffle rules commonly require several years of records.
• Message and sign-in logs: 400 days, which covers a full season plus the following year's filing.
• Backups: deleted data may persist in encrypted backups for a short period before being overwritten.

Security

Traffic is encrypted in transit and data is encrypted at rest by our hosting provider. Access to records is enforced in the database itself, so a person can only read the raffles and buyers their role allows, rather than relying on the interface to hide them. Passwords are hashed, and are checked against known-breached password lists when set.

No system is perfectly secure. If a breach ever affects your information, we will tell you and the relevant regulator as the law requires.

Children

You must be 18 or older to hold a Sunday Squares account. The service is not directed at children and we do not knowingly collect personal information from anyone under 18. If you believe a child has created an account, write to us and we will remove it.

Changes to this policy

We will update this page when what we do changes, and we will move the date at the top. If a change materially affects your rights, we will tell account holders by email before it takes effect.