Privacy Policy

• Account information: email, optional name, password hash (or magic-link state), and the organization(s) you belong to.
• Operator-supplied employee/student data: whatever fields you import (names, IDs, departments, photos, barcodes). You decide what to upload. The only required fields are an employee or student ID, a first name, and a last name.
• Templates, themes, and rendered badges: the design files you create and the PDFs we generate when you print.
• Operational telemetry:print job records (which operator printed which template at what time) and an audit log of admin actions. We don’t track behavioral analytics (no Google Analytics, no Mixpanel, no Segment).
• Print Agent pairings:if you install our optional desktop helper, the device’s hostname, the printer names it reports, and a bearer token used to authorize print dispatches to that machine.
• Roster files:if you turn on roster sync, the files your student information or HR system uploads to your drop folder. We delete each file once it’s applied, and after 14 days at the latest.

We store your data in the United States. These services are involved:

• Database & file storage: Supabase, in AWS us-east-2. Postgres for structured records, S3-compatible object storage for photos and rendered PDFs, both encrypted at rest. For everything you do signed in to the app, the database’s row-level security policies keep each organization’s records separate. Requests made with an API token are limited to that token’s organization by our application code.
• Application hosting: Railway, in the United States. Stateless Next.js server; no persistent operator data lives here.
• Email: Resend sends invitations, password resets, sign-in links, account alerts, and messages from our contact form. Subject to Resend’s privacy policy.
• Billing: Polar. Payment-method details never touch BadgeBadger; Polar handles the card and PCI compliance.
• DNS & email forwarding: Cloudflare runs our DNS and forwards email sent to our help@ and hello@ addresses. App traffic doesn’t pass through Cloudflare’s proxy.
• Roster sync: Amazon Web Services. If you turn on roster sync, your roster files wait in a private Amazon S3 bucket in us-east-2 until we apply them.
• Optional AI features: the Scan card to template feature sends an image of an existing ID card to Anthropic for layout extraction. Anthropic does not train on this data per their commercial API terms. We only call out to Anthropic when an operator clicks the “Scan card” button.
• Fonts and open-source tools: the template editor loads fonts from Google Fonts, and the photo tools load open-source code and models from jsDelivr, Google Cloud Storage, and IMG.LY. Your browser fetches these files directly, so those services see your IP address, as with any web request. No badge data or photos are sent to them.

• We don’t use your data to train AI models, ours or anyone else’s.
• We don’t sell or share data with advertisers, brokers, or anyone outside the processors listed above.
• We don’t track operators across the web. No third-party analytics or advertising scripts run on our site or in the app.

Account and operator data persists for the life of your subscription. When you delete an employee record, we remove it and its photos right away. When your account closes, we delete all of its records within 30 days unless you ask us to keep them longer while you move to another system.

Audit log entries are kept for security and dispute resolution. Automatic retention windows are on the roadmap, so today they stay for the life of the subscription. Print job records (who printed what, when) are kept for the life of the subscription as part of the audit trail and are deletable on request.

Depending on where you live (GDPR, CCPA, FERPA, COPPA), you may have the right to access, correct, delete, or export the data we hold about you. Email help@badgebadger.app with the request and we’ll respond within 30 days.

BadgeBadger acts as a data processor for the employee/student records you upload; the organization that uploaded them is the data controller. Individual students or employees should make rights requests to their organization first.

BadgeBadger is designed to be FERPA-friendly: directory information is the only field type we require, photos and IDs are stored under organization-scoped Supabase RLS, and we sign a Data Processing Addendum with K-12 districts on request. See the DPA template and email help@badgebadger.app to start the paperwork.

We don’t knowingly create accounts for children under 13. Schools and districts use the platform, not their students.

BadgeBadger is run from the United States and stores data there. If you use it from another country, your data is transferred to and processed in the US. For organizations covered by the GDPR or UK GDPR, our DPA includes the EU Standard Contractual Clauses and the UK addendum.

We process your account information to provide the service you signed up for. We process the people records your organization uploads on its behalf and on its instructions, as its processor.

We’ll email the account owner at least 30 days before any materially adverse change. Minor clarifications (typos, links, new sub-processors that don’t change the type of data collected) are reflected here without notice; check the “Updated” date above.

BadgeBadger is run by Po Studios LLC, a New Jersey limited liability company.

Privacy questions, data requests, and security reports: help@badgebadger.app. For a security report, put “Security” in the subject line.