Last updated: August 2026

This Privacy Policy describes how Comprizant LLC ("Comprizant," "we," "us," or "our") collects, uses, stores, and protects information when you use our website, platform, and services (collectively, the "Service").

1. Roles and Definitions

Comprizant operates in two capacities depending on whose data is involved:

Data Controller for merchant data: When you create a Comprizant account, we collect and control your account information, billing details, and usage data.
Data Processor for consumer data: When your promotional campaigns collect consumer information (e.g., email addresses, entry data), you are the data controller and Comprizant processes that data on your behalf according to your instructions.

This distinction matters for your obligations. As the data controller for consumer data, you are responsible for providing privacy notices to consumers, obtaining consent where required, and responding to consumer rights requests. We will assist you in fulfilling these obligations to the extent they relate to data processed through our Service.

2. Information We Collect

Information you provide

Account information: Name, email address, organization name, and password when you create an account.
Billing information: Payment method details processed by our payment provider (Stripe). We do not store full credit card numbers.
Campaign data: Campaign configurations, prize details, eligibility criteria, sponsor information, and other content you provide to create campaigns.
Communications: Information you provide when you contact us for support or through our contact form.
Waitlist and updates: Your email address when you join our waitlist or ask to be notified about the Service. We use it only to contact you about access and product updates, and you can unsubscribe at any time.

Consumer data processed on your behalf

Entry data: Email addresses, names, and other information consumers provide through your promotional campaigns.
Device information: When fraud detection features are enabled, we collect device fingerprints, IP addresses, browser characteristics, and behavioral signals from campaign participants.
Identity data: When identity resolution features are enabled, we build consumer profiles linking multiple entries to the same individual.

Information collected automatically

Usage data: Pages visited, features used, actions taken within the Service, and performance metrics.
Device and browser information: Browser type, operating system, device type, screen resolution, and language preference.
Log data: IP address, access times, and referring URLs.

3. How We Use Information

Merchant data (we are the controller)

Provide, maintain, and improve the Service
Process payments and billing for your campaigns
Send transactional communications (account verification, billing, security alerts)
Provide customer support
Detect and prevent fraud and abuse of the Service
Comply with legal obligations
Analyze usage patterns to improve the product (aggregated and anonymized)

Consumer data (we are the processor)

Process and validate campaign entries on your behalf
Run fraud detection and identity resolution as configured by you
Generate analytics and reports for your campaigns
Deliver entry data to destinations you configure (webhooks and data exports)
Fulfill winner selection and notification as configured by you

We do not use consumer data collected through your campaigns for our own marketing purposes. We do not sell consumer data.

4. Service Providers

We use third-party service providers for cloud infrastructure, database hosting, payment processing, email verification, fraud detection, and AI-powered document review. All service providers are bound by data processing agreements and maintain appropriate security measures. A current list of sub-processors is available upon request at privacy@comprizant.com.

5. Data Retention

Account data: Retained while your account is active and for 30 days after account deletion.
Campaign configurations: Retained while your account is active. Deleted upon account deletion.
Entry data: Retained for 4 years from campaign close date (to meet promotional marketing regulatory retention requirements), then deleted.
Compliance documents: Retained for 4 years from campaign close date.
Billing records: Retained for 7 years as required by tax law.
Fraud detection data: Device fingerprints and identity resolution data retained for 2 years from last activity.

You may request earlier deletion of consumer data by contacting us. We will comply unless retention is required by law or necessary to fulfill ongoing compliance obligations.

6. Data Security

We implement industry-standard security measures to protect your information:

All data is encrypted in transit using TLS 1.2+
Data at rest is encrypted using AES-256
Integration credentials are encrypted with AES-256-GCM
Access controls enforce least-privilege principles
Infrastructure is hosted in SOC 2 compliant data centers
Regular security reviews and dependency audits

No system is perfectly secure. We cannot guarantee absolute security, but we commit to promptly addressing any security vulnerabilities and notifying affected parties as required by law.

7. Cookies and Tracking

The Comprizant website and dashboard use cookies for:

Essential cookies: Authentication, session management, and security. Required for the Service to function.
Analytics cookies: Aggregated usage statistics to improve the Service. Can be disabled without affecting functionality.

Campaign entry pages, which we host, may set cookies and similar identifiers for security, bot protection, and deduplication purposes (for example, preventing the same visitor from entering multiple times).

8. International Data Transfers

Comprizant is based in the United States and processes data primarily in the US East (Virginia) region. If you are located outside the United States, your data will be transferred to and processed in the United States.

For transfers from the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on Standard Contractual Clauses approved by the European Commission. Contact us at privacy@comprizant.com if you require a copy.

9. Your Rights

All users

Access: Request a copy of the personal information we hold about you.
Correction: Request correction of inaccurate personal information.
Deletion: Request deletion of your account and associated personal data.
Export: Request a machine-readable export of your data.
Opt-out: Unsubscribe from marketing emails at any time.

California residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

Right to know: Categories and specific pieces of personal information collected.
Right to delete: Request deletion of personal information.
Right to opt-out of sale: We do not sell personal information. If this changes, we will provide an opt-out mechanism.
Non-discrimination: We will not discriminate against you for exercising your CCPA rights.

To exercise these rights, contact us at privacy@comprizant.com. We will respond within 45 days as required by law.

EEA, UK, and Swiss residents (GDPR)

If you are located in the EEA, UK, or Switzerland, you have additional rights under GDPR:

Right to restriction: Request restriction of processing in certain circumstances.
Right to portability: Receive your data in a structured, commonly used format.
Right to object: Object to processing based on legitimate interests.
Right to withdraw consent: Where processing is based on consent, withdraw at any time.
Right to lodge a complaint: File a complaint with your local data protection authority.

Our legal basis for processing merchant data is: (a) performance of a contract (providing the Service), (b) legitimate interests (improving the Service, preventing fraud), and (c) compliance with legal obligations. For consumer data, we process on your behalf based on your instructions.

10. Children's Privacy

The Comprizant Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you operate campaigns that may involve participants under 13, you are responsible for COPPA compliance, including obtaining verifiable parental consent where required.

If you believe we have inadvertently collected information from a child under 13, contact us immediately and we will delete it.

11. Data Breach Notification

In the event of a data breach that affects your personal information or consumer data processed on your behalf, we will:

Notify affected merchants within 72 hours of becoming aware of the breach
Provide details of the nature and scope of the breach
Describe the measures taken to address and mitigate the breach
Cooperate with your notification obligations to consumers and regulators

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before they take effect. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

For questions about this Privacy Policy or to exercise your privacy rights:

privacy@comprizant.com

Comprizant LLC
Arizona, United States