Privacy Policy

Last updated: 15 July 2026  ·  Effective: 15 July 2026

Save My Seat ("we", "us", "our") is operated by Luck Dragon Pty Ltd (ABN 64 697 434 898), based in Victoria, Australia. This policy explains how we handle your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. What we collect

• Optional email address — if you choose to share one with us, we store it as part of your profile.
• Display name — optional name you enter, shown to your crew, on your own shared-seat screen, and to authorised staff/admin users.
• Seat hold data — which seat you hold, your hold status, when you held it, and when it expires.
• Operator audit data — for authorised staff/admin actions, we record the named Access identity, role, action, reason, time, and request ID.
• Venue location check — with your permission, precise browser location is used briefly to confirm that you are near a supported venue. Coordinates are not stored in your profile or hold record and are not used to infer your exact bay, row, or seat.
• Usage and security data — Cloudflare may process request metadata such as IP address, timestamp, and user agent under our configured security and observability settings.

2. How we use it

• To keep your seat session attached to this device while you are at the venue.
• To display an anonymised venue view, a named view to authorised members of your crew, and operational details to authorised staff/admin users.
• To contact you about your account only if you choose to provide an email address.

3. Who we share it with

We do not sell or share your personal information with third parties for marketing. We use the following sub-processors to operate the service:

• Cloudflare Inc. (USA) — hosting, edge delivery, and database infrastructure. Cloudflare Privacy Policy.
• jsDelivr — delivery of pinned, integrity-checked seat-number scanning and event QR display libraries. Scanning and QR generation run in your browser; the camera image is not uploaded to us.

4. Data retention

• Seat holds are automatically deleted after their selected expiry (normally 3 hours and never more than 4 hours per update).
• Revoked sessions are removed after a short security period; active device sessions expire after 30 days.
• Administrative audit records are retained for up to 180 days for security and operational accountability.
• Your profile data (such as name, crew code, and optional email) is retained until you request deletion.
• You can request deletion of your account at any time by emailing privacy@luckdragon.io.

5. Your rights

Under the Australian Privacy Act, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Request deletion of your account and associated data.
• Complain to the Office of the Australian Information Commissioner (OAIC) if you believe we have breached your privacy.

6. Security

We use security measures including TLS encryption in transit, revocable signed device sessions, short-lived seat proof tokens, rotating event QR proof, named Cloudflare Access identities, scoped access, rate limits, and administrative audit records. Under the Notifiable Data Breaches scheme, we assess suspected eligible breaches promptly and aim to complete the assessment within 30 days; if an eligible breach is confirmed, required notifications are made as soon as practicable.

7. Cookies and local storage

We use browser localStorage/sessionStorage for your device session, current venue/seat, preferences, and short-lived seat/event proof state. The service worker caches the public app shell for read-only offline access. Actions made offline are not queued as confirmed changes. We do not use third-party advertising cookies.

8. Children

Save My Seat is not directed at children under 13. We do not knowingly collect personal information from children.

9. Changes to this policy

We may update this policy from time to time. Continued use of the service after changes are posted constitutes acceptance of the revised policy.

10. Contact

For privacy enquiries: privacy@luckdragon.io
Luck Dragon Pty Ltd, Victoria, Australia