Your people's data
stays yours.
Plain-language pledges, a published list of every sub-processor, and a Data Processing Agreement you can read before you contact us. No dark patterns, no “contact sales,” no fine print that says we own your people's photos.
We don't sell your data
Not to data brokers, not to advertisers, not to AI companies for training. Not for any reason.
We don't profile or target
No behavioral advertising, no “personalized” recommendations driven from your records, no tracking pixels in the app.
AI doesn't learn from your data
Background removal and face detection run in your browser. The one cloud AI feature, scan-a-card-to-template, sends the card photo to Anthropic only when an operator starts a scan. Anthropic doesn't train on API data, but its standard tier can keep inputs for up to 30 days for abuse review; we have no zero-retention contract. Your photos are not training data. Your own API and MCP tokens are separate: any tool you connect with one, including an AI assistant, can read your roster, under your control and until you revoke the token.
Compliance posture
We list what we're aligned with today, what's in progress, and what's out of scope. No hand-waving.
SOC 2 Type II
Not yet started. We'll begin Type II evidence collection (Vanta or Drata) when a paying customer's contract requires it. At our current scale, a $30k+/yr audit is hard to justify before there's revenue to fund it. If you need an interim attestation, ask, and we'll discuss what we can offer in the meantime (security questionnaire, code-access audit, deployment topology).
GDPR / UK GDPR
We're a US company and your data is stored in the US. Our DPA covers GDPR Article 28 and includes the EU Standard Contractual Clauses and the UK transfer addendum; email us to sign it. We don't offer hosting in the EU.
HIPAA
BadgeBadger isn't designed to store Protected Health Information (PHI). If your use case involves health records on the badge (allergy or medication information, for example), talk to us first so we can scope a Business Associate Agreement before you upload anything.
FERPA
When a school engages BadgeBadger, we act as a “school official” with a legitimate educational interest under 34 CFR §99.31(a)(1). Education records are used only for the contracted service: designing, capturing, printing, and managing student ID cards. We don't disclose them to anyone outside the sub-processors below.
COPPA
For students under 13, we rely on the FTC's school-authorization exception (FTC, July 2014 guidance). The school authorizes data collection on parents' behalf, strictly for the educational service. We collect only the minimum data needed to print the badge.
State student-privacy laws
California SOPIPA, New York Education Law §2-d, Illinois SOPPA, Connecticut PA 16-189, and 20+ similar state statutes. The pledges above (no sale, no targeting, no profiling) cover the substantive requirements; the DPA covers the contractual ones.
Sub-processors
The complete list of vendors we send your data to. We notify you 30 days before adding a new sub-processor; existing customers can object and terminate without penalty if a new vendor doesn't meet your bar. One recipient isn't a vendor: a partner who referred you sees your organization's name, plan and payments, and never the people on your badges.
| Sub-processor | Purpose | Hosting | Compliance |
|---|---|---|---|
| Supabase | Authentication, primary Postgres database, photo + asset storage. | United States (AWS us-east-2) | SOC 2 Type II, HIPAA-ready BAA available |
| Railway | Web app hosting: the Next.js server, API routes, PDF rendering, and the SFTP server that passes roster files on to Amazon S3. | United States | SOC 2 Type II, SOC 3, GDPR DPA |
| Cloudflare | DNS, and forwarding the email you send to our help@ and hello@ addresses. | Global network | SOC 2 Type II, ISO 27001, GDPR DPA |
| Google (Gmail) | The mailbox that receives the email you send to our help@ and hello@ addresses, where we read and answer it. | United States | Google's standard terms. We have no separate agreement with Google. |
| Resend | Email: invitations, password resets, sign-in links, account alerts, and messages sent through our contact form. | United States | SOC 2 Type II, GDPR DPA |
| Polar | Subscription billing and payment processing. | United States (Stripe-backed) | PCI-DSS compliant via Stripe |
| Anthropic (AI features) | Vision-LLM calls for scan-a-card-to-template. Only invoked when an operator explicitly clicks an AI feature; never on every photo upload. | United States | SOC 2 Type II. Anthropic does not use API traffic to train models. Default API tier retains inputs for up to 30 days for trust-and-safety review; we don’t have a Zero Data Retention agreement (it’s an Enterprise contract). If you require ZDR before adoption, ask, and we’ll either disable the AI features for your organization or scope an Anthropic ZDR agreement into the contract. |
| Amazon Web Services (S3) | Roster sync only. Holds the nightly roster files your own systems upload until BadgeBadger applies them. Files are deleted once processed, and after 14 days at the latest. | United States (us-east-2) | SOC 2 Type II, ISO 27001, GDPR DPA |
| GitHub | Hosts the Print Agent installers and update files. Public release files only; no customer data is sent. | United States | SOC 2 Type II, ISO 27001 |
Your browser also downloads fonts and open-source tools directly from Google Fonts, jsDelivr, Google Cloud Storage and IMG.LY when you use the template editor and the photo tools. Those requests carry your IP address, like any web request, but no badge data or photos.
Operational guarantees
The boring-but-important stuff that protects you when things go sideways.
Encryption everywhere
TLS 1.2+ in transit, AES-256 at rest. Photos and PDFs stored in Supabase Storage with bucket-level RLS scoped to your organization.
Stored in the US
The database and files live in AWS us-east-2 (Supabase), roster files waiting to sync sit in Amazon S3 in us-east-2, and the app runs on Railway in the United States. We don't offer hosting in the EU.
Deletion on request
Email help@badgebadger.app to request an export or deletion. Deleting a person in the app removes their record and photos right away. An hourly cleanup removes anything left behind, such as replaced photos and old print files. When an account closes, we delete all of its records within 30 days, and we may close an account no one has signed in to for 12 months, after emailing its admins and waiting 30 days. The Privacy Policy has the full retention policy.
72-hour breach notification
If we detect a security incident affecting your data, we notify you within 72 hours of confirming the impact. The detection and escalation procedure is documented in our internal incident-response runbook; a copy is available under NDA.
Support access
Only BadgeBadger's founder has access to production systems. To fix a problem or answer a support request, we can sign in to your organization; anything changed that way is labeled BadgeBadger support in your audit log, and we keep our own log of every support session. We look at your data only to support you, to keep the service running, or when the law requires it.
Audit log
Template changes, changes to people, prints, imports and settings changes land in your organization's audit log, each entry with the IP address and browser type of whoever acted. Sign-ins and profile changes are logged to the account that made them. Admins can filter the log by action, record type, and date at Settings → Audit log. There's no CSV export yet. Photo-read auditing is on the roadmap: today we audit writes, not signed-URL reads on every photo view.
Who runs BadgeBadger
“I tried to print 30 staff IDs for an event and the desktop software I priced was $1,500 plus a USB dongle. Six weeks later I had this. The goal is the version that should have existed already: affordable, in your browser, and you'll never have to talk to a salesperson.”
Honest about where we are.
We're a small team. The pledges and operational guarantees on this page are the ones we keep today. The big-ticket vendor checklist items (a SOC 2 audit, a $2M+ cyber policy, a third-party pen test) haven't started yet. We plan to scope them with the first customer who needs them. Below is what we can offer in a contract conversation today.
- Draft DPA covering GDPR, plus FERPA, COPPA and state law for schools (counsel-reviewed before first signature)
- Schools can start from the SDPC NDPA v2; redlines reviewed within 5 business days
- Documented incident-response & deletion runbooks (available under NDA)
- SOC 2 Type II audit (not started) and cyber liability insurance (not in place yet), both scoped with you
What we can send today
DPA draft
Covers GDPR, FERPA, COPPA and state law. We'll counsel-review and counter-sign once a real contract is in motion.
Security questionnaire
CAIQ Lite + a written narrative of our controls.
Sub-processor list
Same one above, formatted as a CSV, with 30 days' notice before any change.
Runbook summaries
Incident response, data deletion and access review, under NDA on request.
Data Processing Agreement
We have a draft DPA that covers GDPR Article 28 for European customers, and FERPA, COPPA and the substantive provisions of US state student-privacy laws for schools. It's not a finalized template yet: counsel review is scoped to land before our first signed customer contract. Schools can start from the SDPC's National Data Privacy Agreement (v2), and we'll turn around redlines within five business days. Email help@badgebadger.app to start the conversation.
Common questions
Do you sell or share our data with anyone?
No. We don't sell your data, ever. We share data only with the sub-processors listed above, only for the specific purpose listed (hosting, billing, email delivery, AI features that you explicitly invoke), and only the minimum needed for that purpose. We have no advertising business, no data-broker relationships, and no plans to add either. The one exception to the list: if a partner such as a card printer dealer referred you, they see your organization's name, plan and payments so they can check their referral fee, and never the people on your badges.
Where is our data stored?
In the United States. Supabase stores the database and files in AWS us-east-2, roster files waiting to sync sit in Amazon S3 in us-east-2, and the app itself runs on Railway in the US. We don't offer hosting outside the US.
What happens to someone's data when they leave?
An admin can delete the person from their detail page or in bulk; their photo and its cropped and thumbnail copies are removed at the same time. Every file that names them goes in the same step, and an hourly cleanup removes leftovers such as replaced photos and old print files. When an account closes, we delete all of its records within 30 days, and we may close an account no one has signed in to for 12 months, after emailing its admins and waiting 30 days. The Privacy Policy has the full retention policy.
Do AI features train on our people's photos?
No. Anthropic does not use API traffic to train models; that's a contractual commitment under their API terms. Scan card, the only AI feature that sends anything to a third party, runs only when an operator starts a scan; background removal and face detection run in the browser. Important caveat about retention: Anthropic's default API tier retains inputs for up to 30 days for trust-and-safety review (abuse detection). We don't ship to the Zero Data Retention tier yet because it's an Enterprise contract that's not feasible at our current scale. If you require ZDR before adoption, ask, and we'll either disable AI features for your organization or scope an Anthropic ZDR agreement into the contract. Your own API and MCP tokens are separate: any tool you connect with one, including an AI assistant, can read your roster, under your control and until you revoke the token.
Are you GDPR-compliant?
We're a US company and we store data in the US. For European customers, our DPA covers GDPR Article 28 and includes the EU Standard Contractual Clauses and the UK addendum. We don't offer hosting in the EU.
What's your incident-response playbook?
If we confirm an incident that affects your data, we notify you within 72 hours, send a written post-incident report within 30 days, and keep you updated on the fixes until they're done. The DPA documents our exact obligations, and the full runbook is available under NDA.
Talk to a real person
Privacy questions, DPA redlines, security questionnaires, breach drills and audit requests all go to one inbox, and a person reads every message.