Privacy Policy

Workflow Corporation operates Promo Buddy. We trade as Radio Workflow HQ, at 210 Emerson Pl, Suite 300, Davenport, IA 52801, USA, on +1 (563) 275-6409.

Write to support@workflowcorp.comabout anything on this page and mark it for the attention of the privacy team. That is a real inbox that a person reads, which is why it is the only address here: a dedicated privacy alias that nobody watches is worse than a shared one that somebody does. Support is staffed 24/7; the office keeps Monday to Friday, 8:00 AM to 6:00 PM Central.

Two kinds of people appear in this product, and this policy is written for both. Account holders — the station staff who sign in — for whose account data Workflow Corporation is the controller. And listeners — contest entrants and winners, who usually have no account here — whose records belong to the workspace that runs the contest. The workspace controls its listener records; we process them on the workspace’s behalf to run the product. If a station awarded you a prize, the station decided what to record about you, and the station is the right first door to knock on; if you cannot reach them, knock on ours and we will help.

We have not appointed a data protection officer, and we have no representative in the EU or the UK. That is stated plainly rather than glossed over with a title nobody holds.

Account and workspace

• Your name, email address and a hash of your password. If you sign in with Google or GitHub we store the tokens that identity provider issues instead, plus the profile fields they return — including an avatar image URL if there is one.
• When you were created, when you last signed in, and whether your email has been verified.
• The workspaces you belong to and your role in each, plus the email address of anyone you invite.

The promotions record

• Promotions, prizes and their values, liner and imaging copy, run sheets for events — venue, contact name and phone, team notes — and the stations and sponsors they reference, including sponsor contact details your team enters.
• Listener records. Names, email addresses, phone numbers, postal addresses and notes, entered by your team or submitted by the listener through a winner link. These are the personal data of people who mostly have no account here, which is why the section above assigns responsibility for them explicitly.
• Winner records.Who won which prize, when, in what quantity, the prize’s per-unit value frozen at the moment of award, whether it was collected — and, where a winner link was used, the name the listener typed as a signature and the moment they signed. The frozen value exists so year-end tax totals cannot be rewritten by a later reprice.

Usage and technical data

• API request logs: method, path, status code, latency, IP address, user agent, error code, and which API key was used.
• An audit log of consequential actions — who awarded a prize, who archived a promotion, who deleted a winner record, who changed the plan — with the acting user and their IP address.

Billing

Card details never reach our servers. Your browser tokenises them directly with Authorize.Net, and what we store is two opaque profile identifiers plus four display facts: card brand, last four digits, expiry month and expiry year. We also keep a record of each charge — amount, plan, period, gateway transaction id, and any decline reason. There is no column in our database that could hold a card number or a security code.

Cookies

Session cookie

Keeps you signed in. Strictly necessary.

pb_org

Which workspace you are currently working in. Strictly necessary.

pb_lang

The interface language you chose. A preference, set only when you pick one.

pb_theme

Whether you chose the light theme. A preference, set only when you press the toggle.

Those are the only cookies this product sets, and there are no analytics or advertising cookies at all. There is no tag manager, no advertising pixel, no session-replay recorder and no third-party analytics SDK anywhere in the application. Nothing profiles you across sites, because there is nothing here that could. A listener opening a winner link gets the same deal: the page sets no tracking of any kind.

One exception, and it is deliberate: opening the card form on the billing page loads Authorize.Net’s own script from Authorize.Net. That is the mechanism described above — the script is what carries your card details to them instead of to us — and it loads nowhere else in the product.

When a workspace awards you a prize it can issue a winner link — a page at an unguessable address where you submit your own contact details and postal address and sign the prize release, instead of dictating them over the phone for somebody else to type.

• The page shows you the prize, the name of the station group, and their release text — and no other winner, listener or workspace data. There is nothing to browse from it.
• What you submit goes into that workspace’s listener record for you: the details you typed, the name you typed as a signature, and when you signed. The workspace controls that record from then on, like the rest of its listener database.
• The address itself is the credential — there is no password. The workspace can revoke a link at any time, and a revoked or wrong address answers a plain “not found”, never a page confirming what used to be there.
• Submitting is not consent to marketing, and there is no marketing for it to feed — see the email section below. It is the paperwork for a prize you already won, and nothing else.

• To run the service— keep the promotions record, compute the hub’s figures, serve the winner pages a workspace issues, produce its exports, and show it all back to the workspace.
• To bill — charge renewals, apply account credit, keep payment history and chase failed payments.
• To keep the platform safe — rate limiting, abuse and fraud investigation. This is what the IP addresses in the request and audit logs are for.
• To contact you — and there are exactly two messages this product can send: a workspace invitation, and a password reset you asked for. We send no marketing email at all— not to account holders, and not to the listeners in any workspace’s database. There is no mailing list and no campaign tooling; the listeners surface exports a CSV and that is the honest extent of it. A failed payment is not an exception: dunning is shown on the billing page, not mailed.

Where the law you live under requires a lawful basis to be named, these are ours, in the order above: performance of our contract with the workspace for running the service and for the two messages we send; performance of that contract plus our legal obligation to keep tax and accounting records, for billing; and our legitimate interest in a platform that is not used to defraud or harass people, for rate limiting, abuse investigation and the IP addresses the logs keep. Listener records are processed on the workspace’s instructions: the workspace is answerable for having collected them lawfully, and the Terms of Service hold it to that.

We use the following subprocessors, and this list is the whole list. There is no separate subprocessor page — we would rather keep one list right than two lists that disagree.

Google Cloud

Hosting: the application, the database that holds every record described above, and file storage. Our services run in the United States.

Authorize.Net

Card tokenisation, storage and charging. They hold the card; we hold an identifier and the last four digits. Setting a workspace up at the gateway also sends them the workspace name and the email address of its owner, so the charge has a customer record attached to it.

Resend

Transactional email. Receives the recipient address and the message — which, as above, is only ever a workspace invitation or a password reset. With no mail provider configured on a deployment, those are written to our own server log instead, so the address and the message, including a live password-reset link, sit in our infrastructure logs rather than going to a third party — and the sender is told the message was sent.

Google / GitHub

Only if you choose to sign in with them, as identity providers.

No listener record goes to any vendor above except as those entries state. Your listener database is not sent to an AI vendor, an advertising network, a data broker or anyone else — there is no integration in the product that could do it, which is a stronger promise than a policy choice: the CSV export you run yourself is the only way listener data leaves.

We also disclose data where the law requires it, and to professional advisers or an acquirer in a corporate transaction, subject to equivalent protection.

Everything we hold is stored and processed in the United States. If you are outside the United States, using Promo Buddy moves your data into it; where the law you live under requires a transfer mechanism for that, we rely on the standard contractual clauses.

No record is deleted automatically. Nothing you keep here expires on a timer. It stays until you or we delete it. That is a deliberate statement of fact, not an aspiration — no retention sweep over your records exists in the codebase, so promising one here would be false. The exceptions are technical, not content, and are listed at the end.

Promotions, prizes, stations, sponsors

Archived, not deleted. Archiving takes a record out of the working lists and frees its plan slot; the record and everything referencing it stay, so history keeps its meaning. There is deliberately no delete button for these.

Winner and event records

Deletable by an Admin, and each deletion writes an audit row saying who did it.

Listener records

Kept until the workspace edits or removes them. A listener with wins on record cannot be silently deleted — the database refuses, because the prize ledger and the tax totals read those rows — so the product offers anonymisation or archiving of the personal details instead, and the win history keeps its figures without the person.

Deleting a workspace

Removes its records — promotions, prizes, winners, listeners, liners, imaging, events, API keys, request logs and audit rows — by database cascade. A handful of audit rows written after an account is closed belong to no workspace and stay.

Billing records

Payment and subscription rows belong to the workspace and are deleted with it. What we keep after that is the accounting record of the charge, which we hold for seven yearsto meet US tax record-keeping requirements: the amount, the date, the plan, the last four digits and the gateway’s reference. Never a card number — there is no column that could hold one.

Backups and infrastructure logs

Deleted is not instantly unrecoverable.Database backups are kept on a rolling window of days, so a deleted row can survive in a backup until the last one containing it ages out — the honest answer to “when is it really gone” is roughly a week. The server’s own console output goes to our hosting provider’s logging and ages out there; it is operational logging, not a copy of your records.

What you can do yourself

• Edit or remove a listener record — the listeners surface, for any Member and above. This is the ordinary path for a correction a listener asks the station for.
• Delete a winner or event record — Admin and above, logged when it happens.
• Export the audience — the listener database exports as CSV, so the record is portable rather than captive.
• Delete a workspace— Settings › Workspace. Owner only. This removes the records described in the retention section.
• Delete your account— Settings › Account, at /settings/account. It works even if you have already deleted your last workspace. If you are the last owner of a workspace that still has other members, hand ownership over first — we will not strand other people’s work or leave a workspace nobody can bill.
• Revoke an API key at any time.

Deleting your account does not delete the workspace records you created inside a workspace that survives you. Promotions and winner records stay with the workspace that ran them and simply lose their author.

If you are a listener

The station group that recorded you controls that record, so ask them first — they can correct, anonymise or remove it in the console. If you cannot reach them or they do not answer, email support@workflowcorp.com, marked for the attention of the privacy team, with the station’s name and what you were told when you won; we will locate the workspace and put the request to it, and where the law requires more of us than passing a message, we will do what it requires.

Rights, and how we answer

Depending on where you live you may have rights to access, correct, delete, port or object to the processing of your personal data, and to complain to a regulator — in the United States that is generally your state attorney general. We do not require you to be covered by any particular law to ask: we answer every request the same way, whoever sends it, because sorting people by which statute protects them costs more than simply doing the work.

We will answer within 30 daysof a request we can verify. Verification is deliberately low-friction and does not involve sending us identity documents: for account matters, send the request from the email address on the account; for workspace-wide matters, be an owner or admin of that workspace. If we cannot match a request to a record we will say so rather than guess — handing one person another person’s address is the failure that matters most in a product full of winners’ home addresses.

• Passwords are hashed. API keys are hashed at rest and shown once, at creation, so a stolen database does not yield working keys.
• Every query against workspace data filters on the workspace, and winner links are unguessable tokens that answer “not found” to anything that misses — never a hint that a record exists.
• Card data never touches our servers.

No system is perfectly secure. If personal data of yours is breached we will tell the affected customers without undue delay, and within 72 hours of becoming aware of it — with what we know at the time, rather than waiting until we have a complete picture, because a late complete answer is worse than an early partial one for anyone who has to act on it. Where the breach involves listener records, the workspace that controls them is who we tell first, because they hold the relationship with the people affected. Where the law also requires us to notify a regulator, we will.

Report a vulnerability to support@workflowcorp.com with “security” in the subject line. We will acknowledge it within two business days. We do not run a bug bounty and have no money to offer, but we will credit you if you want the credit and keep you out of it if you do not.

Accounts are for adults: you must be 18 or older to hold one, because the service takes card payments and holds other people’s personal data, and neither is something to do on a child’s say-so.

Listener records are a separate question. Whether a minor may enter a given contest is the station’s rules and the law where it runs — not something this product decides — and we do not knowingly keep records about children beyond what a workspace lawfully enters. If you believe a child’s data is in a workspace and should not be, tell the station, or write to support@workflowcorp.com and we will take it up with them.

Updates are posted here, and the date at the top of the page is when the version you are reading took effect. For a material change — a new purpose, a new subprocessor, a longer retention period — the new version goes up at least 30 days before it takes effect, so there is time to read it and to leave if you do not like it.

We deliberately do not promise to email you about it. As set out above, this product sends two kinds of message and neither is an announcement; a commitment we have built no way to keep is not worth writing down. Checking this page is the mechanism.