Skip to content

Data Processing & Subprocessors

Last updated: July 9, 2026

Pilot draft. This document is provided for informational purposes during the WinBin pilot and will be replaced by counsel-reviewed text before public launch.

This overview describes how WinBin processes personal data on behalf of venue and sponsor customers. It complements our Privacy Policy and the Trust & Privacy overview. A signed Data Processing Addendum is available to pilot customers on request.

Roles

  • WinBin as processor. For the limited data our customers direct us to handle (for example, a winner's email used to deliver a coupon), WinBin acts as a processor and uses that data only to provide the service.
  • WinBin as controller. For our own account and business records, and aggregate engagement statistics, WinBin acts as a controller.

What we process

  • Venue, sponsor, and admin account details (name, email, organization).
  • A winner's email address, collected only on a win to deliver a prize coupon.
  • Aggregate, non-identifying engagement data (scan, play, and redemption counts).

Participants are anonymous until they choose to claim a prize — see the Trust & Privacy overview.

Security

  • Encryption in transit, and access to dashboards scoped to authenticated accounts.
  • Prize coupons are cryptographically signed and single-use.
  • Emails are masked in our logs; we do not log raw request bodies or tokens.

Data location and transfers

WinBin is hosted in the United States. Where data is accessed from other regions, we rely on appropriate safeguards for any international transfer.

Subprocessors

We use the following subprocessors to run the service:

  • Amazon Web Services (AWS) — cloud hosting, database, authentication, content delivery, queues, and transactional email. United States.
  • Sentry — application error monitoring (technical diagnostics, with personal data scrubbed before it is sent). United States.

We will update this list and the date above before adding a new subprocessor. Customers can request notice of changes.

Data subject requests, return, and deletion

We assist customers in responding to requests from their users, and we return or delete customer data on request at the end of an engagement, subject to legal retention needs.

Contact

For a signed DPA or data questions: info@winbin.app or the contact form.