Scratchy — Privacy Policy

Scratchy, Inc. (“Scratchy,” “we,” “us”) makes hardware and software that help retailers catch lottery ticket theft. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have.

It applies to our website at scratchy.ai, the Scratchy dashboard at app.scratchy.ai, Scratchy devices installed in stores, and the notifications we send, including text messages (together, the “Services”). Your use of the Services is also governed by our Terms of Service.

Scratchy is built for businesses. Our customers are store owners and operators, and the people they invite to help run their stores. We don’t offer the Services to consumers or lottery players.

Information we collect

Information you give us

Account information. Your name, email address and sign-in details. Sign-in is handled by our authentication provider, Clerk. We never see or store your password.
Store information. Store names, locations, time zones and store contact details (name, email address and phone number).
Team information. The email addresses of people you invite to a store, and who invited them.
Employee information. Names, and initials or register codes, of employees you add, plus the shifts they’re assigned to. These appear on shift ledgers.
Notification settings. An alternate email address, Pushover user key, mobile phone number and whether it has been verified, quiet hours, time zone, and which alerts you receive on which channel.
Lottery reports. Reports you upload, or forward to your store’s Scratchy report address, such as California Lottery retailer reports. When you forward a report email, we read it to find the report’s download link, and we download the report from that link.
Waitlist sign-ups and messages. If you join our waitlist, we collect your name, email address, phone number, state and number of stores. We also keep messages you send us.

Information collected by Scratchy devices

Scratchy devices sit between a barcode scanner and the register or lottery terminal it’s connected to. They collect:

Lottery ticket scans. For each ticket scanned at a register or lottery terminal: the ticket’s barcode (game, pack and ticket number), the time, the device, and the result, such as sold, cashed, blocked or passed through.
Register scans in pass-through mode. Normally a device checks each register scan on the device itself, and scans that aren’t lottery tickets go straight to the register without being sent to us. If you turn on POS pass-through for a device, every barcode scanned at that register is sent to us and recorded. That can include merchandise barcodes and anything else scanned there, such as loyalty cards or ID barcodes scanned for age verification.
Device information. Hardware serial number, software version, the IP address the device connects from, connection status and check-in times, clock accuracy, the number of scans waiting to upload, and how the device is connected to its terminal.
Diagnostics. If you or our support team run diagnostics on a device, it sends us its recent log lines. Device credentials are removed from these logs before they’re sent.

Scratchy devices only see barcode scans. They don’t read payment cards, record video or audio, or identify store customers.

Information collected automatically

Server logs. When you use the dashboard or our website, our servers record technical details such as your IP address, browser type, the pages or features requested and the time of each request.
Cookies and local storage. Clerk sets cookies that keep you signed in. We use your browser’s local storage to remember preferences, such as your color theme and the store you last selected. We don’t use advertising cookies or third-party analytics trackers.
Fonts. Our website and dashboard load fonts from Google Fonts, so Google receives your IP address and browser details when a page loads.

How we use information

We use information to:

Run the Services: record ticket sales and cash-outs, track packs and inventory, detect sequence gaps and theft, raise alerts, build shift ledgers, import lottery reports, and keep devices connected and up to date.
Send the notifications you choose, in the dashboard and by email, Pushover or text message.
Send account and service messages, such as team invitations, security notices and updates to our terms.
Provide support, troubleshoot devices and investigate problems you report.
Protect the Services, our customers and Scratchy, including detecting misuse and securing accounts and devices.
Improve the Services, using aggregated or de-identified information where we can.
Contact people on our waitlist about Scratchy’s availability.
Comply with the law and enforce our Terms of Service.

We don’t sell personal information, and we don’t use it for targeted advertising.

Text messages

If you add a mobile number in your notification settings, check the consent box and verify the number, Scratchy will send you automated text alerts about your stores, such as theft, inventory, device and shift alerts. You choose which alerts come by text.

Message frequency varies with activity at your stores.
Message and data rates may apply.
Consent to receive text messages is not a condition of purchase.
Reply STOP to any message to opt out, or turn SMS off in your notification settings. Reply HELP for help, or email hello@scratchy.ai.
Carriers are not liable for delayed or undelivered messages.

We only text numbers that have opted in through the dashboard. We don’t send marketing text messages, and we don’t text phone numbers submitted through our waitlist or entered as store contact details.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as the provider that delivers our text messages, is permitted. All other categories of sharing in this policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

With your team. Everyone you invite to a store sees the same information about that store as its owner, including alerts, inventory, activity, devices and employee names.
Between stores, for cross-store theft alerts. To catch tickets taken from one store and cashed at another, we compare ticket records across all stores that use Scratchy, including stores run by other businesses. If a ticket from your inventory is cashed at another Scratchy store without being sold, we tell you the ticket number and the name of the store where it was cashed, and we tell that store the ticket number and your store’s name. We don’t share anything else about your business with that store.
With service providers. We use other companies to run parts of the Services. They may use the information only to provide services to us. They include:
- Clerk, for sign-in and account management
- Cloud hosting and database providers, which store and process data for the Services
- Twilio, for text messages
- Pushover, for push notifications you set up
- Our email delivery provider, for email notifications and invitations
- Resend, for receiving the lottery report emails you forward to us
- Inngest, for background jobs such as report imports and shift ledgers
- Google, which receives our waitlist sign-ups and serves our web fonts
With destinations you choose. If you connect a webhook or another integration, we send it the information you configured.
For legal reasons. We may disclose information if we believe in good faith that the law requires it, or that it’s needed to protect the rights, property or safety of Scratchy, our customers or others. We don’t give information to lottery authorities or law enforcement unless the law requires it or you ask us to.
In a business transfer. If Scratchy is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, and it will remain subject to this policy.
With your consent. We may share information for other purposes when you ask us to.

Store data and your employees

The information you and your devices put into the Services, such as scans, store records, employee names and shift records, belongs to you. We process it on your behalf, following your instructions, our Terms of Service and this policy.

If you work at a store that uses Scratchy, your employer controls the information about you in Scratchy. Please send questions and requests about it to your employer. If you contact us instead, we’ll pass your request on to them.

How long we keep information

Account and store data is kept while your account is active. When you close your account, we delete or de-identify it within 90 days, except for anything we must keep for legal, security, billing or dispute reasons.
Lottery report emails and files are stored encrypted and deleted 90 days after we receive them. The ticket and pack records we extract from them stay with your store’s data.
Server and device logs are kept only as long as we need them to operate and secure the Services.
Waitlist sign-ups are kept until you ask us to remove them or we no longer need them to contact you.

How we protect information

We use administrative, technical and physical safeguards suited to the information we handle. For example:

Data is encrypted in transit between your browser, Scratchy devices and our servers.
Each device has its own secret credential, and we store only a hashed form of it.
Lottery report emails and files are encrypted at rest.
Access to a store is limited to the people its owner has invited.

No system is completely secure. If we learn of a security incident that affects your information, we’ll notify you as the law requires.

Your choices and rights

Review and update. You can view and change your account, store, team and notification settings in the dashboard at any time.
Notifications. Choose which alerts you get on each channel in Settings › Notifications. Reply STOP to any text message to stop texts.
Access, correction and deletion. You can ask for a copy of your personal information, or ask us to correct or delete it, by emailing hello@scratchy.ai. We’ll confirm your identity before acting on a request and respond within 45 days.
Waitlist. Email us to be removed from the waitlist.

California residents

If you live in California, the California Consumer Privacy Act gives you the right to know what personal information we collect, use and disclose; to get a copy of it; to ask us to correct or delete it; and to opt out of its sale or sharing for cross-context behavioral advertising. We don’t sell personal information or share it for cross-context behavioral advertising. We won’t discriminate against you for exercising these rights. You can make a request yourself, or through an authorized agent, by emailing hello@scratchy.ai.

In the past 12 months we have collected these categories of personal information: identifiers (such as name, email address, phone number and IP address); commercial information (such as lottery ticket sale and cash-out records); internet or network activity (such as server logs); and professional or employment-related information (such as employee names and shift assignments). We collect them from the sources, use them for the purposes and disclose them to the recipients described in this policy.

Children

The Services are for businesses and aren’t directed to anyone under 18. We don’t knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we’ll delete it.

Where information is processed

Scratchy is based in the United States, and we store and process information in the United States.

Changes to this policy

We may update this policy from time to time. We’ll post the new version on this page and change the effective date. If we make a material change, we’ll tell you by email or in the dashboard before it takes effect.

Contact us

For questions or requests about this policy or your information, email hello@scratchy.ai.

Scratchy, Inc.