Privacy Policy

1. Scope

Funktastic Labs LLC is an Arizona limited liability company that operates Coqui (“Coqui,” “we,” “us,” or “our”). This Privacy Policy applies to Coqui's public website, mobile experience, QR-powered venue rooms, Corporate Admin tools, Venue Owner Portal, email communications, and related services (the “Service”). It does not govern a venue's activities outside Coqui or third-party sites and services that have their own privacy notices.

2. Information we collect

Business applications and venue accounts

• business or venue name, business type, website or social page, role, rollout notes, and expected locations or QR rooms;
• contact name, email address, phone number, country, state or province, and city or town;
• email-verification, application, approval, billing-readiness, and account status;
• your authorization confirmation and the accepted Terms/Privacy versions and acceptance time; and
• account credentials in hashed form, session information, password-reset events, staff roles, and security/audit history.

Spaces, QR rooms, and venue operations

• space and room names, addresses, coordinates, configured geofence radius, hours, QR tokens, room status, and scan/check-in activity;
• host messages, chat controls, events, images, promotions, offer terms, surveys, and venue-supplied links; and
• operational and engagement summaries such as room entries, offer views or redemptions, event interest, survey completion, and feedback trends.

Guest and mobile activity

• an installation- or device-scoped identifier, a temporary Coqui room name, selected preferences, and optional 18+ mingle status;
• the QR room entered, join/leave and presence timestamps, messages, reports, mutes, and moderation signals;
• event-interest choices, offer views/presentation/redemption activity, ratings, survey answers, and optional written feedback; and
• device, app, network, IP address, request, error, and security-log information needed to deliver and protect the Service.

Location information

When you try to enter a room, the mobile app requests device location to check whether you are within the venue's configured boundary. The current production design uses that location for the eligibility check and does not store a guest's raw latitude and longitude in the check-in record. We may retain the room or venue identifier, a device-derived hash, the result of the check, and related timestamps. Venue addresses, coordinates, and boundaries are stored so the room can operate.

Payments

Stripe collects and processes payment methods and financial credentials. Coqui receives limited billing information such as a Stripe customer reference, subscription/payment state, plan, invoice status, billing contact, and supported transaction details. Coqui does not store full card or bank-account credentials.

3. How we collect information

We collect information directly from applicants, venue teams, and guests; automatically when devices and browsers use the Service; from QR and proximity interactions; from authorized venue administrators; and from providers such as Stripe, Resend, hosting, and address/geocoding services. We may also review public business information to verify a venue application or investigate misuse.

4. Why we use information

• provide QR entry, location eligibility, live rooms, events, offers, surveys, feedback, and venue tools;
• create and secure accounts, verify email and businesses, process space requests, and provide support;
• process billing and apply plan, complimentary-access, pause, and activation rules;
• prevent duplicate names, spam, review bombing, fraud, security incidents, and other abuse;
• moderate content, investigate reports, enforce our Terms, and protect guests, venues, Coqui, and the public;
• send transactional messages, including verification, password reset, account, billing, and service notices;
• measure reliability and venue engagement and improve the Service; and
• comply with law, legal process, tax/accounting duties, and valid government requests.

5. When information is disclosed

• Other room participants. Your temporary name, messages, timestamps, and any status you choose to show may be visible in the room.
• The venue. Authorized venue staff can see and manage their rooms, messages, reports, event interest, offer activity, feedback, and survey results. Survey responses are anonymous by default unless the survey clearly requests identifying information.
• Coqui administrators. Authorized personnel can access information needed for support, safety, billing, security, approval, and platform operations.
• Service providers. We use providers such as Railway for hosting and databases, Resend for transactional email, Stripe for billing, and OpenStreetMap/Nominatim-compatible services for address lookup. They process information for us under their own terms and contractual or operational restrictions.
• Legal and safety needs. We may disclose information when reasonably necessary to comply with law, protect rights and safety, investigate fraud or abuse, or respond to legal process.
• Business changes. Information may transfer as part of a financing, merger, acquisition, reorganization, or sale, subject to appropriate confidentiality protections and applicable law.

Coqui does not sell personal information for money and does not share personal information for cross-context behavioral advertising. We do not use third-party ad networks in the current Service.

6. Cookies, local storage, and tracking signals

Coqui uses essential cookies or similar browser/device storage for authenticated sessions, security, form and preference state, installation-scoped identifiers, and viewed/completed offer or feedback state. We do not currently use advertising cookies or track people across unrelated websites for targeted advertising.

Because browsers do not apply a single uniform “Do Not Track” standard, the Service does not currently respond differently to Do Not Track signals. Since we do not sell or share personal information for targeted advertising, a Global Privacy Control signal does not change that practice. We will honor legally required signals if our practices change.

7. Retention

We retain information for as long as reasonably necessary to provide the Service, maintain account and QR-room history, honor venue and guest controls, resolve disputes, prevent fraud and repeat abuse, satisfy billing/tax/audit obligations, and comply with law. Retention varies by record type. For example, a live message may be removed when a venue clears a room, while security, consent, payment, moderation, and audit records may be kept longer. Backups and legal holds may delay deletion. We will establish and document shorter automated schedules as production operations mature.

8. Your choices and privacy requests

You may:

• decline location permission, although you will not be able to pass location-gated room entry;
• leave a room, disable optional mingle status, or avoid submitting optional feedback;
• update venue profile and account details through available portal controls;
• request access to, correction of, or deletion of personal information associated with you; and
• object to or restrict certain processing where applicable law provides that right.

Send a request to the address below. Describe the account, venue, device, or room activity involved. We may need to verify your identity and authority before acting. Some information may be retained or excluded when needed for security, legal compliance, billing, freedom of expression, or the rights of others. We will not discriminate against you for exercising applicable privacy rights.

9. Security

We use administrative, technical, and physical safeguards appropriate to the nature of the information, including access controls, scoped venue authorization, hashed passwords and device identifiers where applicable, encrypted transport, audit records, and provider security controls. No system is completely secure. If a security incident affects information in a way that requires notice, we will investigate and provide legally required notifications.

10. Children and age-restricted features

Coqui is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child under 13 used the Service, contact us so we can investigate and delete applicable information. Users ages 13 through 17 may use general venue features only with parent or guardian permission and subject to venue rules. Single or mingle features are limited to adults age 18 or older.

11. U.S. processing and visitors outside the United States

Coqui is operated from the United States. Information may be processed and stored in the United States and other places where our providers operate. If you use the Service from another country, its data-protection laws may differ from those in your country. A separate regional notice or agreement may apply before Coqui launches broadly in a jurisdiction with additional requirements.

12. Changes to this Policy

We may update this Policy as the Service, providers, or law changes. We will post the revised effective date and provide additional notice when a change materially affects how we use personal information or when law requires it. Prior versions and the version accepted with a venue application may be retained for compliance and audit purposes.