Privacy Policy
Version: cruz-privacy-v1. Publication location: https://www.cruzcasinoentertainment.com/privacy. This document takes effect only upon separately authorized publication. Publication verification and its UTC observation time are recorded in a separate immutable release receipt. Collection, staff access, invitations and notification delivery remain separately gated. Preparation or approval of this document is not personal acceptance.
1. Who we are and what this policy covers
Jory Cross, doing business as Cruz Casino Entertainment, provides mobile casino entertainment and event-planning information. This policy describes the prepared handling of account-free quote requests and private staff access to those requests. References below to a prepared feature describe how that feature is designed to work if separately approved and activated; they do not mean it is available now.
You would not need a customer account to request a quote. Customer signup, customer accounts and invitations are outside this release. A quote request would not book an event or start a payment transaction.
Jory Cross is the proposed accountable owner for privacy and retention and is the sole privacy contact for now; no backup is assigned. The privacy mailbox is admin@cruzcasinoentertainment.com. Jory Cross has confirmed that he personally monitors it and reports that receipt and reply have been checked. This is owner-reported verification, not independent verification of a complete request-handling or escalation procedure. The owner-approved business procedure is to log each privacy request, verify identity before sharing or changing personal information, check any retention or legal holds, and respond within the applicable deadline. Uncertain legal issues are referred to the legal team; deletion is not promised until verified. Approval of this business procedure does not establish its implementation or independent verification, interpret applicable legal deadlines, or authorize automation, disclosure, changes to personal information or deletion. Retention controls remain uninstalled and disabled.
2. Information in a quote request
The prepared form requires your name, email address, phone number, event type, event date, city, approximate guest count, requested duration and games or services. Contact preference, venue name and planning notes are optional. Please provide a venue name and city only; a street address is not requested for this stage.
Please do not enter passwords, authentication or recovery codes, payment or bank information, government identification numbers, or unnecessary medical or other sensitive information. Keep planning notes limited to information needed to discuss the event. This warning also applies to optional free-text fields.
The form does not request payment details, contracts, signatures or document uploads. It has no separate budget, organization or venue-setting field. Information needed for any later event agreement would require its own approved process.
The proposed service is for adults arranging events. That does not mean every event is restricted to adult attendees. Final age-related wording and handling of any information received about children remain subject to legal review.
3. What happens when you use the prepared form
Typing keeps the form information in the page's working memory. The application does not autosave a planning draft to its servers or put the form fields in browser storage merely because you type. This describes application behavior, not a guarantee about a browser's own features.
If submission is separately enabled, pressing Submit sends the form information to the application for validation and retry preparation. That preparation step does not insert a quote record. The subsequent submission can save the validated request after the required checks pass. A failed or incomplete attempt may still involve processing by hosting and security services even if no quote record is created.
For an accepted request, the prepared database record includes the normalized form information, a request reference, the exact Privacy Policy identity acknowledged with the request and a server-recorded submission time. A privacy acknowledgment is required by the prepared flow. It is not a customer account or a separate record of accepting the Terms. Legal review must determine the appropriate notice, acknowledgment or consent wording before activation.
To make retries safer, the application uses browser session storage for one opaque, signed retry token. It does not store the form fields or the Turnstile challenge token there. The retry token is linked to the submission through technical identifiers and a keyed binding, so it should not be described as anonymous. Its permission to submit a new write lasts 24 hours; its status-reconciliation validity lasts seven days. Those are validity limits, not automatic deletion deadlines. Browser session behavior or an explicit accepted reset controls removal of the stored token; expiry on the server does not itself clear browser storage.
4. Purposes and service providers
The proposed business purposes are to discuss event requests and options, communicate about the requested service, maintain relevant event-planning history and protect the service from misuse. The selected scope does not authorize advertising use of quote data, marketing email or SMS, or customer-data analytics. A required phone field does not itself authorize marketing text messages.
The prepared service uses these providers:
| Provider | Role and information involved |
|---|---|
| Vercel | Hosts the application and receives browser and server requests. Hosting and security systems may process connection and request metadata. This policy does not assert that hosting logs contain no IP addresses or establish a verified log-retention period. |
| Cloudflare Turnstile | Helps assess abusive or automated activity. Once the widget is enabled and loads, the browser connects to Cloudflare, which can process IP addresses and browser/connection signals before a form is submitted. Cloudflare documents signals including TLS fingerprint, User-Agent, sitekey and origin. It distinguishes processing to protect the website from processing to improve Turnstile. |
| Upstash Redis | Holds short-lived rate-limit counters under keyed identifiers derived from a validated request IP address. The application does not put the raw IP address or quote fields into those counter keys. These identifiers are pseudonymous, not established to be anonymous. Upstash can also receive server-request metadata. |
| Supabase | Stores accepted quote records in the protected database and supports separately authorized private staff authentication and access. Quote records can include contact details, event information, optional notes and the submission/policy evidence described above. |
| Resend | If internal notification delivery is separately authorized, sends staff a generic new-request alert containing the quote reference and an instruction to open the admin area. The prepared alert does not include the requester's name, email, phone or event notes. Resend still processes sender and recipient addresses, the reference and delivery metadata. The reference can be linked to a quote by authorized staff. |
The application's Turnstile verification request does not send Cloudflare the optional remoteip parameter. That does not prevent Cloudflare from receiving the browser's IP address through the widget. No assertion that Turnstile processes only anonymous data is made here.
The Redis counter expires 60 seconds after its first increment; later increments in that bucket do not extend that expiry. Preparation, submission and status reconciliation use separate rate-limiting buckets. Expiry of a live counter does not establish deletion of provider logs or backups.
The initial account-free quote release uses private staff review and manual follow-up. Internal notification delivery remains separately gated. A delivery failure does not undo a saved quote. The prepared quote-only flow does not send a customer invitation or create a customer account. It does not establish an automatic notification retry or deletion service.
The website includes a separately approved, limited Google Analytics 4 page-view implementation. It can load only when the application identifies the deployment as public production and a measurement ID is configured. Its public route allowlist includes /privacy, /terms and /quote; therefore a visit to the quote page can be measured even while quote submission remains disabled. Private staff and customer account routes are excluded from this allowlist. This describes source behavior, not verification that analytics is currently configured or running in production.
The application constructs page-view events with the page title, allowlisted pathname and sanitized URL origin plus pathname. It adds a rebuilt campaign query only for exact approved organic attribution from Facebook, Instagram, or LinkedIn: utm_source must be facebook, instagram or linkedin, utm_medium must be social, and utm_campaign must be organic. Each must occur exactly once; unapproved additional utm_ keys invalidate attribution. Raw query strings, fragments and unapproved values are excluded from this constructed payload, and its referrer field is blanked rather than copied from the raw browser referrer.
The application does not add quote fields or other customer-provided content to Google Analytics page-view events. Automatic page views from the configuration call are disabled; Google signals and ad personalization are disabled in this configuration. Google advertising storage and advertising-user-data permissions default to denied. These application settings do not establish that all provider processing or cookies are absent. Google may process connection metadata when its script loads. Property-level settings, including Enhanced Measurement history events, and any applicable notice or consent requirements require verification before an effective release. This policy does not authorize new analytics, advertising or customer-data uses.
5. Private staff access and security
Private staff access is a separate, approval-gated function. The prepared authentication and access controls use staff account identity, credentials and session information, an active staff profile and role, and records identifying the Terms and Privacy versions accepted or acknowledged with a server-recorded time. Account-free visitors do not receive staff access.
The implementation includes protected database access and server-side validation. These controls do not guarantee that information can never be lost, misused or accessed improperly. A staff account, privilege grant or invitation cannot be inferred from submitting a quote or from approving these documents.
6. Retention — owner decisions and remaining proposals
The owner has approved the quote-history rule described below; the other periods remain previously recorded proposals. The general retention schedule below does not establish effective retention promises or verified deletion controls. Retention controls remain uninstalled and disabled, and no quote-deletion scheduler is enabled. The final notice must state only periods and actions that the business can support.
| Proposed category | Proposed period |
|---|---|
| Quote history, including initial quote planning notes | Owner-approved rule, not yet effective: 36 calendar months from submission, reset only by substantive activity on that same quote. Views, retries, status polls and unrelated customer activity do not reset the period. Review weekly; process ordinary expiry within 30 days. |
| Follow-up free text | Eighteen months after the last follow-up message |
| Accounts and invitations | While active, then 30 days after account closure or invitation expiry; customer accounts/invitations remain deferred |
| Security and audit records | One year |
| Abuse-prevention records | Thirty days after the relevant event; this does not lengthen the prepared Redis counter's 60-second lifetime |
| Notification delivery logs | Ninety days after the final delivery attempt |
| Rolling backups | Thirty-five days from backup creation |
| Minimal privacy-request completion evidence | Three years after request closure |
Initial quote planning notes are included in the quote-history category above. Staff-only retention — owner-approved draft business periods: Access is to be disabled and session access revoked immediately when staff authorization ends. Ordinary staff app account and profile data is to be deleted within 30 days after account closure. Separate minimal evidence of Terms acceptance and Privacy acknowledgment is to be retained for six years after account closure, limited to the staff identifier and only necessary identity information, the acceptance or acknowledgment timestamp, exact document versions, the method and the closure date. Preserve the exact document versions. The evidence archive must exclude passwords, tokens and full profiles. Preserve relevant records for legal holds or applicable obligations until released. This schedule does not extend to or change client, payroll, tax or personnel records, or existing client retention. These are owner-approved draft business periods, not statutory deadlines or proof of counsel approval, implemented deletion, automation or backup erasure. Retention controls remain uninstalled and disabled. The later-message retention clock remains deferred; the follow-up free-text row remains a proposal, not an approved operational rule. The application, providers, email mailbox copies, backups and historical recovery artifacts do not necessarily share one retention mechanism. No provider-wide deletion or backup-expiry guarantee has been verified for these periods; the proposed 35-day backup period remains unverified.
The proposed process would limit a documented preservation hold to affected records where needed for a legal, security, insurance, tax, contract, dispute or preservation reason. It would reapply completed deletions following a restore. Both the grounds and the procedure require review before use. The proposed minimal completion record would contain the category, rule, date, operator, hash or count, hold status and outcome, rather than a copy of deleted content.
7. Privacy questions and requests
The selected contact for privacy questions and requests is admin@cruzcasinoentertainment.com. Jory Cross is the sole privacy contact for now; no backup is assigned. He has confirmed that he personally monitors this mailbox and reports that receipt and reply have been checked. This is owner-reported verification, not independent verification of a complete request-handling or escalation procedure. Do not send passwords, recovery codes or sensitive identification documents by ordinary email.
The owner-approved business procedure is to log each privacy request, verify identity before sharing or changing personal information, check any retention or legal holds, and respond within the applicable deadline. Uncertain legal issues are referred to the legal team; deletion is not promised until verified. Approval of this business procedure does not establish its implementation or independent verification, interpret applicable legal deadlines, or authorize automation, disclosure, changes to personal information or deletion. Retention controls remain uninstalled and disabled. Applicable rights, verification requirements and response deadlines need legal review; this policy does not invent a universal entitlement, exception or fixed response time. Any later authorized correction, deletion, redaction or pseudonymization must use an approved procedure, locate the relevant records, assess preservation needs and retain minimal completion evidence; approval of this business procedure is not authorization to perform those actions.
8. Finalization and changes
The release version is identified above. This notice takes effect only upon separately authorized publication, with publication verification and its UTC observation time recorded in a separate immutable release receipt. This does not assert independently verified provider practices, automated retention controls or new legal approval. Older versions and changes would need an approved availability process. Policy approval alone would not activate collection, staff accounts or notifications.