Privacy Policy
This policy explains what information Rollster collects, why, and what you can do about it. This policy is drafted with Mexico's Federal Law on Protection of Personal Data Held by Private Parties (Ley Federal de Protección de Datos Personales en Posesión de los Particulares, LFPDPPP) in mind, since Rollster operates under Mexican law. It applies to two different kinds of people, and it's worth telling them apart up front:
- Organizers — the people who create a Rollster account, register their organization, and run events.
- Participants — the people an organizer registers for an event (students, attendees, trainees). Participants don't create a Rollster account; their data is added by the organizer.
1. Who is responsible for your data
For data Rollster collects directly — organizer account details, billing, and support requests — the party responsible for processing (the "responsable del tratamiento" under Mexican law) is Cristian Jesús Torres Pacheco, operating Rollster as an individual professional. Requests about this data, or about exercising your rights under Section 10, go to legal@cjesustp.com.
2. What we collect
From organizers: organization name, your name and email, a password (stored as a one-way hash, never in plain text) or a Google account identifier if you sign in with Google, and billing information when you subscribe (handled by our payment processor — see Section 5).
From organizers, about their participants: whatever the organizer provides when registering someone for an event — typically first and last name, email, phone, institution, and registration type. This is uploaded by the organizer, either one at a time or via a spreadsheet import.
Automatically: check-in records (when, how, and for which session someone checked in), and basic technical data (IP address, browser type) kept in server logs for security and troubleshooting.
3. Who controls participant data
For participant data, the organizer is the data controller and Rollster is the data processor. In plain terms: the organizer decides whose data to upload and why, and is responsible for having the right to do so (for example, informing their students or attendees that a check-in system is being used). Rollster's job is to store and process that data correctly, securely, and only to provide the service — not to use it for anything else.
If you're a participant and have a question about your own data, the fastest path is to contact the organizer who registered you — they can view, correct, or delete your record from their dashboard. If you can't reach them, contact us using the details in Section 10 and we'll help route the request.
4. How we use what we collect
- To operate the check-in and reporting features you're using the service for.
- To send participants their registration badge (a PDF with a personal QR code) by email.
- To authenticate organizer accounts and keep them secure.
- To process subscription and one-time event-pass payments.
- To respond to support requests.
- To detect abuse of the platform — for example, repeated failed check-in attempts against a session's rotating venue code.
We don't sell personal data, and we don't use participant data to advertise to anyone.
5. Who we share data with
We share data only with the third parties that help us run the service, and only the minimum needed:
- Payment processor — handles subscription and event-pass payments directly. Rollster never receives or stores full card numbers.
- Email delivery provider — sends registration badges and account emails on our behalf.
We don't share data with anyone else unless required by law, or with your explicit consent.
6. How long we keep it
Organizer account data is kept for as long as the account is active. Participant and check-in data is kept for as long as the organizer's event remains in the system, so reports stay available; an organizer can delete a participant from their roster at any time. If an organizer account is closed, associated data is deleted within a reasonable period, except where we're required to retain billing records for tax or accounting purposes.
7. Security
Passwords are hashed, never stored or logged in plain text. Database access uses parameterized queries to prevent injection. Staff devices authenticate with scoped, revocable bearer tokens rather than sharing an organizer's login. No system is perfectly secure, but we design every new feature with these baselines in mind.
8. Cookies
Rollster uses a single session cookie to keep you logged in, plus cookies set by our payment processor during checkout and by Google during sign-in. We don't use advertising or analytics cookies. See the Cookie Policy for the full detail.
9. Children's data
Rollster is often used in schools, where participants may be minors. Rollster itself is intended for use by adult organizers; if an organizer registers minors as participants, it's the organizer's responsibility — as the data controller — to ensure that's done in line with their institution's policies and applicable law (for example, obtaining any consent required from a parent, guardian, or the institution itself).
10. Your rights, and how to reach us
Under the LFPDPPP, you have what's commonly called ARCO rights over your personal data:
- Access — know what personal data we hold about you and how it's used.
- Rectification — correct data that's inaccurate or incomplete.
- Cancellation — request that your data be deleted when it's no longer necessary for the purposes it was collected for.
- Opposition — object to a specific use of your data where the law allows it.
You can also revoke a consent you previously gave, where the processing was based on that consent. Organizers can exercise most of these rights directly from their dashboard (editing or deleting a participant, closing their own account). For anything else — including a participant request routed through us, or a request involving data we hold directly as described in Section 1 — contact legal@cjesustp.com with enough detail to identify you and what you're requesting; we may ask for information to confirm your identity before acting on the request.
11. Changes to this policy
If we make a material change to this policy, we'll update the effective date above and, where appropriate, notify organizers by email.