Privacy Policy

1. Overview

PawnSmarts handles sensitive personal information — yours as the account holder and that of your customers (pledgors). This Policy explains what data we collect, how we use it, and your rights.

2. Our Role — Data Processor vs. Controller

For data about your customers (pledgors), the Company acts as a data processor — we store and secure data on your behalf. You are the data controller. You decide what to collect, you are responsible for lawful collection and use, and you bear compliance obligations under your state's pawnbroker statutes.

For your own account data, the Company acts as data controller.

3. Data We Collect

Account Data (About You)

• Name, email address, hashed password (never stored in plain text)
• Business name, address, phone, state license number
• Billing information (Stripe handles card data — we never see card numbers)
• IP address and device info for security purposes

Business Data (Entered by You)

• Pawn ticket records, loan amounts, dates, item descriptions
• Customer records: name, address, DOB, race, sex, height, weight, eye color, government ID
• Redemption, renewal, forfeiture, and payment records
• ATF Gun Log entries (firearm acquisition and disposition)
• Item photos, customer signatures, notes, audit logs

Usage Data

• Feature usage patterns and pages visited (for product improvement)
• Error logs and crash reports (no customer PII included)

4. How We Use Data

5. Third-Party Services

PawnSmarts depends on third-party services. The Company has no control over these services and accepts no liability for their performance or failure:

By using PawnSmarts, you acknowledge that your data is stored on Supabase's infrastructure and is subject to their security practices. You are responsible for maintaining independent backups of your data.

6. Data Sharing

We do not sell, rent, or trade data. We share data only with: (a) infrastructure providers listed above, limited to service delivery; (b) law enforcement in response to a valid court order or subpoena; (c) a successor entity in a business transition, under the same privacy obligations.

7. Security

• Encryption at rest and TLS encryption in transit via Supabase
• Passwords hashed with bcrypt — never stored in plain text
• Row-level database security prevents cross-account data access
• The Company does not grant employees routine access to customer data

No system is perfectly secure. In the event of a breach affecting your account data, we will notify you within 72 hours of the Company becoming aware.

8. Data Retention

9. Your Rights

• Access — request a summary of your account data
• Correction — update your account information in Settings
• Export — download all data via Settings → Download Full Backup (JSON format)
• Deletion — request deletion at [email protected] (subject to retention obligations)

Requests processed within 30 days.

10. No Warranty of Compliance

The Company does not represent that its data handling practices satisfy any specific regulatory requirement applicable to your pawn business. You are responsible for ensuring your use of PawnSmarts complies with all applicable laws.

11. Geographic Scope

PawnSmarts is operated from Grayson County, Texas and governed by Texas law. It is not directed at EU residents and the Company makes no GDPR compliance representations.

12. Changes to This Policy

When updated, the version number and Effective Date are updated, users are notified in-app, and material changes are summarized. Continued use after notification constitutes acceptance.

13. Contact

Pawn Software  ·  [email protected]  ·  pawn-software.com  ·  Grayson County, Texas