Rollcall Privacy Policy

Effective date: October 14, 2026 Who we are: Axis Labs LLC, a Nevada limited liability company ("Rollcall," "we," "us")

This policy explains what personal information Rollcall collects, why, who can see it, how long we keep it, and what you can do about it. We tried to write it in plain English. If something is unclear, email us at hey@letsrollcall.com.

The short version

• Rollcall helps event organizers run guest lists, RSVPs, passes, waivers, and door check-in.
• We collect what we need to do that: your name, contact info, RSVP details, passes, and signed waivers.
• We do not sell your personal information. We do not run ads. We do not use analytics or advertising trackers.
• We do not use your personal data to train AI models.
• If an event scans IDs for age checks, the scan happens in your browser. We never receive your ID image, barcode, or date of birth.
• Each organizer's contact list is private to that organizer. Organizers cannot see each other's lists.

Who this covers

This policy applies to everyone who uses:

• the Rollcall website at letsrollcall.com,
• the organizer app at app.letsrollcall.com,
• the door check-in app at door.letsrollcall.com, and
• the Rollcall wallet app for Android.

We talk about two kinds of people:

• Guests. People who RSVP to an event, hold a pass, or sign a waiver.
• Organizers. Hosts who create events, and the team members they invite.

Some sections apply to only one group. We say so when that happens.

Rollcall and organizers: who is responsible for what

Organizers use Rollcall to run their events. That means two parties are involved in your information.

• Rollcall is responsible for your account, signing you in, keeping the platform running and secure, and the rules in this policy.
• Each organizer is responsible for its own contact list, the questions it asks you for an event, any lists it imports, and the messages it sends in its name. Rollcall processes that information on the organizer's behalf and follows the organizer's instructions within the limits of this policy and our terms.
• If you have a question about how an organizer uses your information, contact that organizer first. Rollcall can help you reach them.

Two more things to know:

• Contacts, tags, notes, and blocks belong to exactly one organization. They are never shared with other organizations.
• Your guest account is one identity across all organizers. Your passes from different organizers show up together in your wallet. Organizers do not see what you did at other organizers' events.

Age requirements

• You must be 18 or older to create a Rollcall account.
• Rollcall is not directed at children under 13. If we learn that a child under 13 has given us personal information, we will delete it.
• Individual events may set their own limit, such as 21 and over. See "ID scanning and age checks" below.

Information we collect

Information you give us

When you sign up or sign in (everyone)

• Your email address, and optionally your phone number.
• A display name.
• An optional profile photo.
• Your settings, such as reminders, push notifications, hiding from guest lists, time zone, and light or dark mode.
• A record that you accepted our terms and which version.

We do not use passwords. You sign in with a one-time code sent to your email, or by text if phone sign-in is turned on.

When you RSVP or hold a pass (guests)

• Your RSVP status (going, waitlisted, and so on).
• Answers to the organizer's questions. An organizer can ask up to five custom questions, and some ask for an Instagram handle or a phone number. A phone number given for an event is saved as you typed it and is not verified.
• Plus-ones. If you add a guest, you may give us their phone number or email so they can claim a spot. That person's information is in our system because you gave it to us. Only share it if they are OK with that.
• Your pass, including the name on it and when and where it was checked in.
• Your attestation, if the event requires one (see below).

When you sign a waiver (guests)

• Your name, phone number, and the time you signed.
• A fingerprint (hash) of the exact waiver text you signed.
• A PDF of the signed waiver.

When you message an organizer (guests)

• Your name, email, and the message. It goes to the event's owners.

When you apply to host or use the organizer app (organizers)

• Name, company, email, phone, how many events you run, typical size, your next event date, Instagram or website, and how you heard about us.
• Your organization's name, handle, bio, links, and logo.
• Team members' names and the email or phone used to invite them, and their role (owner, admin, member, or viewer).
• Event details: title, description, cover image, venue, address, times, capacity, access settings, custom questions, age rule, and waiver text.
• Your contact list. Organizers can add contacts by hand, import up to 10,000 rows, or build the list from RSVPs. A contact record can include name, phone, email, Instagram, tags, notes, attendance counts, and email unsubscribe status.
• When importing, a checkbox confirming "These are people who expect to hear from us." We store when and by whom it was checked.

Information collected automatically

• Security and technical data. Sign-in sessions can record your IP address and browser details. We also use your IP address, email, or phone number to rate-limit requests and stop abuse.
• Door devices. A door device gets a session token (we store a hash of it) and a label the organizer gives it.
• Delivery data. Our email provider tells us if a message was delivered, bounced, or marked as spam.
• Daily totals. We keep daily aggregate counts about how the platform is used.

Information we do not collect

• No photos of guests. The only images in the system are covers, avatars, and logos that people upload.
• No GPS or device location. Venue coordinates belong to the event, not to you.
• No fingerprinting, no advertising profiles, and no data purchased from brokers.
• No payment information. Passes are free today, and Rollcall does not process payments.

ID scanning and age checks

Some organizers set an age rule for an event. There are four modes: off, attestation, optional scan, and required scan.

The attestation checkbox

At an attestation event, you check a box that says "I am 21 or older and will show ID at the door." We store that you checked it, when, and which wording version. It is your statement, not something we verify.

The ID scan

At scan events, you can scan the barcode on the back of a US or Canadian driver's license.

• It happens in your browser. The barcode is decoded on your device by code served from Rollcall's own domain. Nothing is sent to a third-party vendor.
• Only four things are read, briefly: date of birth, expiry date, issuing state or province, and country. Your name, address, and license number are never read.
• What reaches Rollcall is one word: passed, under 21, expired, failed, or skipped.
• We never store or receive: a photo or camera image, the barcode itself, your date of birth, or any biometric data.
• A passed scan is remembered for 12 months on your profile, so you can skip rescanning at other events that use scans. It is a "passed until" date, nothing more.
• An under-21 result blocks you from that event's age-restricted RSVP.
• If a scan fails or you skip it (when the event allows), you can still get a pass. The door app will show "Check ID."

What a scan is not

A scan is a first filter, not proof of age. Rollcall does not certify anyone's age. The organizer is still responsible for checking ID at the door.

Walk-ups

If someone shows up without a pass, the organizer can add them with a name only. We create a name-only record and no age-check data.

How we use your information

We use personal information to:

• create and secure your account and sign you in;
• run RSVPs, waitlists, passes, and check-in;
• show organizers the information they need to run their events;
• hold and share signed waivers;
• send the emails and push notifications described below;
• apply age rules;
• support organizers and guests, and handle abuse reports;
• prevent fraud, spam, and misuse, including rate limiting;
• keep the service working, fix bugs, and measure basic daily volume;
• follow the law and enforce our terms.

Rollcall staff can look up people across organizations by name, email, or phone, view organizer dashboards read-only, and merge duplicate profiles. We do this to give support, investigate abuse, and fix errors. Staff access is limited to people who need it.

What organizers can see about guests

• Guest list. Name, RSVP status, how you joined, plus-ones, your answers to event questions, results of age and waiver steps in plain words (for example "waiver signed" or "passed"), and check-in status. It does not show your phone number or email.
• Contact record. Name, Instagram, tags, attendance counts, history, notes, and your email. Your phone number is hidden except for the last 4 digits, unless the viewer is an owner or admin of that organization. Only owners and admins can export contacts.
• Waivers. Organizers with export permission can download signed waiver PDFs. A PDF includes the signer's name and phone number.
• Door devices see names and gate status only (waiver, age, check-in). They do not see emails or phone numbers.
• Other guests. Other guests going to the same event can see your first name and last initial. If you turn on "hide from guest lists" in your settings, they will not see you. Guests never see anyone's contact details.

Organizers can export reports from Rollcall (contacts, guest lists with names and answers, waiver PDFs). We keep an audit log of exports.

Messages from Rollcall and organizers

Email

Email is the only way Rollcall sends messages to guests today.

• Organizer messages. Event invitations, updates, reminders, confirmations, waitlist news, and perk notices are sent by Rollcall on the organizer's behalf. They arrive as "{Organization} via Rollcall," and replies go to the organizer's email address. Reminders usually go out at 10:00 local time the day before the event and when doors open.
• Account messages. Sign-in codes, account notices, team invitations, and deletion notices are sent by Rollcall. These are transactional. They have no unsubscribe link, because you need them to use your account.
• Unsubscribing. Every organizer email has an unsubscribe link, including one-click unsubscribe. Unsubscribing applies to that organizer only and is checked every time we send. You can also turn off reminders and guest-message emails in your profile settings.
• Bounces and complaints. If a message bounces or is marked as spam, we stop sending to that address for that organizer.

Text messages

• Rollcall sends text messages only to a mobile number you give us, and only for things you asked for: a one-time sign-in code when you choose to sign in by phone, and, if you tick the SMS consent box when you RSVP, confirmations, event and door-time reminders, and updates from the organizer of an event you RSVP'd to.
• The consent box is unchecked by default. Giving an organizer your number without ticking it means we will not text you about the event. A phone number an organizer imports is not treated as consent to text you.
• Message frequency varies with the events you RSVP to. Message and data rates may apply. Reply STOP to any message to opt out, or HELP for help. You can also tell us at hey@letsrollcall.com. We will honor any reasonable request to stop.
• We do not send marketing texts. If that ever changes, we will ask for separate consent first.
• Texts are delivered through a messaging provider acting on our behalf (see Service providers). No mobile information will be sold or shared with third parties for promotional or marketing purposes.

Push notifications

Push notifications are opt-in, per device. If you allow them, we store your browser's push address (called an endpoint) and the keys needed to send to it. A push message contains a title, a short body, and a link. You can turn push off in your settings or in your browser at any time.

Who we share information with

Service providers

We use a small number of companies to run Rollcall. They process data for us and for organizers, and only to provide their service.

Our main website app hosts its own fonts. Google Fonts is only requested by the door app.

What we do not do

• We do not use analytics tools.
• We do not use advertising pixels or ad networks.
• We do not work with data brokers.
• We do not sell personal information.
• We do not share personal information for targeted advertising.
• We do not use personal data to train AI models.

Other disclosures

We may share information:

• With organizers, as described above.
• To follow the law, such as a valid court order or legal process.
• To keep people safe, prevent fraud, or protect our rights and the rights of others.
• In a business transaction, such as a merger, acquisition, or sale of assets. We will tell you if your information becomes subject to a different privacy policy.
• With your consent.

Cookies and similar technologies

• Cookies. We use first-party session cookies to keep you signed in. They are HttpOnly and Secure. The session cookie lasts up to 7 days, and a short-lived sign-in token lasts 15 minutes.
• Local storage. We store small items on your device: event unlock tokens, your remembered organization, light or dark mode, whether you dismissed the wallet install prompt, an import resume ID, and the door app's device token and cached pass list. Some temporary items sit in session storage while you move through a flow.
• Service worker. Our service worker caches nothing. It exists to show push notifications.
• Tracking. We do not use tracking cookies or third-party trackers. Because of that, we do not show a cookie banner. We do not track you across other websites or apps, so Global Privacy Control and Do Not Track signals have nothing to switch off.

How long we keep information

Here is what we actually do today.

If you delete your account

Go to your profile or wallet settings and request deletion.

1. 7-day grace period. You can change your mind during this time.
2. After 7 days we:
   • anonymize your profile (your name becomes "Deleted guest" and your email, phone, avatar, and ID scan status are cleared);
   • delete every contact record any organizer has linked to you, with its history, tags, and notes;
   • delete your sign-in records and sessions;
   • delete your push subscriptions and avatar file.
3. What stays. RSVPs, passes, check-in records, and perk records stay, linked to the anonymized record, and the name on your passes becomes "Deleted guest". Messages you sent to organizers stay as they were sent. Organizers need these for event history, safety, and legal reasons.
4. Signed waivers are kept as legal records, including the name and phone you signed with and the PDF, even after the account is deleted.

Event data

Event, RSVP, contact, and waiver data stay until the organizer deletes them. Rollcall may delete data from inactive events and accounts, and will give notice before it does.

Short-lived data

• Sign-in codes expire after 5 minutes.
• Import staging files are deleted after 24 hours.
• Orphaned uploads (files not attached to anything) are deleted after 24 hours.
• Door device sessions end 4 hours after the event ends.
• Email delivery logs and unsent drafts are cleared on a regular schedule.
• A passed ID scan is remembered for 12 months, then expires.

Backups and legacy data

Deleted data may remain in backups for a short time. Some older waiver records may include an IP address collected before we stopped capturing it.

Your choices and rights

You can:

• Access and correct your name, email, phone, photo, and preferences in your profile.
• Delete your account (see the previous section).
• Unsubscribe from an organizer's emails with the link in any message.
• Turn on or off push notifications, event reminders, and guest-message emails in your settings.
• Hide from guest lists so other guests do not see your name.
• Ask for a copy of your data by emailing hey@letsrollcall.com. There is no self-service download yet.
• Ask us a question or raise a concern about anything in this policy.

For questions about how a specific organizer uses your information, contact the organizer. We can pass along your request.

US state privacy rights

If you live in California, Colorado, Connecticut, Virginia, Utah, or another state with a privacy law, you may have these rights:

• Know what personal information we collect, use, and share, and get a copy.
• Delete your personal information, with some exceptions (for example, signed waivers).
• Correct inaccurate information.
• Opt out of the sale of personal information or sharing for targeted advertising. We do neither, so there is nothing to opt out of.
• Non-discrimination. We will not treat you worse for using these rights.

How to use them. Email hey@letsrollcall.com. We may ask you to confirm you control the email or phone on your account. An authorized agent can submit a request for you with your written permission. We will respond within 45 days.

If we say no, you can appeal by replying to our response or emailing hey@letsrollcall.com with "Appeal" in the subject. We will answer in writing within 45 days of receiving the appeal. If you are still unhappy, you can contact your state attorney general.

In the last 12 months, we have not sold personal information or shared it for targeted advertising. No mobile information will be sold or shared with third parties for promotional or marketing purposes. The information in this policy about categories we collect, why, and who gets it is the notice at collection.

Security

• Data is encrypted in transit using HTTPS.
• Sign-in codes are stored hashed, not in plain text.
• Access to organizer data is role-based. Owners, admins, members, and viewers see different things.
• Exports are logged.
• Door devices see the minimum they need.

No system is perfectly secure. If you think your account has been compromised, email us right away.

Where your information is processed

Rollcall is operated from the United States and your data is stored in the United States. It is not aimed at people in the European Union or United Kingdom. If you use Rollcall from another country, you understand and agree that your information will be processed in the United States, where privacy laws may differ from those where you live.

Third-party links

Organizers may link to their own sites or social profiles. We do not control those and this policy does not cover them.

Changes to this policy

If we make a change, we will update the effective date at the top. For material changes, we will tell you by email or in the app. Rollcall will ask you to accept the updated terms and policy again before you keep using your account. If you do not agree, you can delete your account.

Contact us

Axis Labs LLC Email: hey@letsrollcall.com

Questions about an organizer's event or messages should go to that organizer first.