weDISCOVR, Inc. · 9 Annwood Lane, Cincinnati OH 45206, USA · Contact: privacy@wediscovr.co
In one paragraph. weDISCOVR runs a consent-based behavioral data platform. The whole architecture is built around one promise: brand sponsors, venues, and cities never see your name, your email, or your phone number. They see your weDISCOVR Explorer Identity (wEID), a cryptographically irreversible code that confirms what you did at an event without revealing who you are. This policy explains the data we collect, why we collect it, what we do with it, who we share it with, and the rights you have over it. It is written to be readable. If anything is unclear, email privacy@wediscovr.co and a human will respond within 5 business days.
weDISCOVR, Inc.
9 Annwood Lane, Cincinnati OH 45206, USA
Devonte Lemonte Roach
Legal resident, Berlin, Germany
Licensed to operate in entertainment and events in Germany
To be appointed. Name and contact will be added upon appointment.
This policy covers personal data we process across all weDISCOVR surfaces:
If you interact with weDISCOVR through any of these, this policy applies to you.
This is the most important sentence in this document.
The wEID is the only identifier ever shared with brand sponsors, venues, cities, or partners. Your name, email, phone, address, and any payment information are never disclosed to them.
The wEID is:
This is not a policy commitment that we can change later. It is an architectural commitment. The system is built so that PII and wEID are physically separated and never co-presented to brand-side surfaces.
We collect different categories of data depending on which user type you are. Below is the full inventory.
Account data (name, email, password), Drop claim and redemption signals, optional consent signals (location, dwell time, purchase behavior), DISC token balance, in-app survey responses, and shipping address only when you opt into home delivery.
Account data (name, email, business name), event listings, audience details you provide, Stripe Connect payout information, and Curator Performance Index (CPI) signals derived from your Drops.
Venue profile, capacity, operating hours, approval logs for Curator and Brand bookings, and aggregated foot-traffic data tied to wEIDs, never to individual Explorer identities.
Company profile, billing information, AR Commerce Studio assets and creative uploads, Drop configuration and SKU data, brand-lift survey responses, and the wSI scores generated for each activation.
City OS partnership agreements only. No individual-level data. We share aggregated, anonymized cultural-health metrics with city partners.
IP address, device fingerprint, browser type, session timestamps, and cookies necessary to operate the service. See Section 11 for the full cookie inventory.
GDPR Article 6 requires us to name a legal basis for every processing purpose. We have six. Here is what each one covers.
We need your email to send your pickup code. We need your wEID to confirm at the booth that the Drop is yours. We need the behavioral signals (Drop claimed, redeemed, etc.) to operate the marketplace. Without this data, the service does not work.
When you claim a Drop, we send the brand sponsor a confirmation that the sample was redeemed at the event. This contains the wEID and the activation signal, never your name, email, or any PII. The brand sponsor needs this to measure campaign performance and to fund the next activation.
We have weighed this against your interests and concluded it is necessary, minimal, and reasonable: brand sponsors cannot operate without proof of activation, and we use the strictest anonymization (wEID architecture) to protect you.
You have the right to object to this processing at any time. Email privacy@wediscovr.co or use the Object link on any consent surface. Upon objection, we stop sharing your activation signals with brand sponsors.
The weDISCOVR Signal Intelligence Index (wSI) is the patent-pending protocol that scores Drops, Curators, Spaces, Brands, Events, and Cities based on permissioned behavioral data. Your wEID's signals contribute to these scores. The scores are used to price activations, surface relevant Drops to you, and rank Curators and Spaces.
This is profiling under Article 22 GDPR. You have the right to:
If we want to use your image or video for marketing, promotional, or social media purposes, we need your active consent. This is asked for either in-app at the activation or on a signed release form. At physical activations, clearly posted signage notifies attendees that filming is taking place, satisfying the documentary coverage provisions of Kunsturhebergesetz §23. This signage is posted at all weDISCOVR activation points.
You can opt out of in-app consent at the activation. You can withdraw consent at any time by emailing privacy@wediscovr.co. Withdrawal does not affect the lawfulness of any use before withdrawal.
We send emails about upcoming sessions, Drops, and weDISCOVR updates only if you have given consent. You can unsubscribe from any email in one click.
We log IP addresses, device fingerprints, and login attempts to prevent account abuse, multi-claim fraud, and unauthorized access. This is balanced against your interest: we collect the minimum needed and keep it short.
We share data only with the parties below, only for the purposes named, and only in the forms specified.
What they receive: wEID, activation signal (claimed, redeemed, time-on-site), and aggregated demographic buckets (city, age range if you have provided it).
What they never receive: name, email, phone, address, exact location, payment info, or any other PII.
What they receive: wEID + session registration data + first name + email for Explorers who explicitly pre-register for their sessions.
Why: Curators need to communicate with confirmed attendees (changes, cancellations, content).
What they receive: Aggregated foot-traffic data tied to wEIDs, never to your name.
What they receive: Fully anonymized, aggregated cultural-health metrics. No wEID, no individual-level data.
We use vetted service providers for hosting, payments (Stripe), email delivery, fulfillment logistics, and customer support. Each is bound by a Data Processing Agreement under Article 28 GDPR. A current list of sub-processors is available on request from privacy@wediscovr.co.
We disclose data when legally required (court order, valid government request) or to protect lives, prevent fraud, or defend our rights. We always seek to limit the scope of disclosure to what is strictly required.
weDISCOVR, Inc. is established in the United States. Some processing happens on US infrastructure. When your data leaves the European Economic Area, we use one or more of the following safeguards:
You can request a copy of the SCCs in place for any specific transfer by emailing privacy@wediscovr.co.
Detailed retention per purpose is in Section 5. In summary:
You can request earlier deletion at any time via the My Data panel or by emailing privacy@wediscovr.co. We delete within 30 days unless we are legally required to retain for compliance (in which case we explain why).
Under GDPR, you have the following rights. You can exercise each one through the My Data panel in the Explorer app, or by emailing privacy@wediscovr.co. We respond within 30 days.
You can see all data we hold about you, in machine-readable format, through the My Data panel. You can also request a full export by email.
You can correct any inaccurate data through the My Data panel or by email.
You can request that we delete your data. We comply within 30 days unless we are legally required to keep specific records (in which case we explain why and delete what we can).
You can ask us to stop processing your data while a dispute or correction is pending.
You can download your data in machine-readable format through the My Data panel. You can also ask us to transfer it directly to another controller.
You can object to any processing based on legitimate interest (Article 6(1)(f)). This specifically includes:
Upon objection, we stop the processing unless we can demonstrate compelling legitimate grounds that override your interests. We always tell you the outcome.
For any processing based on consent (Article 6(1)(a)), you can withdraw at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
You have the right to file a complaint with your national data protection authority.
For users in Germany:
Bundesbeauftragter für den Datenschutz und die Informationsfreiheit (BfDI)
Graurheindorfer Straße 153, 53117 Bonn
Web: bfdi.bund.de
For users elsewhere in the EU, find your authority at edpb.europa.eu.
The wSI protocol uses your behavioral signals to:
These are automated decisions that materially affect your experience. Under Article 22 GDPR, you have the right to:
To exercise these rights, email privacy@wediscovr.co with "wSI Review" in the subject line.
We use only the cookies needed to operate the service.
We do not use third-party advertising cookies or trackers. No Facebook Pixel, no Google Ads tags, no LinkedIn Insight Tag, no retargeting pixels of any kind on weDISCOVR-owned surfaces.
Brand-built Drop pages reached through the Recall Deck or Powered by weDI partnerships may load their own first-party cookies for their analytics. We label these clearly when they appear.
weDISCOVR is for users 16 years and older. We do not knowingly collect data from anyone under 16. If you believe a child has signed up, email privacy@wediscovr.co and we will delete the account within 7 days.
We use industry-standard security:
No system is perfectly secure. If we discover a breach affecting your data, we notify you and the relevant supervisory authority within 72 hours as required by Article 33 GDPR.
We may update this policy as the product evolves. For any material change (new categories of data, new sharing partners, weakening of your rights), we will:
For non-material changes (typo fixes, contact updates, clarifications), we update the policy and bump the version number without notification.
Past versions are available on request.
For any privacy question, complaint, or rights request:
For urgent matters (suspected breach, account compromise, etc.), use email and include "URGENT" in the subject line.