Privacy Policy

This Privacy Policy explains how Derby Duck Races, LLC (“Derby Duck Races,” “eQuack,” “we,” “us,” or “our”) collects, uses, and shares personal information through the eQuack platform.

What this policy covers

This policy covers the eQuack websites at equack.app, public Event pages hosted on eQuack (including pages on an organization’s own web address), the eQuack mobile application, and the eQuack text-to-give number (together, the “Services”).

It does not cover our marketing website or race sites hosted on our earlier platform at duckrace.com, which have their own notices. It also does not cover what the organization you support does with your information in its own systems.

eQuack is used by Organizers, meaning Derby Duck Races staff and the organizations we work with, including their administrators, team captains, and volunteers, and by Supporters, meaning the donors, duck adopters, sponsors, and shoppers who use public Event pages. Our Terms & Conditions also apply.

Who is responsible for your information

When you support an Event, Derby Duck Races and the organization hosting the Event have different roles:

• The organization hosting the Event (the nonprofit, school, or club named on the Event page) decides how your information is used for its fundraising. It receives your information and uses it under its own privacy notice.
• Derby Duck Races runs the platform. We handle Supporter information on the host organization’s behalf so it can run its Event. We also use it for purposes of our own: processing payments, preventing fraud, keeping required records, securing the Services, and understanding how the Services perform.

For Organizer accounts and for information about how the Services are used, Derby Duck Races is the responsible party.

Information we collect

• Account information. Organizer name, email address, role, and organization. Sign-in is handled by an authentication provider, and we do not see or store your password.
• Supporter and checkout information. What the checkout asks for, typically name, email address, phone number, and any mailing or delivery address, along with the amount, the Event, the team or referral link that brought you, duck numbers assigned, the terms you accepted, and any message or dedication you add. If you give a duck as a gift, the recipient details you provide.
• Payment information. Payment-card details go directly to our payment processor. We receive a payment confirmation and limited card details, such as the card type and last four digits. We do not receive or store full card numbers.
• Text message information. Your mobile number, the messages you send us, the record of your consent, and any opt-out.
• Email information. Whether messages we send are delivered and, in some cases, opened or clicked.
• Device and usage information. IP address, device and browser or app details, pages viewed, and actions taken in the Services.
• Session replay and diagnostics. Recordings of how a visit unfolds and error reports, as described below.
• Correspondence. Messages you send us and our replies.
• Information from others. Organizations, their authorized users, and other people may give us information about you, such as imported contact records, orders entered for you in person, gift details, and correspondence.

We do not ask Supporters for government ID numbers, health information, or other sensitive personal information, and we ask that you not include them in free-text fields or messages to us.

How we use information

• To provide, operate, and secure the Services.
• To process payments, fulfill orders, and assign duck numbers.
• To give the host organization the records it needs to run its Event, thank its supporters, and issue receipts.
• To send transactional messages, such as receipts, confirmations, duck numbers, payment notices, and Event updates.
• To send the host organization’s fundraising emails and text messages, where it has permission to send them.
• To contact you if a payment you started did not complete, so you can choose whether to finish it.
• To organize, on a host organization’s instructions, its supporters’ giving and engagement history into donor records and audiences the organization uses to personalize its own communications.
• To detect and prevent fraud and unauthorized access.
• To troubleshoot and improve the Services, and to create aggregated statistics.
• To comply with the law and enforce our agreements.

Payments and device permissions

Payments are handled by a third-party payment processor, under its own privacy policy.

For in-person payments, the eQuack mobile app and the payment software built into it may ask for Bluetooth and device location access, to connect to a card reader and to enable payment acceptance and fraud prevention by the payment processor. You can manage these permissions in your device settings. Turning them off may prevent in-person payments.

Text messages

If you text an Event keyword to our number, we reply with the adoption link and messages about the order you place. You receive an organization’s fundraising texts only if you separately opt in to them. Agreeing to texts is never a condition of adopting or donating. Message frequency varies. Message and data rates may apply. Reply STOP to cancel or HELP for help. The full program terms are in Section 7 of our Terms & Conditions.

We do not sell mobile phone numbers or text-message consent, and we do not share them with third parties or affiliates for their marketing or promotional purposes. Messaging providers and mobile carriers process phone numbers, message content, and delivery information to deliver and secure messages, prevent abuse, and meet their legal obligations.

Separately, the organization hosting the Event you supported receives your order details, including the phone number you entered at checkout, because your order is placed with that organization. That is not a transfer of your text-message consent. The organization needs your separate permission before texting you from its own systems.

Cookies, analytics, and session replay

We use cookies and similar technologies for things that have to work: keeping Organizers signed in, holding a checkout together, and remembering which team or referral link brought you to an Event.

We also use analytics, performance-measurement, and error-monitoring tools to understand which pages and flows work and which ones break or confuse people. These include session replay, which may record how a visit unfolds, including clicks, scrolls, page navigation, and the content shown on the page. Replay is configured to mask what is typed into form fields. Other content shown on the page, including information that appears outside form fields, may be visible in a recording. The providers of these tools process this information for us.

Some third-party services are built into the pages you visit: the payment processor’s checkout and fraud-prevention tools, and any video a host organization chooses to embed from a third-party video service. These services may set their own cookies and may collect information about your activity over time and across other websites and services, under their own privacy policies.

Do Not Track and Global Privacy Control. The Services do not currently change how they operate in response to Do Not Track or Global Privacy Control signals.

Most browsers let you block or delete cookies. Blocking essential cookies may prevent sign-in and checkout from working.

AI-assisted features

Organizers can choose to use AI-assisted tools to draft Event page content. When they do, the content they submit is sent to an AI service provider to generate the draft. We do not use personal information to train AI models.

How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We disclose it in these situations:

• To the organization hosting the Event. When you adopt a duck, donate, or sponsor, the host organization receives your name, contact details, amount, and order details so it can fulfill your order, thank you, and meet its own receipting and reporting obligations. Once it has your information, the organization is responsible for its copy under its own privacy practices.
• To team captains and volunteers the host organization has authorized, such as who supported their team.
• To the public, in limited ways. Event pages may show supporter or winner names, for example on team pages, leaderboards, and race results, as the Event’s rules and pages describe.
• To service providers that help us run the Services, in these categories: payment processing, authentication, email and text-message delivery, hosting and data storage, analytics and error monitoring, customer support, business email and documents, and AI-assisted drafting. Some of them also use information for their own fraud-prevention, security, and legal-compliance purposes under their own terms.
• To payment networks and banks, as needed to process a payment or respond to a dispute.
• When the law requires it, or to enforce our agreements and protect the rights, safety, and security of our users and the public.
• In a business transfer, such as a merger or sale of assets, subject to this policy or to notice and any choice the law requires.

Retention

How long we keep personal information depends on the type of record and why we have it. The factors include whether the host organization still uses eQuack, how long tax, accounting, fundraising, and payment rules require transaction records to be kept, how long we need to keep honoring a text-message opt-out, security needs, and legal claims. A deletion request or a legal hold can change the period.

Where information is processed, and security

eQuack is operated from the United States. Your information is processed in the United States and in other countries where our service providers operate, where privacy laws may differ from those where you live.

We use technical and organizational safeguards designed to protect personal information. No method of transmission or storage is completely secure.

Your choices and rights

You can unsubscribe from an organization’s fundraising emails using the link in any of them, stop text messages by replying STOP, and manage cookies in your browser. Unsubscribing from fundraising emails does not stop necessary emails about your own orders. A text-message opt-out applies to all texts from our number.

You may ask us what personal information we hold about you, or ask us to correct or delete it, by emailing info@duckrace.com with the subject line “Privacy request.” Tell us the email address or phone number you used and, if you know it, the Event or organization involved. We may need to confirm your identity. Depending on the law that applies to you, you may also have the right to a copy of your information, to opt out of certain processing, or to appeal our response, and you can use the same address for those. We respond as the law that applies to you requires.

Nevada residents may submit a request directing us not to sell covered information by emailing the same address with the subject line “Nevada opt-out.” We do not sell personal information.

Some limits apply. For example, we must keep certain records, such as transaction records, even if you ask us to delete them. And because much of the information we hold is held for the organization that hosted your Event, we may need to involve that organization, which also holds its own copy.

Children’s privacy

The Services are intended for adults and are not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us.

Changes to this policy

We may update this Privacy Policy. The “Last updated” date at the top of the page is the date the current version took effect. If a change is material, we will update this page and tell Organizers by email or when they next sign in. We will not use information we already hold in a materially different, less protective way without notifying the people affected and getting any consent the law requires.

Contact us

Questions about this Privacy Policy can be sent to info@duckrace.com or mailed to:

Derby Duck Races, LLC
Attn: Privacy
3409 N 7th Ave, PMB 2126
Phoenix, AZ 85013