Privacy policy

Who this covers

This policy covers ramenid.com, the hosted verification pages, the dashboard and the API. It applies to two groups of people:

• Merchants: businesses that sign up to offer student discounts.
• Students: people who verify a school email on a merchant's RamenID page.

When a student verifies on a merchant's page, RamenID handles that student's data on the merchant's behalf. The merchant's own privacy policy also applies to how they use it.

Students: what we collect

• The email address you enter, the school domain it belongs to, and the institution we matched it to.
• The one-time code we email you, stored only as a salted hash. It expires after 10 minutes.
• A hashed copy of your email, so verifying again while your code is still valid returns that same code instead of a new one.
• The discount code created for you, when it expires, and the checkout link for it.
• The IP address of the device requesting a code, used only to limit how often codes can be requested.
• When each step happened (code sent, email verified, discount created).

The merchant whose page you used can see your email, your school, the status of your verification and your discount code. If that merchant turned on webhooks or email alerts, the same details are sent to the endpoint or address they chose.

Merchants: what we collect

• Your account details: your email address, and your name and profile picture if you sign in with Google.
• Your workspace details: its name, URL slug, logo, description, website, redirect URL and notification settings.
• Connections to Stripe, Polar or Dodo Payments. Access tokens and API keys are encrypted at rest. We use them only to run RamenID for you: checking the connection, listing your products, creating and looking up discounts, and preparing checkout links.
• RamenID API keys, stored as a hash plus a short prefix so you can recognise them. We show the full key once, when you create it.
• Your webhook URL, its signing secret, and a log of each delivery attempt.
• Billing details for your RamenID plan: your Stripe customer ID, plan, subscription status and billing period, and a count of the verifications and discounts used. Card details are handled by Stripe and never reach us.

What we do not collect

No student ID documents or photos, no payment card details, and no record of what anyone buys. Coupons are redeemed inside the merchant's own payment provider, so RamenID never sees a purchase. We do not use advertising trackers.

Cookies

We use only the cookies needed to run the service: one that keeps merchants signed in, and short-lived ones that secure the sign-in and provider connection flows. Students verifying a school email do not need an account, and we do not set tracking cookies.

How we use data

• To run the service: send codes, verify emails, create discounts, and notify merchants.
• To prevent abuse, such as repeated code requests and code guessing.
• To bill merchants and enforce plan limits.
• To send service emails, such as verification codes, alerts merchants turned on, and important account notices.
• To answer support requests.

We do not sell personal data, and we do not use it for advertising.

Service providers

We rely on a small number of providers, each of which handles data only to provide its service to us:

• Supabase: database, authentication and logo storage.
• Resend: email delivery.
• Vercel: hosting.
• Stripe: billing for RamenID plans.
• Google: sign-in, if a merchant chooses it.

Discount codes are created directly in the merchant's own Stripe, Polar or Dodo Payments account, under that provider's terms. Each discount stores the student's email in its metadata, so the merchant can match it to the student. For Dodo Payments, the student's email is also passed to Dodo to fill in the checkout page.

How long we keep it

We keep verification records while the merchant's account is active, so the merchant can see who claimed a discount. There is no automatic deletion yet. If a merchant asks us to delete their account, we delete their workspace and every verification record under it. Rate-limit records hold an IP address, a hashed email or a workspace ID, with a count and the start of the current time window. They are overwritten when the same key is used again and are not deleted automatically yet. Anyone can ask us to delete their data at any time, as described below.

Security

All traffic uses HTTPS. Payment provider credentials are encrypted at rest, one-time codes are stored only as hashes, API keys as a hash and a short prefix, and webhooks are signed so merchants can check they came from us. Access to production systems is limited to the people who run the service.

Your rights

Depending on where you live, you may have the right to see the personal data we hold about you, correct it, delete it, or object to how we use it. Email us at contact@workview.io from the address involved, and we will respond within 30 days. Students can also contact the merchant who offered the discount.

Where data is processed

Our service providers may process data in the United States and in other countries. Where the law requires it, we rely on safeguards such as standard contractual clauses for those transfers.

Children

RamenID is built for students at educational institutions and is not directed at children under 13. We do not knowingly collect data from them. If you believe a child has used RamenID, contact us and we will delete the data.

Changes to this policy

If we make a material change, we will update the date above and email merchants before the change takes effect.

Contact

Workview LLC, operator of RamenID. Email contact@workview.io.