Privacy Policy

The short version. We're a family of movie theaters in Idaho Falls and Blackfoot, Idaho. To sell you a ticket, hold your seat, and run the Royal Rewards program, we need a few things: your name, email, phone number, and date of birth. We never see your full credit card number — our payment processor handles that. We don't sell your information to anyone, and we don't tell advertisers or social media companies which movies you go see. You can get a copy of your information, correct it, or delete your account at any time, no matter what state you live in. If you'd rather not hear from us, every marketing email has an unsubscribe link that actually works.

The rest of this page is the detailed version. It's long because we'd rather be specific than vague, but we've tried to keep it in plain English.

1. Who we are and what this policy covers

Royal Theaters operates movie theaters in Idaho Falls, Idaho (the Paramount and the Centre) and in Blackfoot, Idaho.

This policy covers the personal information we collect through:

• our website at royaltheaters.com
• our Royal Theaters mobile app for iOS and Android
• in-person purchases at our box offices and concession stands that are tied to your account, such as scanning your Royal Rewards account
• our private theater rental, fundraiser discount card, and pre-show screen advertising programs

We are a US business serving customers in the United States. We do not sell tickets internationally, and we do not target our services to people in the European Union or the United Kingdom.

When this policy says "we," "us," or "Royal Theaters," it means the company that operates those theaters. When it says "you," it means anyone who uses our website, our app, or our services.

2. Information you give us

Your account

When you create a Royal Theaters account, we collect:

• Email address — used to sign in, send your tickets, and verify your account
• Password — stored by our ticketing provider in hashed form; we cannot see or retrieve your actual password
• First and last name — used on your tickets and at will-call pickup
• Phone number — used for order issues, will-call, and rental or fundraiser coordination
• Date of birth — see Section 3 for exactly why we need this

We also store a postal address field on accounts. We no longer ask for it when you sign up, and it is optional. Some older accounts still have one on file from when we did collect it, and some customers give us one for gift card mailing.

Your purchases and rewards

• Ticket purchases, including the showtime, theater, auditorium, and the specific seats you selected
• Concession and popcorn pre-orders, and will-call pickup status
• Royal Rewards point balances, ticket credits, money credits, and gift or loyalty card balances and activity
• Refunds, exchanges, and any account adjustments we make
• Records related to private theater rentals, including the event date, contact details, and any deposits or payments
• Records related to fundraiser discount card sales, including the organization and the cards issued
• For businesses in our pre-show advertising program: business contact information and signed advertising agreements

Messages you send us

If you email us, fill out a form on our site, or contact us about a rental, fundraiser, job application, or complaint, we keep what you send us so we can respond and keep a record of it.

3. Why we ask for your date of birth

We ask for your date of birth for two specific, practical reasons:

1. Age verification for restricted films. We are required to check age for R-rated and other age-restricted showings. Having your date of birth on file lets us handle that consistently.
2. Age-based ticket pricing. Child, adult, and senior tickets are priced differently. Your date of birth is how we determine which price applies.

We also use it to confirm you are old enough to have an account with us at all — see Section 13.

We do not use your date of birth for advertising, we do not sell it, and we do not use it to build a profile about you.

4. Information collected automatically

When you use our website or app, we automatically receive some standard technical information:

• IP address, browser type and version, operating system, and device type
• Which pages or screens you visited, in what order, and how long you stayed
• The website that referred you to us, if any
• Crash reports and error logs from the app
• Cookies and similar technologies (see Section 8)

If you turn on push notifications in the app, we receive a push notification token from Apple or Google. This is a device identifier that lets us send you a notification. It is not tied to anything you do outside our app.

If you add a ticket to Apple Wallet, the pass containing your ticket information is stored on your device by Apple. We generate the pass; we do not get information back from your Wallet.

5. What we do not collect

We want to be direct about this, because these are the things people most often worry about:

• We do not collect biometric information. No facial recognition, no fingerprints, no face or voice templates, no retina scans, anywhere in our theaters, our website, or our app.
• We never receive your full credit or debit card number. See Section 6.
• We do not collect Social Security numbers or government ID numbers from customers.
• We do not collect precise GPS location. We know which theater you bought a ticket for because you told us; we are not tracking where your phone is.
• We do not collect sensitive personal information as state privacy laws define it — nothing about your race, ethnicity, religion, health, sexual orientation, union membership, or immigration status.

6. How payments work

Card payments are processed by Heartland, a Global Payments company, using their SecureSubmit tokenization service.

Here's what that means in practice: when you type your card number into our checkout, it goes directly to Heartland, not to us. Heartland sends back a token — a meaningless reference number that stands in for your card. We use that token to complete the charge.

Royal Theaters never receives and never stores your full card number, security code, or PIN. If you choose to save a card for next time, what we save is the token, not the card.

Refunds are issued back through Heartland to the original payment method. Where you paid with rewards credits or a gift or loyalty card, refunds go back to that source.

7. Your moviegoing history and the Video Privacy Protection Act

This deserves its own section, because it's a fair thing to be concerned about.

The Video Privacy Protection Act ("VPPA") is a federal law that restricts disclosing what videos a person watches. Courts have consistently held that the VPPA does not apply to movie theaters selling tickets — it was written for video rental and streaming services that hand you the actual recording. Two federal appeals courts have now ruled that a movie theater is not the kind of business the VPPA covers, including the Ninth Circuit, which covers Idaho.

We are telling you our practices anyway, because the legal technicality is not the point. The point is what we actually do:

• We do not tell advertisers, social media companies, or data brokers which movies you buy tickets for. Not Meta, not TikTok, not any ad network.
• We do not sell or rent your purchase history.
• We use your moviegoing history for exactly three things: showing you your own order history, running Royal Rewards, and understanding in aggregate which films are doing well so we know what to book.
• If we ever wanted to disclose your specific viewing history to a third party for their own marketing purposes, we would ask you first, in a separate request, and you'd be free to say no.

8. Cookies, analytics, and advertising

We use cookies and similar technologies for a few purposes:

• Strictly necessary — keeping you signed in, holding your seats while you check out, remembering your cart, and security. The site does not work without these.
• Preferences — remembering your default theater and similar settings.
• Analytics — understanding which pages people use and where things break, so we can fix them.

You can block or delete cookies in your browser settings, and you can reset or limit your advertising identifier in your phone's settings. If you block strictly necessary cookies, ticket checkout will not work.

We do not run our own cross-site advertising network, and we do not allow third parties to collect your browsing activity across other websites through our site for their own advertising purposes.

9. How we use your information

We use what we collect to:

• Sell you tickets, assign your seats, and get you your tickets
• Take and fulfill concession and popcorn pre-orders, and manage will-call pickup
• Run the Royal Rewards program and keep your points, credits, and card balances accurate
• Verify your age for restricted films and apply the right ticket price
• Send you order confirmations, tickets, showtime changes, cancellations, and refund notices
• Verify your email address and let you reset your password
• Handle private theater rentals, fundraiser card programs, and pre-show advertising agreements
• Answer your questions and resolve problems
• Send you marketing email about films and events, if you've opted in (Section 10)
• Send push notifications, if you've turned them on
• Detect and prevent fraud, chargeback abuse, ticket scalping, and account takeover
• Understand attendance patterns in aggregate so we can book films and set showtimes
• Keep required business and tax records, and comply with the law

We do not use your information to make automated decisions that have a legal or similarly significant effect on you, and we do not use it to train artificial intelligence models.

10. Marketing email and push notifications

Marketing email is opt-in. We only send promotional email — new releases, special events, rewards offers — to people who have asked for it.

Every marketing email we send will:

• clearly come from Royal Theaters, with an honest subject line
• include a working unsubscribe link
• include our physical mailing address, as federal law requires

If you unsubscribe, we'll stop. We process opt-outs promptly and in all cases within 10 business days, which is the deadline the CAN-SPAM Act sets. You do not have to give a reason, log in, or pay anything to unsubscribe.

Transactional email is different. Order confirmations, tickets, seat changes, refund notices, email verification codes, and password reset messages are not marketing — they're part of the service you asked for. If you have an active account or a pending order, you'll keep getting those even if you've unsubscribed from marketing. If you don't want them at all, close your account (Section 15).

Push notifications can be turned off at any time in your device settings or in the app, without affecting anything else.

We use Resend to deliver our email. To unsubscribe, use the link in any marketing email, change your preferences in your account, or email us at royaltheatersinc@gmail.com.

11. Who we share information with

We do not sell your personal information, and we never have. We don't trade it, rent it, or hand it to data brokers.

We do share information with a small number of companies that help us run the business. They're only allowed to use it to do the job we hired them for.

Because RTS is the system of record for your account, your account information necessarily lives on their systems as well as ours. RTS is bound by our agreement with them.

We may also disclose information:

• When the law requires it — a valid subpoena, warrant, or court order. We review these and push back on overbroad requests.
• To protect people or property — to investigate fraud, threats, or safety issues at our theaters.
• To our professional advisors — accountants, lawyers, and insurers, under confidentiality obligations.
• In a business transfer — if Royal Theaters is sold or merged, customer information would transfer with the business. We'd notify you and this policy would continue to apply until it was replaced.

12. Your privacy choices and rights

We extend these rights to every Royal Theaters customer, regardless of which state you live in. Some states legally require this and some don't; we'd rather not make you check.

You can ask us to:

• Know what personal information we have about you and who we've shared it with
• Get a copy of your information in a portable format
• Correct anything that's wrong
• Delete your account and your personal information (Section 15)
• Opt out of marketing email and push notifications
• Opt out of any sale or sharing of your personal information — though as stated above, we don't do this

How to make a request: email royaltheatersinc@gmail.com with what you'd like us to do. You can also handle most of it yourself in your account settings or in the app.

Verification. To protect your account, we'll need to confirm it's really you before we act on a request about your information — usually by confirming control of the email address on the account. We can't fulfill a request we can't verify.

Timing. We'll respond within 45 days. If we need more time, we'll tell you why and take up to another 45 days.

Cost. Free, unless a request is repetitive or excessive, in which case we'll tell you before doing anything.

Authorized agents. You can have someone make a request for you. We'll need proof you authorized them.

No retaliation. We will never deny you service, charge you a different price, or take away your Royal Rewards benefits because you exercised a privacy right.

Appeals. If we deny your request, you can appeal by replying to our response or emailing royaltheatersinc@gmail.com with "Privacy Appeal" in the subject line. We'll give you a written answer within 45 days explaining our reasoning. If we deny the appeal, we'll tell you how to complain to your state attorney general.

13. Your California privacy rights

The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), gives California residents specific rights.

Whether the CCPA legally applies to us. The CCPA applies to businesses that meet at least one of three thresholds: annual gross revenue above roughly $26.6 million; buying, selling, or sharing the personal information of 100,000 or more California residents or households per year; or making at least half of their revenue from selling personal information. Royal Theaters is a small independent theater chain in eastern Idaho and does not meet any of these. We are therefore not currently a "business" as the CCPA defines it.

We're honoring these rights anyway. If you're a California resident, you have the right to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and be free from retaliation, exactly as described in Section 12. Use the same contact address: royaltheatersinc@gmail.com.

For the record, in the twelve months before the date at the top of this policy:

• Categories collected: identifiers (name, email, phone, account ID, IP address), customer records (postal address, payment token reference), commercial information (purchases, seat selections, rewards balances), internet activity (site and app usage), and age or date of birth.
• Sources: you, your device, our theaters' point of sale, and our ticketing provider RTS.
• Business purposes: everything listed in Section 9.
• Disclosed for a business purpose to: the service providers listed in Section 11.
• Sold or shared: none. We have not sold or shared personal information, including for cross-context behavioral advertising, and we do not sell or share the personal information of anyone under 16.
• Sensitive personal information: we do not collect it, so there is nothing to limit.

14. Rights in other states

As of 2026, roughly twenty states have comprehensive consumer privacy laws in effect, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Indiana, Kentucky, and Rhode Island, with more taking effect over the next few years.

Most of these laws apply only to businesses handling the data of 100,000 or more residents of that state per year, and Royal Theaters is well below those thresholds in every state. A few, including Texas and Nebraska, apply without a numeric threshold but exempt small businesses.

Rather than sort out which law covers which customer, we give everyone the same rights — see Section 12. Depending on your state, those may include the right to access, correct, delete, and obtain a copy of your data, to opt out of targeted advertising, sale, and profiling, and to appeal a denial. We honor all of them for all customers.

A note about Idaho. Idaho, where we operate, does not have a comprehensive consumer privacy law. Idaho does have a data breach notification statute (Idaho Code §§ 28-51-104 through 28-51-107) that we follow, and the Idaho Consumer Protection Act prohibits deceptive practices — including being dishonest in a privacy policy. We've written this one to be accurate.

15. Children and age requirements

You must be at least 13 years old to create a Royal Theaters account. Our website and app are general-audience services for people buying movie tickets. They are not designed for or directed at children under 13.

We do not knowingly collect personal information from children under 13. We ask for date of birth partly to check this. The Children's Online Privacy Protection Act ("COPPA") permits a general-audience service to collect age information for the purpose of screening out younger children, which is what we're doing.

If a child under 13 has created an account, or if you're a parent or guardian who believes we have collected information from your child, email us at royaltheatersinc@gmail.com. We will verify the situation, delete the account and the associated personal information promptly, and confirm to you when it's done. We do not require you to jump through hoops for this.

Children are of course welcome in our theaters. A parent or guardian can buy tickets for a child, and children can attend age-appropriate films — none of that requires the child to have an account or give us any information.

16. The mobile app

The Royal Theaters app for iOS and Android collects the same information described in this policy. A few app-specific points:

• App store privacy labels. The disclosures we file in Apple's App Privacy section and Google Play's Data safety form describe the same practices as this policy. If you ever see a discrepancy, tell us and we'll fix it.
• Permissions. The app asks for notification permission (optional, for order and showtime alerts) and camera permission only if you use a feature that needs it, such as scanning. You can decline any permission and still buy tickets.
• Account deletion in the app. You can delete your account from inside the app — see Section 17. Apple and Google both require this, and we agree with the requirement.
• Apple and Google are not responsible for this policy. They distribute the app; they don't control how we handle your information.

17. Deleting your account

You can delete your Royal Theaters account at any time. There are three ways:

1. In the app — open your account settings and choose to delete your account.
2. On the website — sign in at royaltheaters.com and use the account deletion option in your account settings.
3. By email — write to royaltheatersinc@gmail.com from the address on your account and ask us to delete it.

What happens when you delete. We remove your account and personal information from our systems and instruct RTS to do the same. Deletion is not instant everywhere — backups roll off on their own schedule, and we may keep a minimal record of completed transactions where tax, accounting, fraud-prevention, or legal-hold obligations require it. We won't use anything we're required to retain for marketing.

Please read this part before you delete. Deleting your account will forfeit any remaining Royal Rewards points, ticket credits, and money credits, and may affect gift or loyalty card balances tied to the account. We can't restore them afterward. If you have a balance you care about, spend it first or contact us before deleting. Tickets for showings you've already bought will still be honored — bring your confirmation.

18. How long we keep information

We keep your information as long as your account is open and you're using our services.

After that: account and purchase records are retained as long as needed for the purposes described in this policy and to meet tax, accounting, and legal requirements, then deleted or anonymized. Email verification codes and password reset codes are hashed — stored scrambled, never in readable form — and expire within minutes. Marketing preference records are kept as long as needed to keep honoring your opt-out, which means if you unsubscribe we keep just enough to remember not to email you.

19. How we protect your information

We take reasonable and appropriate measures to protect your information, including:

• Encryption in transit (HTTPS) across our website, app, and internal systems
• Passwords and one-time codes stored hashed, never in plain text
• Card data tokenized by Heartland so full card numbers never touch our systems
• Role-based access controls so staff can only see what their job requires, scoped by location
• Short-lived, single-use verification and password reset codes
• Reputable infrastructure providers (Google Firebase, Vercel) with their own security programs

No system is perfectly secure, and we won't pretend otherwise. Please use a strong, unique password for your Royal Theaters account and don't reuse it elsewhere. If you think your account has been accessed by someone else, contact us at royaltheatersinc@gmail.com right away.

If a breach happens. If a security incident affects your personal information, we will notify you as required by Idaho's breach notification law and any other applicable state law, without unreasonable delay.

20. Links to other sites

Our website and app link to places we don't control — studio sites, trailers, review sites, and payment pages. This policy doesn't cover them. If you follow a link off our site, the other company's privacy policy takes over.

21. Changes to this policy

We may update this policy as our services change or the law changes. When we do, we'll update the "Last updated" date at the top and post the new version here.

If we make a material change — something that meaningfully affects how we handle your information — we'll give you clear notice before it takes effect, by email if you have an account with us, or by a prominent notice on our website and app.

We'll keep prior versions available on request at royaltheatersinc@gmail.com.

22. Contact us

Questions about this policy, or want to make a privacy request? We'd rather hear from you than have you wonder.

Email: royaltheatersinc@gmail.com

Mail: Royal Theaters [MAILING ADDRESS]

You can also talk to a manager in person at any of our locations — the Paramount or the Centre in Idaho Falls, or our Blackfoot theater — though written requests are easier for us to track and respond to properly.

If you're not satisfied with how we've handled a privacy request, you may contact the Idaho Attorney General's Consumer Protection Division, or the attorney general of your own state if you live elsewhere.