Who is responsible
Psychopaths LLC operates Psycho Paths, the immersive Halloween experience at West Oaks Mall, Ocoee, Florida, and this website at thepsychopaths.com. Psychopaths LLC decides what personal information is collected here and what it is used for — in the language of the data protection laws below, it is the controller.
| Company | Psychopaths LLC |
|---|---|
| Postal address | {{POSTAL_ADDRESS}} |
| Privacy contact | {{PRIVACY_EMAIL}} |
| Venue | West Oaks Mall, 9401 W Colonial Dr, Ocoee, Florida 34761 |
The ticketing, casting and door systems behind this site are operated for Psychopaths LLC by a service provider acting only on its written instructions. That provider is a processor: it holds the records so that this show can run, and it has no right to use them for anything else.
There are no cookies on this site
Not "no advertising cookies", and not "only essential cookies" — none. Nothing on thepsychopaths.com writes a cookie to your browser, so there is no storage consent to collect and no banner interrupting you to collect it. If you ever see a cookie banner on this domain, something is wrong and we would like to know.
What we record, and why
Four things happen on this site, and each one holds a different amount about you. Nothing below is collected "just in case".
| If you | We hold | Because |
|---|---|---|
| Just look at the site | The page you were on, how far down it you read, what you pressed, and a browser and device name chosen from a short list. Not your IP address. Not the full identification string your browser offers, because that string alone can single out a device. | To know which parts of the site work. This is our own measurement, on our own server — see below. |
| Join the mailing list | Your name and email address, and where you first arrived from. | Your consent, which you gave by submitting the form and can withdraw at any time. |
| Buy a ticket | Your name, email address, the night and entry window you chose, the party size, what you paid and an order reference. Never your card number — see the payments section. | To perform the contract you entered into: issuing the pass, admitting you at the door, and answering you if something goes wrong. |
| Apply to perform | The details on the casting form, including any links you supply to your own reels or portfolio. | To consider you for a role — steps taken at your request before entering into a contract. |
What we never ask for
We do not ask for and do not want your date of birth, your government identification, your address, your card number, or anything about your health. If a form on this site ever asks you for one of those, do not fill it in and tell us.
How we count visits
We count visits ourselves, on our own server, into our own database. There is no third-party analytics product on this site — no Google Analytics, no Meta analytics, nothing that reports your reading back to a company that sells advertising.
The two identifiers that tie one visit together live in the browser tab and are destroyed when you close it. That is a deliberate limit rather than an oversight: it means we count visits and not people. If you come back tomorrow, we have no way of knowing it was you.
We do not record your IP address, and we never read anything you type into a form unless you send it to us.
Advertising measurement, and the one company we share with
We advertise this show on the radio and on display networks. One measurement company — Magellan AI — is told when this site's home page is opened, when the box office is reached, and when a ticket is bought, together with the amount and the order reference. That is how the show learns which advertising actually sold tickets.
What Magellan is told: that an anonymous visit happened, the value of a basket, the value of a completed order, and an opaque order reference which lets them recognise a refreshed confirmation page as the same sale rather than a second one.
What Magellan is never told: your name, your email address, which night you booked, how many seats, or anything you typed into any form. The order reference resolves to a person only inside our own systems.
Magellan AI is the only company any information about your visit is sent to. If a second one is ever added, it will be named on this page on the day it is added.
Under California law this counts as a share of personal information for cross-context behavioural advertising, even though no money changes hands for it and no cookie is involved. It is named as such here rather than argued about, and the opt-out below is real.
We do not sell personal information, and never have.
Do Not Track and Global Privacy Control are honoured
If your browser sends a Global Privacy Control or Do Not Track signal, then on every page of this site: we record nothing at all, and the advertising pixel is never loaded — not suppressed after the fact, not loaded-and-ignored. No script from Magellan reaches your browser.
There is no setting to find and no box to tick. Your browser's own signal is the whole mechanism, and it is treated as a valid opt-out of sharing under the CPRA.
Do not sell or share my personal information
Because we share for advertising measurement, California residents have a right to tell us to stop. There are two ways to do it and they are equally effective:
- Turn on Global Privacy Control in your browser or extension. This works immediately, on every visit, with nothing submitted to us.
- Use the form below and choose Do not share my personal information. This records a standing instruction against your email address so that future campaign exports exclude you.
An opt-out is an instruction, not a deletion. What we keep on file for it is a one-way hash of your address and the reason — enough to check the next export against, and useless for anything else. If you want the underlying records gone as well, ask for erasure instead; you can ask for both.
Payments
Card details are taken by Square in fields served by Square, and they never reach this site. We do not see, receive, transmit or store your card number, its expiry or its security code at any point, which is the entire reason the checkout is built the way it is. What comes back to us is the outcome, the amount and a reference.
Square is an independent controller of the payment it processes and handles that data under its own privacy notice.
Confirmations, passes, casting replies and privacy correspondence are written by us and delivered by an email provider acting as our processor. They transmit the message; they do not use your address for anything else. Marketing email is sent only to people who asked for it and every message carries a working unsubscribe.
How long we keep things
Retention is set by Psychopaths LLC per record type and enforced in the database rather than left to somebody remembering. In outline: order and ticket records are kept while they are needed for the season, for accounting and for the period a card dispute can still be raised; casting applications are kept for the season they were made for and then removed; mailing-list entries are kept until you unsubscribe.
The exact figure for each record type is set by Psychopaths LLC and available on request through the form below. It is not printed here for one reason: a number typed into a document goes stale the first time it is changed anywhere else, and a retention period that is wrong in the notice is worse than one you had to ask for.
Children
This site is not directed at children under 13 and we do not knowingly collect their personal information. If you believe a child has given us information through this site, write to us and it will be removed.
Your rights
Which rights you have depends on where you are. The list below is drawn from our own systems rather than typed here, so it cannot offer you a right nobody has built a path for.
- Access — a copy of what we hold about you.
- Portability — that copy in a machine-readable form.
- Rectification — correction of anything wrong.
- Erasure — deletion of what we hold.
- Objection and restriction — a stop on particular uses (UK and EU).
- Opt out of sharing — the advertising opt-out above (California).
Exercising any of them is free and we will not treat you differently for it. We answer within 30 days under the UK and EU regimes, and within 45 days under California law. If a request is genuinely complicated we may extend that, and if we do we will tell you inside the original period and say why.
Verification is the point of the email step. Handing someone else's ticket history to whoever types their address into a form would be a data breach committed in the course of complying with a privacy law. So nothing is disclosed until a link sent to that address comes back, and this form gives the same answer whether or not we have ever heard of the address you enter.
Make a request
The form is a convenience and not the only route. You can write to the postal address at the top of this page instead, and your rights do not depend on this form working.
Complaints
If you are unhappy with how we have handled your information, tell us first — most of it is fixable. You also have the right to complain to a regulator: the Information Commissioner's Office in the UK, your national supervisory authority in the EU, or the California Privacy Protection Agency or state Attorney General in California.
Changes to this notice
When this notice changes, the "last updated" date at the top changes with it. A change that materially affects what we do with information already held will be announced by email to the people it affects rather than left here to be discovered.