Important: Draft pending legal review
DRAFT — pending review by a qualified attorney. This draft describes how this website and booking system actually work as built. Replace every
[PLACEHOLDER]and have it reviewed before approval. It is not legal advice.
Business: [PLACEHOLDER] Business name, [PLACEHOLDER] street address, Batavia, Illinois [PLACEHOLDER] ZIP Privacy contact: [PLACEHOLDER] privacy email, [PLACEHOLDER] phone
This policy explains what personal information we collect when you use our website, create an account, book a golf simulator session (with an account or as a guest), why we collect it, who we share it with, how long we keep it, and the choices you have.
Information we collect
Account information. When you create an account we collect your name and email address. Your password is handled by our authentication provider (Supabase) and stored only in hashed form; we never see it. If you choose "Continue with Google," Google shares your name and email address with us.
Optional contact details. You may add a phone number to your profile. We use it only to reach you about a booking.
Guest bookings. You can book without an account. We then collect your name, email address, and phone number with the booking and use them only for that booking: confirmations, receipts, changes, and contacting you if something affects your session. Your booking emails contain a private link that lets you view or cancel the booking; anyone who has that link can do so, so please keep those emails to yourself. We do not send marketing email to guests.
Booking information. The date, time, length, and price of each booking, any promo code used, any note you add for staff, the version of our terms you accepted, and the booking's history (for example, held, confirmed, cancelled, refunded).
Payment information. Payments are processed by Stripe on Stripe's own secure checkout page. We do not receive or store your full card number or security code. Stripe sends us the payment amount, status, and Stripe reference numbers, which we keep with your booking.
Your choices and consents. Whether you agreed to receive marketing email, and when; your acceptance of booking terms; and, if our age policy requires it, your confirmation that you meet the age requirement.
Messages and requests. What you send us through the contact form or a privacy request, including your name, email, optional phone number, and any booking reference.
Security information. To protect accounts and the booking system we record events such as failed sign-in attempts and blocked requests. Internet (IP) addresses used for rate limiting and security logs are converted to one-way keyed hashes; we do not store raw IP addresses in our database. Our hosting provider may keep standard server logs that include IP addresses for a limited time.
Cookies. We use only cookies that are strictly necessary to keep you signed in and to protect sign-in (see our Cookie Notice). We do not use analytics, advertising, or cross-site tracking cookies or pixels.
How we use information
- To create and manage your account and bookings, process payments, and issue refunds.
- To send transactional email: booking confirmations and receipts, changes, cancellations, refunds, and responses to requests.
- To provide customer support and respond to accessibility reports, complaints, and privacy requests.
- To keep the service secure, prevent fraud and abuse, and troubleshoot problems.
- To keep business, accounting, and tax records and meet legal obligations.
- To send news and offers by email, only if you opted in. You can opt out at any time.
We do not sell your personal information, and we do not use it for targeted advertising.
Who we share information with
We share information only with service providers that help us run the business, under their terms and only as needed:
| Provider | What they do | Information involved |
|---|---|---|
| Supabase | Database and account sign-in | Account, booking, and request records |
| Stripe | Payment processing and refunds | Payment details you enter on Stripe's page; booking reference and amount |
| Resend | Sending email | Your email address and the email content |
| Vercel | Website hosting | Requests to the website, including IP addresses in server logs |
| Google (only if you use Google sign-in) | Sign-in | Your Google account name and email |
| [PLACEHOLDER: Cloudflare Turnstile, only if enabled] | Bot protection on sign-in forms | Browser and device signals used to detect bots |
We may also disclose information if required by law, to protect our rights or the safety of others, or as part of a sale or transfer of the business (with notice where required).
How long we keep information
| Information | How long |
|---|---|
| Account profile | While your account is open. Deleted or anonymized when you delete your account. |
| Booking and payment records (including guest name, email, and phone) | [PLACEHOLDER: number] years after the booking, as required for tax and accounting purposes, then kept only without your name, email, phone, or notes. After account deletion or a guest deletion request, they are kept without those details. |
| Contact messages and privacy requests | [PLACEHOLDER: retention period] |
| Security event logs | About 180 days |
| Rate-limiting counters | About 2 days |
| Contents of sent emails stored for delivery | Recipient and content removed after about 90 days |
| Consent records | As long as needed to show what you agreed to, including after you opt out |
Your choices and rights
- Access: download a copy of your information at any time from Account > Privacy and data. If you booked as a guest, contact us and we will send you a copy after verifying your email address.
- Correction: update your name and phone in your profile, or ask us to correct other information.
- Deletion: ask us to delete your account, or, if you booked as a guest, contact us from the email address you booked with. We will delete or anonymize your personal information, except records we must keep for legal, tax, or accounting reasons, which we keep without identifying details where possible. We cannot remove details from a booking that has not happened yet; cancel it first or ask us to.
- Marketing: opt out using the link in any marketing email or in your profile.
We may need to verify your identity before acting on a request. Depending on where you live, you may have additional rights under local law; contact us and we will respond as the law requires. [PLACEHOLDER: attorney to confirm whether any state privacy law applies and add required disclosures.]
Security
We use HTTPS encryption, access controls that limit each person to their own records, two-step verification for staff accounts, audit logging of staff actions, and payment processing on Stripe's hosted checkout so card numbers never reach our systems. No system is perfectly secure. If a security breach affects your personal information, we will notify you and the authorities as required by law.
Children
Our website is not directed to children under 13, and we do not knowingly collect personal information from children under 13. [PLACEHOLDER: describe the age policy chosen in the admin settings.] If you believe a child has given us personal information, contact us and we will delete it.
Changes
We will post changes here with a new effective date. If a change materially affects how we use information you already gave us, we will notify you.
Contact
[PLACEHOLDER] Business name, [PLACEHOLDER] address, Batavia, IL [PLACEHOLDER] ZIP. Email [PLACEHOLDER]. Phone [PLACEHOLDER].