DRAFT, not yet reviewed by an attorney. Items in [brackets] need to be filled in or confirmed before this is published.

Privacy Policy

Effective [date]. Last updated [date].

Who we are

CartBarnIQ ("we", "us") makes software that golf courses use to run their cart fleets: checking golfers in to a cart, unlocking the cart, documenting its condition, and handling any damage claims. Our customers include public, municipal and private golf courses.

When you play at a course that uses CartBarnIQ, we handle your information on behalf of that course. The course decides why and how your information is used, and its own privacy policy also applies. Courses run by a city, county or other public agency may also be subject to public records laws.

Information we collect

From golfers

• Contact details: your name, mobile number and email address, given to the course or entered by you.
• Round details: your group name, tee time, assigned cart, and when the round started and ended.
• Payment card: card details are entered directly into our payment processor (Square). We never see or store your full card number. We keep only the card brand, last four digits, expiration date, and a token from the processor that lets the course charge the card under the terms you agreed to.
• Signed agreement: your signature, the version of the terms you signed, and the time, IP address and device type when you signed.
• Cart condition: photos of the cart taken by you or course staff, notes about existing damage, and issues you report at the cart.
• Claims and payments: damage claims, itemized estimates, disputes, charges, refunds and receipts.
• Messages: a record of texts and emails we send you, and whether you opted out of texts.

From course staff

• Name, work email, role, and sign-in records. Passwords are stored only as a secure one-way hash.
• Actions taken in the app, such as starting rounds, inspections, claims and charges, so there is a record of who did what.

How we use it

• To check you in, assign and unlock your cart, and run the cart screen.
• To document the cart's condition before and after your round.
• To send you texts and emails about your round, and about any damage claim, payment, refund or receipt.
• To process payments, refunds and disputes through the course's payment processor.
• To keep the service secure, prevent fraud, and meet legal obligations.

We don't sell your personal information, and we don't use it for advertising. We don't send marketing texts.

Text messages

We text only people who have agreed to get texts about their round. Texts are about your cart, check-in, and any damage claim. Message and data rates may apply. Reply STOP to opt out or HELP for help. See our Text Message Terms.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties, except the service providers that deliver our messages.

Who we share it with

• The golf course where you play, which is our customer.
• Service providers that run parts of CartBarnIQ for us, under contracts that limit how they use your data:
  • Cloudflare, for hosting, data storage and email delivery
  • Square, for payment processing
  • Twilio, for text message delivery
• As required by law, such as a subpoena, court order, or a public records request to a public course, or to protect people's safety or our legal rights.

How long we keep it

We keep information as long as the course's settings and the law require. By default: [round, photo and message records for X months; signed agreements, claims and payment records for X years, for disputes and accounting]. Saved cards are removed after [X days] unless needed for an open claim. Public courses may be required to keep some records longer under their records retention schedule.

How we protect it

• All data is encrypted in transit (HTTPS) and at rest.
• Each course can see only its own data. Staff access depends on their role.
• Passwords and access links are stored only as secure hashes. Full card numbers never reach our systems.
• [Independent security audit, such as SOC 2, once completed.]

Your choices

• Texts: reply STOP at any time to stop texts. Reply START to turn them back on.
• Access, correction and deletion: contact the course or us. We'll respond as required by applicable law, but we may need to keep some records, such as a signed agreement or an open claim, for legal or accounting reasons.

Children

CartBarnIQ isn't meant for children under 13, and we don't knowingly collect their information. Cart drivers must meet the course's age requirement.

Changes

If we change this policy, we'll update the date above. For significant changes we'll notify the courses we work with.

Contact us

CartBarnIQ, [business address]
[privacy@cartbarniq.com]