Privacy Policy

OpenTeeSheet is a tee time booking platform operated by Heron Networks LLC. We connect golfers with venues that want to take bookings directly, without a middleman. This privacy policy explains what information we collect, why we collect it, and how we use it. We've written it in plain English because we actually want you to read it. If something isn't clear, email us at privacy@openteesheet.com and we'll explain it.

When you create an account or make a booking, we collect: • Your name, email address, and phone number • Payment details — processed securely through Stripe; we never store full card numbers • Booking history: venue, date, time, bay, and duration • If a venue asks you to accept a waiver: your name, email address, the time you accepted, your IP address, and which version of the waiver (with a fingerprint of its exact text) you accepted. The venue can see and export this record. • If a venue has a no-show fee: a saved card, kept by Stripe (we only keep Stripe's reference to it), together with the fee, the wording you agreed to, and when and from where you agreed. It is used only for that one fee. • Device and browser info when you use our website (IP address, browser type, approximate location from IP) When a venue signs up, we also collect business details: venue name, address, contact info, banking details for payouts (via Stripe Connect), and simulator/course inventory. We do not collect anything we don't need. We don't buy or broker data from third parties.

Your information is used to: • Process and confirm your bookings • Send your PIN code and venue access instructions via SMS or email • Send booking reminders and receipts • Let you manage your booking history and alerts • Improve the platform (we analyze aggregate usage patterns, not individual behavior) • Prevent fraud and abuse • Respond to your support requests We don't use your data for advertising. We don't sell it. We don't use it to build behavioral profiles for resale.

We share data only when necessary: Venues: When you make a booking, the venue receives your name, phone number, and booking details. They need this to serve you. Venues agree to our terms and may not use this data for marketing without your consent. Stripe: Payment processing. Stripe is PCI-compliant and has its own privacy policy at stripe.com/privacy. Hosting and database: the site and API run on Cloudflare and booking data is stored in a Neon (PostgreSQL) database. Email delivery: sign-in codes, receipts and reminders are sent through transactional email providers (Brevo, with Resend and Postmark as fallbacks). They receive the recipient address and the message, and nothing else. SMS delivery: We use a third-party SMS provider (such as Twilio) to send your PIN codes and reminders. They receive your phone number for delivery purposes only. Legal: We may disclose information if required by law, court order, or to protect the safety of users. We do not share your data with advertisers or data brokers. The only analytics provider is Cloudflare, which already hosts the site (see Cookies and analytics below).

We use a small number of cookies: • Session cookies: to keep you logged in • Preference cookies: to remember your search filters and settings We count visits with Cloudflare Web Analytics. It sets no cookies, uses no local storage and does not fingerprint visitors. For each page view Cloudflare records the page address, the referring site, the browser, operating system and device type, and the country (worked out from the IP address, which is not kept for analytics). We see only totals, never an individual visitor. We use no Google Analytics, no advertising pixels and no cross-site trackers, so there is no cookie banner. We also keep daily totals of a few steps (for example sign-ups and checkout starts) with no visitor identifier attached. We don't use third-party advertising cookies. You can clear cookies at any time in your browser settings. The site works without cookies except for login sessions.

You have the right to: • Access: request a copy of all data we hold about you • Correction: ask us to fix inaccurate information • Deletion: request that we delete your account and associated data. We'll comply within 30 days, except where we're required to retain records (e.g., financial transaction records for tax purposes, typically 7 years) • Portability: request your booking history in a machine-readable format • Opt-out: unsubscribe from non-transactional emails at any time via the link in any email. You cannot opt out of transactional messages (booking confirmations, PIN codes) while a booking is active. California residents have additional rights under CCPA. EU/UK residents have rights under GDPR. Contact us and we'll honor them regardless of where you live. To exercise any of these rights, email privacy@openteesheet.com.

Heron Networks LLC Privacy questions: privacy@openteesheet.com General: hello@openteesheet.com Business phone: (703) 249-9248 We aim to respond to all privacy requests within 5 business days.