Privacy Policy

Pocket Labs Pty Ltd (ABN 93 695 191 621, ACN 695 191 621, "PocketPass", "we", "us", or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our wallet pass customer management platform and services.

This policy is written with the Australian Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and the EU and UK General Data Protection Regulation (GDPR) in mind, where they apply.

1.1 If You Are a Golfer or Customer of a Club

Your club or merchant decides how your information is used in PocketPass and is the controller of it. We process it on their behalf under our Data Processing Addendum. Your club's own privacy notice applies, and requests about your information should go to them first. If you contact us, we will refer you to your club where we can identify it.

In your club's online account you can choose whether you get marketing messages (by email and on your wallet pass), download your data, and ask your club to delete it. Every marketing email has an unsubscribe link, and your wallet pass has a link to your marketing preferences.

1.2 If You Run a PocketPass Account

We are the controller of your account, billing and website information, which the rest of this policy describes.

2.1 Information You Provide

• Account information: name, email address, business name, phone number, billing address
• Payment information: billing details (processed securely through our payment provider)
• Business information: company details, industry type, location
• Customer data: information about your customers/customers that you upload or sync
• Communications: messages, feedback, and support requests you send us

2.2 Automatically Collected Information

• Usage data: requests and actions recorded in our server logs and audit log
• Device information: IP address, browser type, operating system, device identifiers
• Wallet pass data: installation status, pass updates, notification delivery status

2.3 Information from Third Parties

• Payment processors for transaction verification
• Integration partners (Lightspeed, etc.) with your authorization

• Service delivery: provide, maintain, and improve our platform
• Wallet pass management: generate, update, and deliver wallet passes to end users
• Communications: send service updates, notifications, and marketing (with consent)
• Payment processing: process subscriptions and handle billing
• Security: detect fraud, prevent abuse, and protect accounts
• Legal compliance: meet legal obligations and enforce our terms
• Support: respond to inquiries and provide customer support

4.1 Service Providers

• Supabase: database and authentication infrastructure
• Apple & Google: wallet pass delivery infrastructure
• Lightspeed: the integration you connect
• Email and hosting providers (AWS): transactional email and hosting
• Stripe or Peach Payments: card payments, where a merchant enables them
• Anthropic: the support assistant, which receives what you type and limited account details it looks up to answer you
• Intercom: support conversations you choose to start, in a workspace also used for our related Pocket product
• Cloudflare: bot protection on sign-in forms
• Google Maps: address search in the geofence form, if you use it
• Slack: internal notifications about new account signups and contact-form messages

The current list of sub-processors for customer data, with locations, is in Annex 3 of our Data Processing Addendum.

4.2 Transfers Between Golfers

If your club has switched on transfers and you choose to send or receive money, the other person sees your first name and last initial on the confirm screen, in their account history and on their email receipt, so you can both check it's the right person. To receive money you create a short-lived code and give it to the sender yourself. There is no member search, so nobody can find you unless you share a code. Your name is not shown to anyone if you never use this feature. Expired codes and abandoned attempts are deleted. Your club keeps a record of completed transfers.

4.3 Business Transfers

In a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before it becomes subject to a different privacy policy.

4.4 Legal Requirements

We may disclose your information if required by law, court order, or government request, or to protect our rights, property, or safety.

• Encryption in transit (TLS/SSL) and at rest
• Monitoring of application errors and failed background jobs
• Access controls and authentication requirements
• Least-privilege service credentials

No method of transmission or storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

We retain your information for as long as your account is active or as needed to provide services and comply with legal obligations. When you close your account, deletion starts 90 days later and finishes within about a week, except where retention is required by law.

• Support assistant conversations, outgoing webhook records and uploaded import files: 90 days
• Raw records received from point-of-sale systems: 30 days
• Message delivery logs: personal details removed after 13 months
• Financial records and audit logs: 7 years

When a customer is erased, financial amounts stay on the ledger without their details. We keep a keyed record so a sync can't re-create them, and a hashed address so an opt-out or bounce is still honoured. Text someone typed into the assistant can't be matched to a person, so it is removed by the 90-day limit.

7.1 Australian Users (Privacy Act 1988)

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion (subject to legal requirements)
• Opt out of marketing communications
• Complain to the Office of the Australian Information Commissioner (OAIC)

7.2 EU and UK Users (GDPR)

• Right to data portability
• Right to restrict processing
• Right to object to processing
• Right to withdraw consent
• Right to lodge a complaint with a supervisory authority, including the UK Information Commissioner's Office

7.3 Other Regions

Depending on where you live, including California and other US states, Canada, New Zealand and South Africa, you may have similar rights to access, correct or delete your information and to opt out of marketing. We do not sell personal information or share it for targeted advertising.

7.4 Exercising Your Rights

To exercise these rights, contact us at privacy@getpocketpass.com. We will respond within 30 days.

PocketPass is hosted in the United States, and our service providers may process information in the other countries listed in Annex 3 of our Data Processing Addendum. We ensure appropriate safeguards are in place, including standard contractual clauses and adequacy decisions where applicable.

PocketPass accounts are for adults. A club may hold records of junior golfers, and is responsible for them. Where a stored birthday shows someone is under 18, we exclude them from marketing messages and customer scoring. If you have a concern about a child's information, contact the club or us.

We use only the cookies needed to run the service: to keep you signed in, remember which club account you are working in, your display timezone (for the browser session) and your sidebar preference. We do not use analytics or advertising cookies.

Our login, signup and password forms use Cloudflare Turnstile to block automated abuse. Cloudflare may process your IP address and set a security cookie.

Some tools load only if you ask for them. If you choose "Talk to a person", we load Intercom, which sets its own cookies to run the chat. If you use address search in the geofence form, we load Google Maps, which may set cookies.

Club signup and portal pages show images the club uploaded. If a club adds other tools to its own website, its own policy applies.

We may update this Privacy Policy from time to time and will notify you of material changes. Continued use after changes constitutes acceptance.

OAIC complaints: if you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

See also our Terms and Conditions.