Standing Privacy Policy

Effective Date: October 11, 2026

Version: 1.0

Operated by: 17101112 Canada Inc., doing business as “Standing”

This policy is offered in English, Canadian French, and Simplified Chinese. The English version governs in the event of any conflict.

Plain-English Summary

Who we are. Standing is a Canadian golf league and tournament app run by 17101112 Canada Inc. (d/b/a “Standing”), based in Toronto, Ontario.

What we collect. Your name and mobile number (required to sign in); optional email, handicap, and league details; scores and attendance; payment ledger entries; and basic device and security logs.

Why we collect it. To run your leagues and tournaments, send you messages you’ve agreed to receive, process payments, keep the app secure, and improve the service.

Who sees it. Other league members see names, scores, and standings — never your phone number or email. Organizers see their own league’s data. We do not sell your data or use it for advertising.

Your rights. You can access, export, correct, or delete your data at any time — mostly through the app itself. We respond to requests within 30 days.

Questions? Contact our Privacy Officer: Daniel Yang — hello@standingleague.com.

1. Who We Are

Legal name: 17101112 Canada Inc., doing business as “Standing”

Federal Corporation No.: 1710111-2

Standing is accountable for the personal information it controls, as required by the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA”), Schedule 1, Principle 1, and An Act respecting the protection of personal information in the private sector, CQLR c P-39.1, as amended by Law 25 (“Law 25”), s. 3.1.

2. Scope and Applicability

This policy applies to all personal information Standing collects, uses, or discloses in connection with the Standing app and website from users across all of Canada and the United States. We comply with applicable federal, state, and provincial privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, comprehensive state privacy laws in the United States, and Quebec's Act respecting the protection of personal information in the private sector (Law 25).

This policy covers information about:

golfers and league members;
tournament entrants;
league organizers and course staff;
visitors to the Standing website.

Dual-role notice. Standing acts as a controller for personal information it collects for its own operational purposes (account management, security, service improvement). Standing acts as a processor for personal information that golf courses and their organizers collect about their golfers. Section 10 explains this distinction and its consequences for golfers.

3. Information We Collect

3.1 Everyone — Shared Account Identity

The following applies to all account holders:

Mobile phone number (required) — used to sign in via one-time code and to receive league texts.
Name (required).
Email address (optional).
Golf handicap index (optional).
Text-message consent status (optional, off by default) — your opt-in choice and STOP status.
Sign-in session data — session token, timestamps, device type.
Language preference — English, Canadian French, or Simplified Chinese.
Google sign-in data (optional, if you use Google sign-in) — name and email address provided by Google.
App push token (optional) — to deliver push notifications.

3.2 Golfers (League Members)

In addition to the shared identity above:

Attendance (In/Out per round).
Hole-by-hole scores, scorecards, and optional stats.
Calculated handicap records and handicap history.
Standings, season summaries, and awards.
Team assignment, tee selection, keep-with/not-with requests.
Substitute-pool availability and opt-in status.
Ledger entries: dues, green/cart/bay fees, buy-ins, payments, winnings, payouts, and season-pass share.
Private organizer notes (entered by the organizer, visible only to that organizer and authorized course staff, never shown to the golfer).
Course-card mistake reports: reporter’s account identifier and message text.

3.3 Tournament Entrants

Tournament entrants sign in by mobile number. We collect:

Name (required).
Mobile phone number or email address (at least one required; email is optional if a phone number is provided).
Text-message consent status (optional).
Answers to organizer-defined entry questions (e.g., handicap, meal choice) (optional; defined by the organizer, not by Standing).
Scores entered during the tournament.

Tournament entrant data is visible only to the organizer of that tournament.

3.4 Organizers and Course Staff

In addition to the shared identity above:

Role on the course account (owner, manager, staff, or front desk).
Course or venue name, city, province, optional logo, and venue type.
Stripe account identifier and payout-readiness status (Standing never stores bank account or card numbers — see Section 20).

3.5 Location Information

Find-a-league: approximate location derived from a network lookup (not stored) or a location you choose to share (rounded to reduce precision, not stored).
Course geocoding: a course address is geocoded once via OpenStreetMap Nominatim to place it on a map. The resulting coordinates are stored as part of the course record, not linked to any individual.

3.6 Automatically Collected Information

Device and browser type; operating system; IP address (redacted in logs).
Security logs — sign-in attempts, code delivery, rate-limit events; phone numbers, codes, and payment data are redacted before logging.
Error reports via Sentry (PII scrubbed before transmission).
Aggregate usage counts via PostHog, if enabled — server-side only, keyed to a league, not to an individual; no advertising cookies.

3.7 What We Never Collect

Payment card numbers or bank account numbers (handled entirely by Stripe).
Precise or stored GPS location.
Advertising identifiers or third-party tracking data.

4. Purposes of Collection and Use

We collect and use personal information only for the following purposes:

a. League and event operations. Creating and managing leagues, tournaments, pairings, scorecards, standings, handicaps, awards, and the substitute pool.

b. Communications. Sending texts, push notifications, and emails that you have consented to receive, including sign-in codes, league reminders, organizer “Send a Notice” messages, entry confirmations, and receipts.

c. Payment processing. Recording dues, fees, buy-ins, winnings, and payouts in the ledger; facilitating payments through Stripe where enabled.

d. Security. Authenticating sign-ins, detecting and preventing fraud and abuse, rate-limiting, bot protection, and enabling “sign out on every device.”

e. Service improvement. Diagnosing errors, monitoring performance, and understanding aggregate usage patterns to improve the app.

f. Legal compliance. Meeting obligations under applicable Canadian law, including tax record-keeping and breach notification.

We do not sell personal information. We do not use personal information for third-party advertising.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.

(PIPEDA, Sch. 1, Principles 3 & 4; Law 25, ss. 12–14; CASL, S.C. 2010, c. 23, s. 10)

Express consent is obtained at sign-up for all data collection described in this policy. Consent checkboxes are separate and unbundled — you are not required to consent to optional communications (texts, push, email) as a condition of using the core service.

Implied consent applies to existing users who have had an active business relationship with Standing within the past two years, for commercial electronic messages consistent with that relationship, as permitted by CASL.

Withdrawal. You may withdraw consent at any time by:

replying STOP to any text message;
turning off notifications on your Account page;
declining optional cookies via the cookie-settings link;
deleting your account (Section 16).

Withdrawal may limit features that depend on the withdrawn consent. It does not affect the lawfulness of processing before withdrawal, and it does not override legal retention obligations.

5A. Sensitive Personal Information

Standing does not typically collect or process sensitive personal information as defined by applicable privacy laws. However, if we do collect sensitive data (such as precise geolocation, health data, or other categories defined as sensitive under your jurisdiction's law), we apply heightened protections and obtain appropriate consent.

Jurisdiction-Specific Sensitive Data Requirements:

• California: California law provides a "limit use and disclosure" right rather than requiring opt-in consent. California residents may limit our use of sensitive personal information to purposes necessary to perform services reasonably expected by the consumer.

• All Other U.S. States with Comprehensive Privacy Laws: These states require opt-in consent or separate consent before processing sensitive personal information. We obtain such consent before processing sensitive data of residents of these states.

• Maryland, Oregon, and Minnesota: These states impose additional restrictions on the processing of sensitive personal data beyond standard consent requirements.

• Quebec: Heightened consent requirements apply for sensitive information under Law 25.

• British Columbia and Alberta: PIPA requires heightened consent and safeguards for sensitive information.

• Other Canadian Jurisdictions: PIPEDA requires meaningful consent, with heightened requirements for sensitive personal information.

We do not sell or share sensitive personal information for cross-context behavioral advertising or targeted advertising.

6. How Information Is Shared

We share personal information only with the service providers listed below, and only to the extent necessary for the stated purpose. We do not sell personal information or share it for third-party advertising.

Supabase — Database, authentication, file storage, and background jobs. Hosts essentially all account and gameplay data (names, phone numbers, emails, handicap indexes, scores, payment ledger). Data is stored in the Canadian region (ca-central-1); Supabase is a US company. Bound by the Supabase Data Processing Agreement.

Vercel — Application hosting and content delivery. Receives all web requests in transit and operational logs (personal identifiers redacted). United States. Bound by the Vercel Data Processing Agreement.

Twilio — Text messaging. Receives mobile phone numbers and the content of league texts and one-time sign-in codes. United States. Bound by the Twilio Data Processing Agreement.

Resend — Transactional email. Receives email addresses and the content of account emails (entry confirmations, receipts, reminders). United States. Bound by the Resend Data Processing Agreement.

Expo — Mobile push notifications. Receives device push tokens and notification content. United States. Bound by Expo/EAS terms.

Stripe — Payment processing and payouts. Receives payment and cardholder data directly from the user; for courses collecting dues, their banking and identity details go directly to Stripe. Standing stores only Stripe account identifiers, payout-readiness status, and transaction ledger entries. United States and Canada. Bound by the Stripe Data Processing Agreement.

Anthropic — AI assistance for league setup and scorecard reading. Receives only the text or scorecard image submitted for processing (which may contain names and scores); photos are not stored by Standing after processing. United States. Bound by Anthropic’s commercial terms with zero-retention API handling.

Google — Optional sign-in. Receives a sign-in request and returns the user’s Google name and email. United States. Bound by Google’s Data Processing Terms.

OpenStreetMap Nominatim — Geocoding. Receives a course street address to return map coordinates. European Union. Subject to OpenStreetMap’s terms of service.

Sentry — Error monitoring, if enabled. Receives error reports with personal identifiers scrubbed before transmission. United States. Bound by the Sentry Data Processing Agreement.

PostHog — Usage analytics, if enabled. Receives server-side aggregate usage counts keyed to a league, not to an individual; no personal profiles; no cookies. United States. Bound by the PostHog Data Processing Agreement.

Cloudflare Turnstile — Bot protection, if enabled. Receives IP address and challenge data. United States and global. Bound by Cloudflare’s Data Processing Addendum.

Visibility within the app:

League members see names, pairings, scores, standings, and awards. Phone numbers and email addresses are never visible to other golfers.
Public results pages and TV scoreboards show names and scores only if the organizer has made them public.
The substitute pool shows an opted-in golfer’s name and home league only — no contact details — to other organizers at the same course.
Find-a-league and course pages show course and league names only; private clubs are hidden; no golfer information is shown.
Prospect preview pages are accessible only via a private link and are claimed by signing in with a staff number published on the course’s own website.
Organizers and staff see their own league’s contacts, attendance, ledger, and entries according to their role; front-desk staff have the most limited access and cannot view financial data.

7. Cross-Border Transfers

(Law 25, s. 17; PIPEDA, Sch. 1, Principle 7)

The primary database is stored in Canada (Supabase, ca-central-1 region). The following service providers process data outside Canada:

United States: Vercel, Twilio, Resend, Expo, Stripe, Anthropic, Google, Sentry, PostHog, Cloudflare Turnstile.
European Union: OpenStreetMap Nominatim.

Data transferred outside Canada may be subject to the laws of the receiving country, including lawful access by foreign governments. We have entered into data processing agreements with each provider that include contractual safeguards equivalent to standard contractual clauses. As required by Law 25, we have conducted a Privacy Impact Assessment for cross-border transfers of personal information of Quebec residents.

Jurisdiction-Specific Cross-Border Requirements:

• United States: No U.S. state law in the comprehensive privacy statutes imposes a general cross-border transfer prohibition or adequacy requirement. However, ordinary controller/processor contracts, security measures, notice requirements, and assessment duties apply.

• Quebec: Privacy impact assessments are required for transfers of personal information outside Quebec where there is a risk of serious injury (Law 25, s. 17).

• British Columbia: PIPA requires accountability, consent or purpose alignment, and appropriate safeguards for cross-border transfers.

• Alberta: PIPA requires accountability, consent or purpose alignment, and contractual safeguards for cross-border transfers.

• Nova Scotia: The Personal Information International Disclosure Protection Act, S.N.S. 2006, c. 3 imposes additional requirements for cross-border transfers of personal information.

• All Jurisdictions: We maintain appropriate contractual safeguards with all service providers, implement security measures, provide notice of cross-border transfers, and conduct assessments as required by applicable law.

8. Controller–Processor Relationship

(PIPEDA, Sch. 1, Principle 1; Law 25, s. 3)

Golf courses and their organizers are the accountable controllers for the personal information of their golfers. Standing processes that information as a service provider under a Data Processing Addendum entered into with each course.

If you have questions about how your course collects or uses your personal information, please contact your league organizer or course directly. Standing will refer course-specific data inquiries to the relevant organizer where appropriate.

9. Automated Decision-Making

(Law 25, s. 12.1)

Handicap calculations, pairing assignments, and substitute-pool offers are determined by fixed, rule-based algorithms. They do not involve AI profiling, machine learning, or decisions based on personal characteristics beyond the golf data you provide. Organizers retain full control and may review and correct any output at any time.

Jurisdiction-Specific Rights:

• Quebec residents have the right to request that a human review any automated decision that significantly affects them, and to receive an explanation of the factors and parameters that led to the decision (Law 25, s. 12.1).

• Minnesota residents have rights to profiling explanations, review, and re-evaluation under Minn. Stat. §§ 325M.10–.24.

• Connecticut residents have rights regarding solely automated significant decisions under Conn. Gen. Stat. §§ 42-515 to -526.

• Colorado residents have opt-out rights and protections for profiling under Colo. Rev. Stat. §§ 6-1-1301 to -1314.

• California residents have automated-decision notice and opt-out provisions under CCPA/CPRA, Cal. Civ. Code §§ 1798.100–1798.199.100.

• Most other comprehensive state privacy laws provide opt-out rights only for profiling producing legal or similarly significant effects.

• British Columbia and Alberta residents have access and correction rights, but no specific automated-decision explanation requirement has been confirmed under their respective PIPA statutes.

See Section 14A for complete details on your jurisdiction-specific rights.

10. Cookies and Tracking Technologies

(Law 25, s. 8; CASL, s. 8)

Essential cookies (always active — no consent required):

Sign-in session — authenticates your requests and keeps you signed in.
Language preference — remembers your chosen language for one year.
Security — protects sign-in forms against cross-site attacks and abuse.
Consent record — stores your cookie-banner choice.

Optional technologies (active only after you opt in via the cookie banner):

Analytics (e.g., PostHog, Google Analytics) — to understand how the app is used and improve it.
Advertising and conversion measurement (e.g., Meta Pixel, Google Ads, TikTok) — to measure and improve advertising campaigns.

No optional cookie or pixel is placed on your device until you accept. Optional boxes are never pre-ticked. You may change or withdraw your cookie choice at any time via the cookie-settings link in the app footer; declining does not affect your use of Standing. Some analytics also run server-side without placing cookies on your device.

11. Commercial Electronic Messages and CASL

(CASL, ss. 6(2)(a), 6(2)(c), 10, 13)

Consent basis:

Existing users (active within the past two years): implied consent based on an existing business relationship.
New sign-ups: express opt-in consent obtained at sign-up, separately for texts, push notifications, and email.

Every commercial electronic message we send includes:

Standing’s name and a physical mailing address.
A clear, one-click unsubscribe mechanism (or STOP for SMS).

Unsubscribe: Unsubscribe requests are honoured within 10 business days. Replying STOP to any text removes you from all Standing text messages immediately. STOP status is retained indefinitely so we never text you again.

Organizer “Send a Notice” messages sent through Standing are commercial electronic messages subject to CASL. Organizers are responsible for ensuring they have the required consent from recipients before using this feature.

Consent records — including consent type, date, and source — are retained for at least three years after the last message or after consent is withdrawn.

12. Data Retention

(PIPEDA, Sch. 1, Principle 5; Law 25, s. 23; Income Tax Act, R.S.C. 1985, c. 1 (5th Supp.), s. 230; Breach of Security Safeguards Regulations, SOR/2018-64, s. 9)

Account identity (name, mobile number, email, handicap index): retained while your account is active. Anonymized within 30 days of account deletion or after 24 consecutive months of inactivity.

League and play history (scores, attendance, standings, substitute history): retained for the life of the league to preserve accurate historical results. On account deletion, personal identifiers are removed and remaining results are anonymized.

CASL consent records (opt-in type, date, source): retained for at least three years after the last message or after consent is withdrawn.

STOP/opt-out records: retained indefinitely.

Financial and payment records (dues, ledger entries, Stripe transaction identifiers): retained for seven years, as required by the Income Tax Act.

Security and support logs (with personal identifiers redacted): retained for 90 days.

Breach register: retained for at least 24 months, as required by SOR/2018-64, s. 9.

Error and usage data (Sentry, PostHog): retained for 90 days.

Rolling database backups: overwritten on an approximately 30-day cycle; deleted data ages out of backups within that window.

Prospect and business-contact data: retained for up to 24 months of no engagement, then deleted.

Anonymization vs. deletion. Where deletion would destroy accurate historical records (e.g., past scores, financial summaries), we anonymize the data so it can no longer identify you, rather than erasing the record entirely. Anonymized data is no longer personal information.

13. Security Safeguards

(PIPEDA, Sch. 1, Principle 7; Law 25, s. 20; SOR/2018-64)

Technical safeguards:

All data in transit is encrypted via HTTPS/TLS; the app refuses to operate on a non-HTTPS connection in production.
Data at rest is encrypted in the Supabase Postgres database.
Row-level security is enforced at the database layer, scoping each query to the authenticated league and account so one league’s data is never accessible to another.
Contact details (phone numbers, email addresses) are readable only server-side and are never exposed through the public API.
Sign-in is passwordless — one-time codes sent to your mobile number, expiring quickly, with rate-limited delivery.
Role-based permissions (owner, manager, staff, front desk; organizer, golfer, sub) are enforced server-side on every sensitive action.
Payment card and bank data never passes through Standing’s servers.
Payment webhooks are signature-verified; shareable links are cryptographically signed.
Bot protection, honeypot fields, IP-based rate limiting, SMS-pumping protection, and daily messaging spend limits are in place.
Security events are logged in structured, queryable form with personal identifiers redacted; anomalies trigger alerts.
Credentials are stored as encrypted environment secrets and are never committed to the codebase; automated scanning detects accidental exposure.
The primary database is hosted in Canada (Supabase, ca-central-1).
Daily automated backups enable data restoration after a failure.

Organizational safeguards:

Least-privilege access to production systems; multi-factor authentication on all administrative accounts.
A written incident-response and breach-notification process (see Section 18).
Regular dependency updates and security review of changes before release.

No security system is perfect. We work continuously to improve these measures.

14. Your Privacy Rights

(PIPEDA, Sch. 1, Principles 6 & 9; Law 25, ss. 27–28)

Access. You may request a copy of the personal information we hold about you. Most of your information is visible when you sign in.

Export (portability). Use Export my data on your Account page to download your personal information in a portable, machine-readable format. This right is available to all users and satisfies the portability right under Law 25, s. 27, for Quebec residents.

Correction. Edit your name, mobile number, and other profile details on your Account page. Score or standing corrections are made by your league organizer.

Deletion. Use Delete my account on your Account page. We remove your personal identifiers and anonymize any historical records that must be retained for accuracy or legal compliance. Records subject to mandatory retention (e.g., financial records for seven years) are retained only for the required period and then deleted. Your STOP status is retained indefinitely.

Withdrawal of consent. Reply STOP to any text, turn off notifications on your Account page, or delete your account. See Section 5.

Human review of automated decisions (Quebec residents). See Section 9.

How to submit a request. Use the self-serve tools in the app, or email hello@standingleague.com. Because sign-in is tied to your mobile number, we verify your identity through the number on file before acting on a written request.

Response time. We respond within 30 days. If a request is complex and requires more time, we will notify you of the reason and provide a revised date. Reasonable requests are free of charge.

Refusals. If we cannot fulfill a request (for example, because a record has been anonymized or is subject to a legal retention obligation), we will explain the reason in writing.

14A. Your Rights by Jurisdiction

This section provides specific information about privacy rights available to residents of different U.S. states and Canadian provinces and territories. These rights are in addition to the general rights described in Section 14 above.

14A.1 United States State-Specific Rights

The following states have enacted comprehensive consumer privacy laws. If you are a resident of one of these states, you have the rights described below in addition to the general rights in Section 14.

(a) California

Applicable Law: California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), Cal. Civ. Code §§ 1798.100–1798.199.100

Your Rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you.

• Right to Delete: Request deletion of your personal information, subject to certain exceptions.

• Right to Correct: Request correction of inaccurate personal information.

• Right to Portability: Request a copy of your personal information in a portable, machine-readable format.

• Right to Opt-Out of Sale: We do not sell personal information.

• Right to Opt-Out of Sharing for Cross-Context Behavioral Advertising: We do not share personal information for cross-context behavioral advertising.

• Right to Limit Use and Disclosure of Sensitive Personal Information: You may limit our use of sensitive personal information to purposes necessary to perform services reasonably expected.

• Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your privacy rights.

• Automated Decision-Making: You have the right to notice and opt-out of automated decision-making in certain contexts.

How to Exercise Your Rights: Contact us at hello@standingleague.com or use the self-serve tools in your Account page.

Enforcement: California Privacy Protection Agency and California Attorney General.

Private Right of Action: Limited to data security breaches only (Cal. Civ. Code § 1798.150).

(b) Colorado

Applicable Law: Colorado Privacy Act (CPA), Colo. Rev. Stat. §§ 6-1-1301 to -1314

Your Rights:

• Right to Access: Confirm whether we are processing your personal data and access such personal data.

• Right to Deletion: Delete personal data you have provided.

• Right to Correction: Correct inaccuracies in your personal data.

• Right to Portability: Obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format.

• Right to Opt-Out of Sale: We do not sell personal information.

• Right to Opt-Out of Targeted Advertising: We do not engage in targeted advertising.

• Right to Opt-Out of Profiling: Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.

• Consent for Sensitive Data: We obtain consent before processing sensitive personal data.

How to Exercise Your Rights: Contact us at hello@standingleague.com or use the self-serve tools in your Account page.

Enforcement: Colorado Attorney General.

Private Right of Action: None.

Applicable Law: Connecticut Data Privacy Act (CTDPA), Conn. Gen. Stat. §§ 42-515 to -526

Your Rights:

• Right to Access: Confirm whether we are processing your personal data and access such personal data.

• Right to Deletion: Delete personal data you have provided.

• Right to Correction: Correct inaccuracies in your personal data.

• Right to Portability: Obtain a copy of your personal data in a portable and readily usable format.

• Right to Opt-Out of Sale: We do not sell personal information.

• Right to Opt-Out of Targeted Advertising: We do not engage in targeted advertising.

• Right to Opt-Out of Profiling: Opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.

• Right Regarding Automated Decisions: You have rights regarding solely automated significant decisions.

• Consent for Sensitive Data: We obtain consent before processing sensitive personal data.

How to Exercise Your Rights: Contact us at hello@standingleague.com or use the self-serve tools in your Account page.

Enforcement: Connecticut Attorney General.

Private Right of Action: None.

(d) Delaware

Applicable Law: Delaware Personal Data Privacy Act (DPDPA), Del. Code tit. 6, §§ 12D-101 to -111