Partner & Coach Privacy Policy

This policy applies to golf facilities, simulator venues, and coaches who partner with Skratch Golf Inc. ("Skratch Golf", "we", "us"), and to the individuals who administer those accounts — owners, general managers, and staff you give portal access to.

It covers the Partner Portal, the Coach Portal, and everything we collect while onboarding and integrating you.

Much business contact information is not "personal information" under Canadian privacy law. We have written this policy as though it all is, because the distinction is a technicality and you should be able to see the whole picture in one place.

We handle your information in accordance with PIPEDA, British Columbia's PIPA, Alberta's PIPA, and Quebec's Law 25 — applying the strictest of these across all partners regardless of province.

Skratch Golf has a designated Privacy Officer accountable for our compliance with this policy and with Canadian privacy law.

We respond to privacy requests within 30 days. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.

Business information — facility or coaching business name, address, phone, website, business number, hours, amenities, photos, and the services and prices you list.

Contact information — the name, title, email address, and phone number of your main contact and any second contact or staff member you add.

Portal account — sign-in email, hashed password, and the devices you have chosen to trust for 30 days.

Coach-specific — biography, credentials and certifications, teaching locations, lesson types, availability, and your service area.

Pricing and commercial terms — your rate card, the commission or per-booking fee we agreed, cancellation windows, and the history of every pricing change you submit and we approve.

Booking-system credentials — see section 4. These get special treatment.

Payment and banking — see section 5. Held by Stripe, not by us.

Transaction records — bookings taken through Skratch, fees accrued, invoices issued, and payments received.

Portal usage — sign-in times, actions taken in the portal, and support conversations, so we can troubleshoot and detect unauthorised access.

To sell your tee times or lesson slots we need API credentials for your point-of-sale or booking system. These are among the most sensitive things you will ever hand us, so here is exactly what happens to them.

They are write-once. You paste your API key and secret once. From that moment the portal shows you only a masked hint — ••••••••1234 — saved Aug 20 — and a Replace button. There is no way, for you or for us, to read the value back out through the portal.

They are stored apart from everything else, in a vault table that our website and app cannot query at all. Only our backend can reach it, and only a Skratch administrator can reveal a value — one at a time, deliberately, in a view that hides it again after 30 seconds.

They are destroyed once we are done with them. When we finish wiring your integration, we permanently delete your API key and secret from our systems on the spot. We keep the fact that you sent them — so our reminder emails stop and your onboarding advances — but not the values. If credentials ever need to change, you issue new ones and paste them again.

Being straight with you about the limit of this: your credentials are stored as you gave them, protected by strict access control rather than by encryption we could not ourselves undo. Someone who compromised our backend infrastructure could read a credential that had not yet been destroyed. That is precisely why we destroy them as soon as the integration works, rather than keeping them on file.

We use these credentials only to read your availability and to write bookings your Skratch listing generates. We never use them to alter your pricing, your other sales channels, or anything else in your system.

Where we are today: online booking and card payments are not yet live. Facility listings are currently visual only and golfers call you to book. This section describes how payments will work once we switch them on, and what Stripe collects when you onboard — not money that is moving today.

Payments run through Stripe Connect, and the structure matters for your privacy as much as for your money.

You are the merchant of record. You hold your own Stripe account. Golfers' charges are made directly on it, and funds settle directly into your bank account. Money never passes through Skratch Golf, and we never hold it.

When you onboard to Stripe Connect, Stripe collects the information it needs to satisfy Canadian financial regulation — your legal business name, business number, bank account details, and identity verification for beneficial owners, which can include date of birth and government identification.

You give that information to Stripe, not to us. It is collected on Stripe's own hosted onboarding pages under Stripe's privacy policy. We never see your bank account number, your date of birth, or your identification documents.

What Skratch Golf receives back from Stripe is limited to: your connected account identifier, whether onboarding is complete, whether you can accept charges and receive payouts, and any outstanding requirement Stripe is waiting on. That is enough for us to show you an accurate status and nothing more.

Our commission is taken as an application fee on each transaction. Disputes and chargebacks are handled on your Stripe account, and we send you a prepared evidence pack when one opens.

• •Creating and administering your portal account
• •Building and publishing your public listing or coach page
• •Reviewing and approving your listing, your pricing, and changes to either
• •Connecting your booking system and keeping availability in sync
• •Routing bookings to you and confirming them
• •Calculating fees, issuing invoices, and reconciling payments
• •Meeting our tax, GST/PST, and accounting obligations
• •Providing support and communicating about your account
• •Detecting fraud and unauthorised access to your portal

We do not sell partner information, and we do not share your commercial terms with other partners.

This section runs the other way: it is about your obligations, not ours.

When a golfer books with you through Skratch, we send you their name, contact details, and booking details so you can honour the reservation. For that information, you are an independent organisation with your own responsibilities under Canadian privacy law — we are not your processor and you are not ours.

By accepting bookings through Skratch Golf you agree to:

• •Use golfer information only to deliver the booking they made and to meet your legal obligations
• •Not add golfers to your own marketing lists without getting their consent yourself, as CASL requires
• •Not sell, rent, or disclose golfer information to anyone else
• •Protect it with reasonable security, and keep it no longer than you need it
• •Tell us promptly if golfer data you received from us is lost, stolen, or exposed

A golfer who books with you has agreed to our Golfer Privacy Policy, not to yours. Treating their details as a marketing list you have bought is the fastest way to end a partnership with us.

• •Golfers: Your public listing — business name, address, phone, photos, services, prices, and for coaches your biography and credentials — is visible to anyone. Your internal contacts, terms, and credentials are not.
• •Service providers: The companies in section 9.
• •Your booking system provider: When we integrate, we exchange booking and availability data with the POS vendor you nominated.
• •Professional advisors: Our accountants and, if needed, our lawyers, under confidentiality.
• •Legal requirements: Where required by law, court order, or tax authority.
• •Business transfer: If Skratch Golf is sold or merged, partner records transfer with it. You will be notified.

Skratch Golf is a Canadian company, but most of our service providers store and process data on servers in the United States.

While your information is in the United States, it is subject to United States law and may be accessed by that country's courts, law enforcement, and national security authorities, without notice to you and without our being able to prevent it.

Canadian privacy law requires us to tell you this before you hand over business information, and to let you decide with that in mind. Each provider is contractually bound to protect your data and use it only for us.

Your banking and identity information given to Stripe is held under Stripe's own arrangements, which include Canadian processing for Canadian accounts.

This applies if we have contacted you about joining Skratch Golf but you have not signed up.

We keep a sales record for prospective partners: business name, publicly available contact details, the name and title of the person we spoke to, notes on our conversations, and where you are in our outreach process. We collect this from your public website and business listings, from industry directories, and from our own conversations with you.

We automatically read the sent folders of our own founders' work mailboxes to record the date we last contacted you. This checks only who a message was sent to and when — it stamps a date on your record so we do not pester you twice. The contents of our emails are not stored in the prospect record by this process, and it never touches your mailbox, only ours.

If you have been sent a setup link and have not finished, our system emails you a reminder every two days, up to four times, and then stops permanently.

Ask us to stop contacting you or to delete your prospect record at any time — email info@skratchgolf.ca and we will do it, no follow-up sales attempt.

This applies only if you are a coach and choose to connect Google Calendar or Microsoft Outlook to your Coach Portal. It is optional.

We access your calendar solely to: (1) read your event times so we can show when you are available or busy, and (2) create or remove lesson and block events so your Skratch bookings stay in sync.

Golfers never see your event details — only that a time is available or unavailable, never the title or contents. We never sell this data and never use it for advertising.

Skratch Golf's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnect at any time from the Coach Portal — access stops immediately.

Your public listing is removed from the site and app as soon as a partnership ends — retention above concerns our internal records, not your visibility to golfers.

You have the right to access, correct, and delete personal information we hold about you, to withdraw consent, to receive your information in a portable machine-readable format, and to complain to us and then to a regulator.

Two honest limits: information we must keep for tax and accounting cannot be deleted on request, and a deletion request for an account administrator does not by itself end your partnership or remove your business listing — tell us if that is what you want.

Email info@skratchgolf.ca. We respond within 30 days, free of charge.

• •All data transmitted over HTTPS
• •Passwords hashed, never stored in plain text
• •Row-level security — you can only reach your own facility's or coaching data
• •API credentials in a separate vault our public applications cannot query
• •Credentials destroyed once your integration is complete
• •Portal sign-in protected by a one-time code, with device trust you control
• •Administrative access protected by passkeys and a second factor
• •Rate limiting on all portal and API routes

No system is completely secure. If you believe your portal account or your API credentials have been compromised, contact us immediately at info@skratchgolf.ca and revoke the credentials in your booking system.

A note on money fraud: our remittance and banking details change only in our own admin dashboard, by a Skratch founder. If you ever receive an email claiming Skratch Golf's banking details have changed, it is fraudulent — call us before acting on it.

If your information is lost, stolen, or accessed by someone who should not have it, and there is a real risk of significant harm, we will tell you directly as soon as feasible, report it to the Office of the Privacy Commissioner of Canada and any applicable provincial commissioner, notify anyone who could reduce the risk to you, and keep a record for at least two years.

If a breach involves API credentials, we will tell you immediately and without waiting to complete an investigation, so you can revoke them in your booking system.

We may update this policy. For material changes we will update the effective date and notify partner account contacts by email before the change takes effect.

Where a change materially affects our partner agreements, you may be asked to re-accept them before we can continue invoicing you.

• •Privacy Officer, Skratch Golf Inc. — info@skratchgolf.ca
• •Golfer privacy — see the Golfer Privacy Policy
• •Cookies and tracking — see the Cookie Policy

Skratch Golf Inc. · All rights reserved · September 2026