Privacy Policy

TOUCH SHOOTING — Privacy Policy Effective Date: October 3, 2026 | Last Updated: October 3, 2026 1. Who We Are This Privacy Policy explains how personal information is collected, used, disclosed, and protected through the Touch Shooting ticketing, check-in, and team-registration platform (the “Platform”), which supports Touch Shooting youth basketball tournaments and events. Touch Shooting LLC (“Touch Shooting”) operates the events and is the merchant of record for ticket sales. Creative Code Collective Labs LLC, doing business as CerebrOS AI (“CerebrOS”), provides and operates the technology that powers the Platform on Touch Shooting’s behalf as its service provider. In this Policy, “we,” “us,” and “our” refer to Touch Shooting and CerebrOS in those respective roles. This Policy applies to information collected through the Platform and at our events. Event-specific documents, such as the Participation Agreement, the Data Use Disclosure, and the Minor Participant Waiver, supplement this Policy. If a supplemental document conflicts with this Policy on a privacy matter, this Policy controls unless the supplemental document provides you greater protection. 2. Key Points - We do not sell or share your personal information for cross-context behavioral advertising, and we never sell or share any information about youth athletes or children. - Youth athlete information is kept separate. It is stored in a restricted database area that is not linked to ticket-buyer, contact, or marketing data, and it is never used for marketing or advertising. - Card numbers never reach our systems. Payment card details are entered directly into Stripe’s secure payment fields. - Marketing is optional. You may buy tickets without agreeing to receive marketing or to participate in CerebrOS Connect. 3. Information We Collect We collect the following categories of personal information. We collect information directly from you, from a parent or guardian on behalf of an athlete, or automatically when tickets are scanned or agreements are accepted. We do not purchase personal information from data brokers or other third parties. Category | What We Collect | Source Ticket buyer identifiers and contact information | First and last name, email address, telephone number, and ZIP or postal code. | The purchasing adult, at checkout before payment. Order information | Ticket tiers purchased, the team you are attending to support, order details, the Stripe charge reference, ticket amounts, and fees. | The purchasing adult; generated by the Platform. Additional adult attendees | First and last name of each additional adult on the order; email and telephone number only if provided. | The purchasing adult, on behalf of the group. Child spectator tickets | No name or birth date. We record the ticket tier (which reflects an age range) and link the ticket to the buyer’s order and ZIP code. | The purchasing adult, by selecting a ticket tier. Payment information | Card number, expiration date, and security code, which are collected and held by Stripe only. We retain only the charge reference and amounts. | The purchasing adult, through Stripe’s embedded fields. Attendance and check-in records | A time-stamped record each time a ticket is scanned at the gate, including re-entries. | Generated when event staff scan your ticket. Legal acceptance records | The document and version accepted, the typed name of the person accepting, IP address, and timestamp. | The person accepting an agreement or consent. Communication and advertising preferences | Your marketing opt-in choice and your CerebrOS Connect choice, with the text shown, choice made, timestamp, and source. | The purchasing adult, at checkout. Youth athlete roster information | Athlete first and last name, jersey number, birth year, guardian email, media and public-statistics elections, per-athlete game statistics, and optional emergency medical information (allergies, medical conditions, medications, and insurance provider). | The athlete’s parent or legal guardian, through the Minor Participant Waiver; statistics are generated during games. Operator staff accounts | Email addresses of authorized Touch Shooting staff and login credentials. | Touch Shooting and CerebrOS; the staff member, through our authentication provider. 4. How We Use Information We use personal information only for the purposes described in this Policy and at the time of collection, including to: - Process ticket purchases, deliver tickets and receipts, and look up orders at the gate or on request; - Control admission, verify tickets, and maintain one accurate record for each attendee; - Analyze attendance, travel distance (using ZIP codes), team-driven attendance, and time spent at events to plan and improve our tournaments; - Verify athlete rosters and eligibility, protect tournament safety, and respond to emergencies; - Record game statistics and provide them privately to each athlete’s parent or guardian and authorized coaches, and publish them only as described in Section 5; - Contact you about your order and, if you opted in, send optional event updates, offers, and recommendations; - Maintain durable records of the agreements and consents you accept, prevent fraud, and resolve disputes; - Secure the Platform, restrict operator access, and comply with legal obligations. We do not use personal information to make automated decisions that produce legal or similarly significant effects, and we do not use athlete statistics for scouting, ranking, recruiting, or automated evaluation. 5. Youth Athletes and Children 5.1 How athlete information is protected We accept roster information about a youth athlete only after a parent or legal guardian completes the Minor Participant Waiver. Athlete information is stored in a separate, restricted area of our database that has no links to ticket-buyer, contact, or marketing records. Even when a parent is also a ticket buyer, our system is designed so that it cannot connect those records. Athlete information is never used for marketing, never included in CerebrOS Connect, and never disclosed to any advertising platform. 5.2 Who can see athlete statistics Audience | Access Parent or legal guardian | May view and correct their own athlete’s information and statistics through a private, signed, non-guessable link sent to the guardian’s email. The link is not a public page and is not available to other families. Coaches | Authorized coaches may view statistics only for athletes assigned to their team, only for legitimate event, safety, and coaching purposes, and may not use them for independent promotion. The public | Team-level scores, schedules, and aggregate results that do not identify any athlete. Player-level statistics are published only if a parent or guardian gives the separate, optional public-statistics consent described below. 5.3 Optional public statistics Public display of an individual athlete’s statistics is optional, is requested separately for each athlete, and is never a condition of registration, participation, or private access to statistics. If a parent or guardian consents, we will publish only the approved display string recorded at the time of consent, in the format “J. Smith #12” (first initial, last name, and jersey number), together with ordinary game-performance statistics from the covered event or season. We will not publicly display an athlete’s full first name, photograph, video, voice, birth date, age, grade, school, address, contact information, health, academic, or disciplinary information under this consent. Consents given under earlier versions of the waiver are not treated as permission for public statistics. A parent or guardian may withdraw public-statistics consent at any time using the methods in Section 11. We will remove the athlete from public player-level pages we control within 7 days. We cannot guarantee deletion of copies made by unaffiliated third parties before withdrawal. 5.4 Children and the Platform The Platform is intended for use by adults. We do not knowingly collect personal information online directly from children under 13. Information about youth athletes is provided by their parents or guardians, and we collect no name or identifying information for child spectator tickets. If you believe a child has provided personal information to us directly, please contact us and we will delete it. 6. How We Disclose Information We disclose personal information only to the following categories of recipients and only for the business purposes described: Recipient | Purpose | Information Involved Stripe | Payment processing | Card data; buyer name and email associated with the charge; amounts Resend | Transactional and opted-in marketing email | Email address, name, ticket and receipt content, guardian access links Clerk | Operator console authentication | Operator staff emails and login credentials Vercel | Application hosting and cookieless usage analytics | Information in transit while the Platform is served; aggregate, non-identifying usage metrics Neon | Database hosting | Stored Platform information, including the restricted athlete area Touch Shooting and CerebrOS | Operating the events and the Platform | Information needed for each party’s role described in Section 1 Our service providers are contractually limited to processing personal information on our behalf for the specified purposes. We may also disclose information when required by law or legal process; to protect the rights, safety, or property of attendees, athletes, us, or others; to coaches and the public as described in Section 5; or in connection with a merger, acquisition, or sale of assets, subject to this Policy. We do not disclose personal information to third parties for their own direct-marketing purposes. We do not currently share athlete roster information with any stat-tracking, camera, or analytics vendor. We will not do so without first updating this Policy and putting appropriate data-protection agreements in place. 7. No Sale or Sharing; CerebrOS Connect We do not sell personal information and do not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (“CCPA”). We have not done so since the Platform launched. We do not sell or share personal information of consumers we know to be under 16 years of age. At checkout, you may make an optional choice to participate in CerebrOS Connect, a future advertising program. Declining does not affect your purchase. At this time, we only record your choice. No Connect information is uploaded to, matched with, or disclosed to any advertising platform, sponsor, or other third party. Before Connect is ever activated, we will update this Policy and our notice at collection to describe the program, and at the same time provide a “Do Not Sell or Share My Personal Information” mechanism, honor opt-out preference signals, and offer a separate way to withdraw. Any future program would use only adult buyer contact information and would never include athlete, roster, statistics, or child information. 8. Sensitive Personal Information Some information we collect may be considered sensitive personal information, such as the optional emergency medical information a guardian may provide for an athlete’s safety and emergency care (allergies, medical conditions, medications, and insurance provider) and operator account login credentials. We use sensitive personal information only as reasonably necessary to provide our services, ensure safety and security, and respond to emergencies. We do not use it to infer characteristics about any person. Accordingly, the right to limit the use of sensitive personal information does not apply to our current practices. 9. How Long We Keep Information We keep personal information only as long as reasonably necessary for the purposes described in this Policy, after which we delete or de-identify it. Information | Retention Period Youth athlete roster information, statistics, and Minor Participant Waiver records | Through the first day of the applicable tournament plus 365 days, then purged. Statistics are deleted first, then acceptance records, then the athlete record; identifying values are redacted rather than left in place. Ticket buyer, additional attendee, order, payment reference, and check-in records | While your relationship with us is active and for 24 months after your last event, then deleted or de-identified. Marketing and Connect preference records | Until you withdraw or opt out, then we keep a minimal suppression record so that your choice stays in effect. Adult legal acceptance records | 4 years from the event date, consistent with the limitations period for written-contract claims. Operator staff account information | For the duration of the operator relationship. Payment card data | Held by Stripe under Stripe’s own retention practices. 10. Security We use reasonable administrative, technical, and physical safeguards appropriate to the nature of the information, including isolation of athlete data in a restricted database area, private signed links for guardian access, role-based coach access, an allowlist for operator access, append-only records of consents and acceptances, and payment processing through Stripe so that card data never reaches our servers. No system is completely secure, and we cannot guarantee absolute security. 11. Your Privacy Rights If you are a California resident, you have the following rights, subject to certain legal exceptions: - Right to know the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients; - Right to delete personal information we collected from you; - Right to correct inaccurate personal information; - Right to opt out of the sale or sharing of personal information (we do not currently sell or share); - Right to non-discrimination. We will not deny you goods or services, charge different prices, or provide a different level of service because you exercised your rights. A parent or legal guardian may exercise these rights on behalf of their athlete, and may also view and correct athlete information directly through the private guardian link. How to submit a request You may submit a request by email to ryan@touchshooting.com or sunnyransom@touchshooting.com. We will confirm receipt within 10 business days and respond within 45 calendar days. If we need more time (up to an additional 45 days), we will tell you why. To protect your information, we will verify requests to know, delete, or correct by matching information you provide against our records, such as the email address and order details associated with your purchase. Opt-out requests do not require verification. You may use an authorized agent; we may require proof of the agent’s authority and ask you to verify your identity directly. You need not create an account to submit any request. Opt-out preference signals We treat a legally recognized opt-out preference signal, such as Global Privacy Control, as a valid request to opt out of the sale or sharing of personal information associated with that browser and, where known, with you. 12. Cookies and Analytics The Platform uses cookies and similar technologies only as necessary to operate the site, secure checkout, and authenticate operator staff. We also use Vercel Analytics, a privacy-preserving, first-party analytics service that measures aggregate, non-identifying site usage (such as page views and visit counts). It does not set advertising or tracking cookies, does not fingerprint your device, and does not track you across other websites. We do not deploy third-party advertising pixels or cross-site tracking technologies. Because we do not engage in cross-site tracking, our practices do not change in response to browser “Do Not Track” signals; however, we honor opt-out preference signals as described in Section 11. 13. Marketing Communications If you opt in to marketing, you may unsubscribe at any time using the link in any marketing email, replying STOP to any text message, or contacting us. Unsubscribing from email or text does not affect transactional messages about your order. Your email, text, and CerebrOS Connect choices operate independently of one another. Under California Civil Code section 1798.83, California residents may ask about disclosures to third parties for their direct-marketing purposes; we do not make such disclosures. 14. Changes and Contact We may update this Policy from time to time. We will post the updated Policy with a new “Last Updated” date and, where required, notify you or obtain your consent before applying a material change to information already collected. Questions, requests, or complaints about this Policy may be directed to: Touch Shooting LLC — Attn: Privacy 11327 Folsom Blvd Ste 180, Rancho Cordova, CA 95742 Email: ryan@touchshooting.com or sunnyransom@touchshooting.com | Telephone: (916) 382-7465 Technology services provided by Creative Code Collective Labs LLC, doing business as CerebrOS AI, as service provider to Touch Shooting LLC.