Privacy Policy


Effective Date: March 20, 2026
GolfOne.ai (“GolfOne,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard your personal information when you use the GolfOne.ai platform — including our mobile app, web application, and club management tools (collectively, the “Service”).
By creating an account or using the Service, you expressly consent to the collection, use, and processing of your personal data as described in this Privacy Policy, in accordance with applicable data protection laws, including Costa Rica’s Law 8968 and its implementing regulations (Executive Decree 37554-JP). If you do not agree, please do not use the Service.
Note: This Privacy Policy is also available in Spanish at www.golfone.ai/privacidad. In the event
of any conflict between the English and Spanish versions, the English version shall prevail.

  1. Information We Collect
    1.1 Information You Provide
  1. How We Use Your Information
    We use the information we collect to:
  1. Profile Visibility & Player Discovery
    GolfOne.ai is a social golf platform. Sharing your golf activity is central to the experience. Here is
    how visibility works:
    3.1 Default Public Profile
    By default, the following fields are visible to the other registered users of the Service: your display
    name, profile photo, handicap index, home club, and recent round scores (collectively, “Public
    Profile Information”). This enables features like player search, leaderboards, and round
    invitations.
    3.2 Private Profile Option
    You may switch your profile to Private in your account settings at any time. When set to Private,
    your profile is only visible to users you have accepted as connections. Your scores will not appear
    in public leaderboards.
    3.3 Player Search
    Registered users may search for other players by name or username. Search results include only
    Public Profile Information as defined in Section 3.1. Users with private profiles do not appear in
    search results to non-connections.
    3.4 Friend Requests & Connections
    GolfOne.ai allows registered users to send connection requests (referred to as “friend requests”)
    to other registered users. The friend request mechanism works as follows:
  1. Sharing Your Information
    We do not sell your personal information to third parties.
    We may share your information in the following limited circumstances:
  1. Payment Processing
    5.1 Payment Processors We Use
    GolfOne.ai uses third-party payment processors to handle all financial transactions. We do not
    store your full card number, CVV, or banking credentials on our servers.
    Depending on your region and the type of transaction, payments may be processed by one or
    more of the following providers:
  1. Data Retention
    We retain your personal information for as long as your account is active or as needed to provide
    the Service.
    Transaction and payment data is retained for a minimum period of five (5) years from the date
    of the transaction, or for such longer period as may be required by applicable tax, accounting, or
    financial regulatory obligations, including those established by SUGEF and Costa Rican tax
    legislation. After the applicable retention period expires, transaction data is securely deleted or
    anonymized.
    You may request deletion of your account and associated data at any time by contacting us at
    privacy@golfone.ai. We will process deletion requests within 30 days, subject to any legal
    retention obligations (including the transaction data retention period described above).
    Anonymized and aggregated data (e.g., platform-wide scoring trends) may be retained indefinitely
    as it cannot be linked to an individual.
  2. Your Privacy Rights & Choices
    Depending on your location, you may have the following rights:
  1. Children’s and Minors´Privacy
    The Service is not directed to children under the age of 13. We do not knowingly collect personal
    information from children under 13. If you believe a child under 13 has provided us with personal
    information, please contact us at privacy@golfone.ai and we will promptly delete it.
    For users in Costa Rica, in accordance with Law 8968 and its implementing regulations (Executive
    Decree 37554-JP), any person under the age of 18 is considered a minor and may not
    independently authorize the collection, use, or processing of their personal data. The processing
    of personal data of any person under 18 years of age requires the prior, express, and informed
    consent of a parent or legal guardian (representante legal). If you are under 18 and located in
    Costa Rica, you may only use the Service if your parent or legal guardian has provided such
    consent on your behalf. GolfOne.ai reserves the right to request reasonable verification of
    parental or guardian consent at any time.
    If we become aware that personal data of a minor in Costa Rica has been collected without the
    required parental or guardian consent, we will take steps to delete such data promptly and, where
    applicable, notify the Agencia de Protección de Datos de los Habitantes (PRODHAB).
  2. Security
    We implement industry-standard security measures including encryption in transit (TLS),
    encrypted storage, access controls, and regular security reviews to protect your personal
    information. However, no system is completely secure. We encourage you to use a strong, unique
    password and to notify us immediately if you suspect unauthorized access to your account.
    9.1 Data Breach Notification
    In the event of a security breach that compromises your personal data, including payment data,
    we will:
  1. International Data Transfers
    10.1 Cross-Border Transfers
    GolfOne.ai is operated from the United States. When you use our Service from outside the United
    States, your personal information is transferred to and processed in the United States. We also
    share certain categories of personal data with the following types of recipients, which may be
    located in other countries:
    (a) Payment processors, located in the United States, which receive billing data and transaction
    information for the sole purpose of managing charges associated with the Service. For further
    details on data flows related to payment processing, see Section 5.3.
    (b) Infrastructure and hosting service providers, located in the United States, which receive
    technical data and Service usage data for the purpose of maintaining the operation, security, and
    availability of the Service.
    (c) Support and analytics service providers, located in the United States, which receive usage
    data and contact data for the purpose of providing user support and improving the Service, contact
    data, player profile (including names and, where provided, dates of birth), and powering AI-driven
    analytics features for golf club operators.
    (d) AI-powered analytics providers, located in the United States, which receive player profile
    data and usage data for the purpose of generating analytics reports and enabling golf club
    operators to query player activity data through AI-powered tools. The primary provider for this
    service is Anthropic (anthropic.com). Data transmitted to AI providers is processed solely for the
    purposes described in this Privacy Policy and is subject to data processing agreements that
    prohibit its use for AI model training or any other unauthorized purpose.
    .
    10.2 European Users (GDPR)
    If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we
    process your personal data on the following legal bases: (a) performance of a contract, when
    processing is necessary to deliver the Service you have requested; (b) legitimate interests, for
    fraud prevention and platform security; (c) consent, for marketing communications and optional
    features. You have the right to lodge a complaint with your local data protection authority. Crossborder transfers to the United States are made using Standard Contractual Clauses (SCCs)
    approved by the European Commission.
    10.3 Costa Rican Users (Law 8968)
    For users in Costa Rica, we comply with the Ley de Proteccion de la Persona frente al tratamiento
    de sus datos personales (Law 8968) and its implementing regulations (Executive Decree 37554-
    JP) (the “Regulations”). This section sets the specific rights and protections applicable to the
    processing of your personal data under Costa Rica law.
    (a) Legal Basis for Processing
    The primary legal basis for the processing of your personal data under Law 8968 is your express
    and informed consent. You provide this consent at the following stages:
    (i) Account registration. When you create an account and accept this Privacy Policy, you consent
    to the processing of your account data and golf profile data as described in this Privacy Policy.
    (ii) Social and connection features. When you activate or use social and connection features,
    including friend requests, player search, and messaging, you consent to the processing of the
    data generated through those features, as described in Section 3.4.
    (iii) Payment transactions. When you initiate a payment transaction, you consent to the processing
    of your payment data for that transaction, as described in Section 5.
    (iv) AI-powered analytics. When your personal data is processed through AI-powered analytics
    tools made available to golf club operators, such processing is carried out on the basis of your
    consent provided at the time of account registration and your acceptance of this Privacy Policy.
    This includes the transmission of personal data (such as your name and, where provided, date of
    birth) to third-party AI service providers located in the United States.
    You may withdraw your consent at any time by contacting us at privacy@golfone.ai or by deleting
    your account through the settings available in the Service. Withdrawal of consent does not affect
    the lawfulness of any processing carried out prior to such withdrawal.
    (b) Safeguards for International Transfers
    In compliance with Law 8968 and the Regulations, GolfOne.ai implements the following
    safeguards to protect your personal data when it is transferred outside of Costa Rica pursuant to
    Section 10.1:
    (i) Data processing agreements. GolfOne.ai has entered into data processing agreements with
    each of its providers and processors. These agreements include obligations of confidentiality,
    purpose limitation, technical and organizational security measures, and the obligation to delete or
    return personal data upon termination of the contractual relationship.
    (ii) Technical and organizational security measures. Transferred personal data is protected
    through encryption in transit and at rest, role-based access controls, audit logs, and periodic
    security assessments.
    (iii) Purpose limitation. Personal data transferred to third parties will be processed solely for the
    specific purposes described in this Privacy Policy and in accordance with GolfOne.ai’s
    instructions. Such third parties may not use the data for their own purposes.
    (c) Express Consent for International Transfer
    By accepting this Privacy Policy through the express acceptance mechanism provided in the
    Service, you grant your free, informed, specific, and unambiguous consent for your personal data
    to be transferred to the United States and, where applicable, to other countries where the
    recipients identified in Section 10.1 are located, subject to the safeguards described in Section
    10.3(b).
    You may revoke this consent at any time by sending a written communication to our data
    protection officer at privacy@golfone.ai. Revocation of consent may result in the inability to
    continue providing the Service, in whole or in part, to the extent that the international transfer of
    data is necessary for its operation. Revocation shall not affect the lawfulness of any processing
    carried out prior thereto.
    (d) ARCO Rights
    In accordance with Law 8968, you have the right to request at any time access to, rectification of,
    cancellation of, or objection to the processing of your personal data (collectively, the “ARCO
    Rights”), including personal data that has been subject to international transfer. To exercise your
    ARCO Rights, you may submit a written request to privacy@golfone.ai. GolfOne.ai will respond
    to your request within ten (10) business days, as required by Law 8968 and Executive Decree
    No. 37554-JP.
    (e) PRODHAB Registration
    GolfOne.ai’s database containing personal data of Costa Rican users has been registered with
    the Agencia de Protección de Datos de los Habitantes (“PRODHAB”), in compliance with the
    registration requirements established by Law 8968 and Executive Decree No. 37554-JP. For any
    inquiries or complaints related to the processing of your personal data, you may also contact
    PRODHAB directly.
    (f) Costa Rican Representative
    For purposes of the exercise of ARCO Rights and any communications with PRODHAB,
    GolfOne.ai’s representative in Costa Rica is:
    Tres- Ciento Dos- Novecientos Noventa y Cinco Mil Ochocientos Sesenta y Ocho SRL. San José,
    Costa Rica Email: privacy@golfone.ai
    (g) Payment Data and Financial Regulations
    Payment data processed through BAC Credomatic is additionally subject to the regulations issued
    by the Superintendencia General de Entidades Financieras (SUGEF) and the Banco Central de
    Costa Rica (BCCR) governing electronic financial transactions in Costa Rica.
    10.4 Latin America (Broader)
    For users in other Latin American countries, we comply with applicable local data protection and
    consumer privacy laws, including but not limited to Brazil’s LGPD (Lei Geral de Protecao de
    Dados), Colombia’s Law 1581, and Mexico’s LFPDPPP (Ley Federal de Proteccion de Datos
    Personales en Posesion de los Particulares).
    Where local law requires specific disclosures or consent mechanisms, we apply those
    requirements to users in those jurisdictions.
  2. Third-Party Links & Integrations
    The Service may contain links to third-party websites or integrate with third-party services (e.g.,
    golf course databases, social login providers). This Privacy Policy does not apply to those third
    parties. We encourage you to review the privacy policies of any third-party services you use.
  3. Changes to This Policy
    We may update this Privacy Policy from time to time. When we make material changes, we will
    notify you via email or an in-app notice, and update the Effective Date at the top of this document.
    Your continued use of the Service after any update constitutes your acceptance of the revised
    policy.
  4. Contact Us
    If you have any questions, concerns, or requests regarding this Privacy Policy or your personal
    data, please contact us:
    GolfOne.ai
    Email: privacy@golfone.ai
    Website: www.golfone.ai