Privacy Policy

Effective Date: March 20, 2026

GolfOne.ai (“GolfOne,” “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and safeguard your personal information when you use the GolfOne.ai platform — including our mobile app, web application, and club management tools (collectively, the “Service”).

By creating an account or using the Service, you expressly consent to the collection, use, and processing of your personal data as described in this Privacy Policy, in accordance with applicable data protection laws, including Costa Rica’s Law 8968 and its implementing regulations (Executive Decree 37554-JP). If you do not agree, please do not use the Service.

This Privacy Policy is also available in Spanish at golfone.ai/es-cr/politica-de-privacidad/. In the event of any conflict between the English and Spanish versions, the English version shall prevail.

1. Information We Collect

1.1 Information You Provide

1.2 Information Collected Automatically

1.3 Information from Third Parties

2. How We Use Your Information

We use the information we collect to:

3. Profile Visibility and Player Discovery

GolfOne.ai is a social golf platform. Sharing your golf activity is central to the experience. Here is how visibility works.

3.1 Default Public Profile

By default, the following fields are visible to other registered users of the Service: your display name, profile photo, handicap index, home club, and recent round scores (collectively, “Public Profile Information”). This enables features like player search, leaderboards, and round invitations.

3.2 Private Profile Option

You may switch your profile to Private in your account settings at any time. When set to Private, your profile is only visible to users you have accepted as connections. Your scores will not appear in public leaderboards.

3.3 Player Search

Registered users may search for other players by name or username. Search results include only Public Profile Information as defined in Section 3.1. Users with private profiles do not appear in search results to non-connections.

3.4 Friend Requests and Connections

GolfOne.ai allows registered users to send connection requests (referred to as “friend requests”) to other registered users. The friend request mechanism works as follows:

The legal basis for the processing of personal data through the social and connection features is your express consent, which you provide when you activate or use these features. For users in Costa Rica, this consent satisfies the requirements of Article 5 of Law 8968. You may withdraw your consent at any time by switching your profile to Private or by deleting your account.

3.5 Club-Level Visibility

If you are a member of a golf club using GolfOne.ai’s club management tools, the club administrator may have access to your tee time bookings, scores, and handicap history for operational purposes. This is disclosed to you at the time of club enrollment.

4. Sharing Your Information

We do not sell your personal information to third parties. We may share your information in the following limited circumstances:

5. Payment Processing

5.1 Payment Processors We Use

GolfOne.ai uses third-party payment processors to handle all financial transactions. We do not store your full card number, CVV, or banking credentials on our servers.

Depending on your region and the type of transaction, payments may be processed by one or more of the following providers:

5.2 What Payment Data We Collect

When you make a payment through GolfOne.ai, we collect and store only the following limited payment-related information:

Full card numbers, CVV codes, and bank account credentials are entered directly into the payment processor’s secure environment and are never transmitted to or stored by GolfOne.ai.

5.3 Payment Data Flows and International Transfers

Transaction data processed by BAC Credomatic for users in Costa Rica and Central America is initially processed and stored within BAC Credomatic’s infrastructure in Costa Rica and Central America. However, GolfOne.ai receives and stores the limited payment-related information described in Section 5.2 on its servers in the United States. By using the Service and making payments, you consent to this transfer. For users in Costa Rica, this cross-border transfer is carried out in compliance with Article 14 of Law 8968 and its implementing regulations (Executive Decree 37554-JP), and GolfOne.ai implements appropriate contractual and technical safeguards to ensure an adequate level of protection for your data.

5.4 Regional Payment Compliance

We process payments in multiple jurisdictions and apply the following region-specific standards:

5.5 Recurring Payments and Subscriptions

If you subscribe to a GolfOne.ai paid plan or a club’s recurring service, you authorize us and our payment processors to charge your payment method on a recurring basis. You may cancel your subscription at any time through your account settings. Cancellations take effect at the end of the current billing period. Refund eligibility is subject to our Refund Policy.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service.

Transaction and payment data is retained for a minimum period of five (5) years from the date of the transaction, or for such longer period as may be required by applicable tax, accounting, or financial regulatory obligations, including those established by SUGEF and Costa Rican tax legislation. After the applicable retention period expires, transaction data is securely deleted or anonymized.

You may request deletion of your account and associated data at any time by contacting us at privacy@golfone.ai. We will process deletion requests within 30 days, subject to any legal retention obligations (including the transaction data retention period described above).

Anonymized and aggregated data (for example, platform-wide scoring trends) may be retained indefinitely, as it cannot be linked to an individual.

7. Your Privacy Rights and Choices

Depending on your location, you may have the following rights:

To exercise any of these rights, contact us at privacy@golfone.ai. We will respond within 30 days.

7.1 Effect of Account Deletion on Social Data

When you request deletion of your account, the following applies to your social and connection data:

8. Children’s and Minors’ Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@golfone.ai and we will promptly delete it.

For users in Costa Rica, in accordance with Law 8968 and its implementing regulations (Executive Decree 37554-JP), any person under the age of 18 is considered a minor and may not independently authorize the collection, use, or processing of their personal data. The processing of personal data of any person under 18 years of age requires the prior, express, and informed consent of a parent or legal guardian (representante legal). If you are under 18 and located in Costa Rica, you may only use the Service if your parent or legal guardian has provided such consent on your behalf. GolfOne.ai reserves the right to request reasonable verification of parental or guardian consent at any time.

If we become aware that personal data of a minor in Costa Rica has been collected without the required parental or guardian consent, we will take steps to delete such data promptly and, where applicable, notify the Agencia de Protección de Datos de los Habitantes (PRODHAB).

9. Security

We implement industry-standard security measures including encryption in transit (TLS), encrypted storage, access controls, and regular security reviews to protect your personal information. However, no system is completely secure. We encourage you to use a strong, unique password and to notify us immediately if you suspect unauthorized access to your account.

9.1 Data Breach Notification

In the event of a security breach that compromises your personal data, including payment data, we will:

10. International Data Transfers

10.1 Cross-Border Transfers

GolfOne.ai is operated from the United States. When you use our Service from outside the United States, your personal information is transferred to and processed in the United States. We also share certain categories of personal data with the following types of recipients, which may be located in other countries:

10.2 European Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases: (a) performance of a contract, when processing is necessary to deliver the Service you have requested; (b) legitimate interests, for fraud prevention and platform security; (c) consent, for marketing communications and optional features. You have the right to lodge a complaint with your local data protection authority. Cross-border transfers to the United States are made using Standard Contractual Clauses (SCCs) approved by the European Commission.

10.3 Costa Rican Users (Law 8968)

For users in Costa Rica, we comply with the Ley de Protección de la Persona frente al tratamiento de sus datos personales (Law 8968) and its implementing regulations (Executive Decree 37554-JP) (the “Regulations”). This section sets out the specific rights and protections applicable to the processing of your personal data under Costa Rican law.

(a) Legal Basis for Processing

The primary legal basis for the processing of your personal data under Law 8968 is your express and informed consent. You provide this consent at the following stages:

You may withdraw your consent at any time by contacting us at privacy@golfone.ai or by deleting your account through the settings available in the Service. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to such withdrawal.

(b) Safeguards for International Transfers

In compliance with Law 8968 and the Regulations, GolfOne.ai implements the following safeguards to protect your personal data when it is transferred outside of Costa Rica pursuant to Section 10.1:

(c) Express Consent for International Transfer

By accepting this Privacy Policy through the express acceptance mechanism provided in the Service, you grant your free, informed, specific, and unambiguous consent for your personal data to be transferred to the United States and, where applicable, to other countries where the recipients identified in Section 10.1 are located, subject to the safeguards described in Section 10.3(b).

You may revoke this consent at any time by sending a written communication to our data protection officer at privacy@golfone.ai. Revocation of consent may result in the inability to continue providing the Service, in whole or in part, to the extent that the international transfer of data is necessary for its operation. Revocation shall not affect the lawfulness of any processing carried out prior thereto.

(d) ARCO Rights

In accordance with Law 8968, you have the right to request at any time access to, rectification of, cancellation of, or objection to the processing of your personal data (collectively, the “ARCO Rights”), including personal data that has been subject to international transfer. To exercise your ARCO Rights, you may submit a written request to privacy@golfone.ai. GolfOne.ai will respond to your request within ten (10) business days, as required by Law 8968 and Executive Decree No. 37554-JP.

(e) PRODHAB Registration

GolfOne.ai’s database containing personal data of Costa Rican users has been registered with the Agencia de Protección de Datos de los Habitantes (“PRODHAB”), in compliance with the registration requirements established by Law 8968 and Executive Decree No. 37554-JP. For any inquiries or complaints related to the processing of your personal data, you may also contact PRODHAB directly.

(f) Costa Rican Representative

For purposes of the exercise of ARCO Rights and any communications with PRODHAB, GolfOne.ai’s representative in Costa Rica is:

Tres-Ciento Dos-Novecientos Noventa y Cinco Mil Ochocientos Sesenta y Ocho SRL
San José, Costa Rica
Email: privacy@golfone.ai

(g) Payment Data and Financial Regulations

Payment data processed through BAC Credomatic is additionally subject to the regulations issued by the Superintendencia General de Entidades Financieras (SUGEF) and the Banco Central de Costa Rica (BCCR) governing electronic financial transactions in Costa Rica.

10.4 Latin America (Broader)

For users in other Latin American countries, we comply with applicable local data protection and consumer privacy laws, including but not limited to Brazil’s LGPD (Lei Geral de Proteção de Dados), Colombia’s Law 1581, and Mexico’s LFPDPPP (Ley Federal de Protección de Datos Personales en Posesión de los Particulares). Where local law requires specific disclosures or consent mechanisms, we apply those requirements to users in those jurisdictions.

11. Third-Party Links and Integrations

The Service may contain links to third-party websites or integrate with third-party services (for example, golf course databases and social login providers). This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or an in-app notice, and update the Effective Date at the top of this document. Your continued use of the Service after any update constitutes your acceptance of the revised policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

GolfOne.ai
Email: privacy@golfone.ai