Privacy Policy

This Privacy Policy describes how Commons ("we," "us," or "our") collects, uses, shares, and protects information about you when you use our platform, mobile applications, and related services (collectively, the "Service"). Commons is a software platform that powers booking, class registration, membership, and rewards for local sports clubs and the businesses around them.

Each individual club that uses Commons (each, a "Club") is a separate organization that operates its own programs and services. The pilot Club at the time of this Policy is Basha Tennis at Forest Crest Tennis Club in Mountlake Terrace, Washington.

1. Who We Are

Commons is the data controller for personal information processed through the Service. We are based in the United States. If we appoint a Data Protection Officer or a representative for residents of jurisdictions where one is required, we will list them here.

2. Information We Collect

2.1 Information you give us

• Account information: email address, password (stored as a salted hash by our authentication provider), and the account creation timestamp.
• Profile information: first and last name, date of birth, optional phone number, and an optional avatar.
• Club membership data: which Club(s) you join, your role in that Club (member, staff, admin), your membership tier, and the dates your membership is active.
• Booking and class data: the courts you reserve, the times you book them, the classes you enroll in, and your check-in history.
• Payment information: if you purchase a membership or class, your payment is processed by Stripe. We do not store your full card number; we store only a customer reference, the last four digits of your card, and a payment history.
• Communications: if you email or message us, we keep a record so we can respond.

2.2 Information collected automatically

• Usage data: pages you visit, features you use, and the timestamps of those events.
• Device data: the browser or mobile device you use, the operating system, approximate location based on IP address, and the language preference.
• Cookies and similar technologies: session cookies set by our authentication provider, a session-age cookie we set to enforce inactivity sign-out, and any cookies set by a third-party analytics provider if we enable one. See Section 8 for details.

2.3 Information from third parties

• OAuth providers: if you choose to sign in using Google, we receive your email address, name, and avatar from Google. We do not access any other Google data.
• Payment processor: we receive payment confirmation, refund status, and dispute notifications from Stripe.

3. Why We Process Your Information (Legal Bases)

For users in the European Economic Area, the United Kingdom, and similar jurisdictions, we rely on the following lawful bases under Article 6 of the General Data Protection Regulation:

• Performance of a contract with you to provide booking, class registration, and membership functionality.
• Legitimate interests in operating, securing, and improving the Service, preventing fraud, and communicating with you about your account.
• Consent for optional features such as marketing communications.
• Legal obligation when we are required to retain or disclose information by law.

4. How We Use Your Information

• Create and maintain your account.
• Process bookings, class registrations, and payments.
• Send transactional emails such as booking confirmations, cancellation notices, and password resets.
• Provide rewards program functionality and notify you about reward milestones.
• Enforce session-expiry rules and detect suspicious activity.
• Respond to your support requests.
• Diagnose service errors and improve the Service.
• Comply with legal obligations.
• If we add marketing communications in the future, send them only with your explicit opt-in.

5. Who We Share Information With

We do not sell your personal information. We share information in the following ways:

5.1 With the Club you join

The administrators and staff of the Club(s) you join can see your name, email, membership tier, booking history, and class enrollments to operate the Club. They cannot see other Clubs' members.

5.2 With service providers (data processors)

• Supabase — hosts our database and handles authentication. Data is stored in the United States.
• Stripe — processes payments. Subject to Stripe's privacy practices at stripe.com/privacy.
• Vercel — hosts our web application.
• Google — only if you sign in with Google. Subject to Google's privacy practices.
• Email service provider — sends transactional emails (provider to be selected before launch). Information shared is limited to your email and the message contents.
• Error and uptime monitoring — anonymized error reports and uptime checks. PII is scrubbed where reasonably possible.

Each provider processes information only for the purpose we direct, under a written data processing agreement where required by law.

5.3 Legal disclosures

We may disclose information if we are required to do so by law, court order, or to protect the rights, property, or safety of users or the public.

5.4 Business transfers

If Commons is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you and provide a choice before any transfer is subject to a materially different privacy policy.

6. Where Your Information Is Stored

Our primary infrastructure and databases are located in the United States. If you access the Service from outside the United States, you understand that your information is transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses or other lawful transfer mechanisms with our service providers.

7. How Long We Keep Your Information

• Active accounts: we keep your information for as long as your account is active.
• Closed or inactive accounts: we keep account information for a reasonable period after closure to satisfy legal, tax, and accounting requirements. Booking and payment records are retained for at least seven years.
• Backups: our backups may retain your information for an additional period after deletion until those backups are overwritten in the normal course.

8. Cookies and Similar Technologies

We use a small number of cookies, all classified as "strictly necessary" for the Service to function. No cookie consent banner is required for cookies in this category, but you can review them here.

• Supabase authentication cookies (sb-*-auth-token) — store your signed-in session. Set as HttpOnly and Secure, with SameSite=Lax. Lifetime is governed by your refresh token TTL.
• Session-age cookie (cr_session_started) — records when your current session began so we can enforce an absolute session timeout. Contains only a timestamp.

If we add analytics, advertising, or non-essential cookies in the future, we will display a consent banner and obtain your consent before setting them.

9. Your Rights

9.1 Rights for all users

Regardless of where you live, you may:

• Access and review the information we have about you, via your profile.
• Correct inaccurate information by editing your profile or contacting us.
• Delete your account and associated personal information, subject to retention obligations described in Section 7.
• Contact us with any privacy question at the address in Section 14.

9.2 European Economic Area, UK, and Switzerland

If you are located in the EEA, UK, or Switzerland, you also have the right to:

• Request a copy of your personal information in a structured, machine-readable format (right to data portability).
• Restrict or object to certain processing.
• Withdraw consent you previously gave at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with your national data protection authority. We encourage you to contact us first so we can address your concern.

9.3 California residents

If you are a California resident, the California Consumer Privacy Act ("CCPA") gives you the right to:

• Know what categories of personal information we collect and how we use them.
• Request access to the specific pieces of personal information we have about you.
• Request deletion of your personal information.
• Opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information for cross-context behavioral advertising.
• Be free from discrimination for exercising these rights.

You may exercise these rights by contacting us using the details in Section 14. We will verify your identity before fulfilling a request and respond within 45 days. You may authorize an agent to act on your behalf with appropriate documentation.

10. Children's Information

The Service is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with information without your consent, please contact us and we will delete it.

Children under 13 can participate in junior programs at a Club only by being enrolled by a parent or guardian on the parent's own Commons account. The parent's account holds the registration information; the child does not have their own account.

11. Security

We use technical and organizational measures designed to protect your information from unauthorized access, alteration, disclosure, and destruction. These measures include encryption in transit (HTTPS), database-level access controls, role-based authorization checks at multiple layers of our application, server-side session expiry, and routine security audits. No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

If we discover a data breach that materially affects your personal information, we will notify you and any required regulators in accordance with applicable law.

12. Automated Decision Making

We do not use your personal information to make automated decisions that produce legal or similarly significant effects.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date at the top, and for material changes, we will send a notification to your registered email at least seven days before the change takes effect. Continued use of the Service after the change indicates your acceptance of the updated Policy.

14. How to Contact Us

For any question about this Policy or to exercise your rights, contact us at:

• Email: privacy@bashatennis.com
• Postal: c/o Basha Tennis at Forest Crest Tennis Club, Mountlake Terrace, Washington, USA

We will respond to your request within a reasonable time and in any event within the timeframe required by applicable law.