CaliberControl Privacy Policy

Effective Date: August 26, 2026

Maxdev Contracting LLC, a Utah limited liability company doing business as CaliberControl ("CaliberControl," "we," "us," or "our"), operates the CaliberControl platform at https://calibercontrol.com, the booking sites we host for participating facilities, and our mobile applications (together, the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect information from sport and recreation facility operators such as shooting ranges and pickleball clubs, including their staff members ("Facility Operators" or "Operators"), and individuals who book, register, sign waivers, or otherwise use the Platform ("End Users"). Together, Operators and End Users are referred to as "users" or "you."

By using the Platform, you consent to the practices described in this Privacy Policy.

1. Information We Collect

1.1. Information from Facility Operators and Their Staff

When you subscribe to CaliberControl as a Facility Operator, or work at a subscribed facility, we collect:

1. Business Information: Business name, address, phone number, website, and tax identification information;
2. Account Information: Names, email addresses, phone numbers, and login details for authorized staff members and administrators;
3. Payment and Billing Information: Payment method details processed and stored by Stripe (our payment processor). We do not store full credit card numbers on our servers;
4. Time Clock Data: If the facility uses the staff time clock, we record clock-in and clock-out times and, where the staff member's device permits, the approximate device location at the moment of each punch. Location is captured only at the punch itself, is never tracked continuously, and is collected for the Operator's timekeeping and made available to facility managers; and
5. Usage Data: Information about how you interact with the Platform, including features accessed, settings configured, and administrative actions taken.

1.2. Information from End Users

When you use the Platform as an End User, we collect:

1. Account Information: Name, email address, and phone number;
2. Optional Profile Details: Date of birth (used to verify age requirements), gender (self-selected; used only to verify eligibility for gender-based program divisions), and a sport skill rating where applicable;
3. Payment Information: Payment method details processed through Stripe on behalf of the Facility Operator. We do not store full credit card numbers on our servers;
4. Reservation and Registration Data: Booking dates, times, lane or court selections, party size, class, lesson, and program registrations, membership details, and related records;
5. Household and Guest Information: Names and, where provided, birth dates of household members and guests you add to your account or bookings, including minors whose information you provide as their parent or legal guardian;
6. Attendance Records: Check-in times and attendance status for your reservations and sessions, including records the facility keeps about late arrivals or missed reservations;
7. Digital Waiver Data: Your name, signature, date of birth, date of signing, and the content of signed waivers as configured by the Facility Operator;
8. Location Data: When you sign a digital waiver, we collect your approximate geographic location at the time of signing for verification purposes. Location data is collected only during the waiver signing process and is not continuously tracked; and
9. Usage Data: Information about how you interact with the Platform, including pages visited, actions taken, and device information.

1.3. Information Collected Automatically

For all users, we automatically collect:

1. Device Information: Browser type, operating system, device type, and unique device identifiers;
2. Push Notification Tokens: If you enable push notifications, a device token used to deliver them;
3. Log Data: IP address, access times, pages viewed, referring URL, and actions taken on the Platform;
4. Cookies and Similar Technologies: As described in Section 7 below.

1.4. Information We Do Not Collect

We do not collect biometric data (e.g., fingerprints, facial recognition data). Digital waiver signatures are treated as electronic signatures, not biometric identifiers. Cameras used to scan QR codes at facility kiosks and check-in screens process the image on the device only to read the code; camera images are not recorded, stored, or transmitted.

2. How We Use Your Information

We use the information we collect for the following purposes:

2.1. Providing the Platform: To operate, maintain, and deliver the features and services of the Platform, including processing bookings, registrations, memberships, payments, check-ins, and digital waivers;

2.2. Account Management: To create and manage your account, authenticate your identity, and communicate with you about your account;

2.3. Payment Processing: To process subscription fees (Facility Operators) and booking, program, and membership payments (End Users) through Stripe;

2.4. Eligibility Verification: To verify age, skill, certification, and similar participation requirements set by an Operator or by law;

2.5. Waiver Verification: To record and verify digital waiver signatures, including the use of location data at the time of signing;

2.6. Communications: To send transactional messages (booking confirmations, reminders, receipts, account and billing notifications) by email, text message, and push notification according to your settings, and, with your consent, marketing communications;

2.7. Platform Improvement: To analyze usage patterns, monitor errors and performance, diagnose technical issues, and improve the Platform's features and performance;

2.8. Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests;

2.9. Safety and Security: To detect, prevent, and address fraud, security breaches, and technical issues; and

2.10. Dispute Resolution: To resolve disputes and enforce our agreements.

3. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

3.1. With Facility Operators. When you make a booking, register for a program, purchase a membership, or sign a waiver as an End User, the relevant Facility Operator receives your reservation, registration, waiver, attendance, and contact details necessary to provide their services.

3.2. With Other Participants. If you join a shared booking, your display name and check-in status may be visible to the booking's host and other participants. If you list open spots on a booking for other players to claim, limited information about the booking and your display name are visible to other users of that facility's site. Program rosters and standings may display your name to other participants.

3.3. Payment Processing (Stripe). Payment information is transmitted to and processed by Stripe, Inc. Stripe's collection and use of your information is governed by its own privacy policy at https://stripe.com/privacy.

3.4. Analytics. We use Vercel Analytics and Vercel Speed Insights to understand Platform usage and performance. These tools run on all pages of the Platform and collect anonymized usage data (such as pages visited, time on site, general geographic region, and performance metrics). They do not use advertising cookies, do not track you across other sites, and do not build behavioral profiles.

3.5. Service Providers. We use third-party providers to operate the Platform, each of which processes data only to provide its service to us: Supabase (application hosting, authentication, and database services), Vercel (web hosting and the analytics described above), Stripe (payments), Resend (email delivery), Telnyx (text message delivery), Apple, Google, and Expo (push notification delivery), and Sentry (error and performance monitoring; where session replay is captured to diagnose an error, all on-screen text and media are masked). These providers are contractually obligated to protect your information.

3.6. Legal Requirements. We may disclose information if required by law, regulation, legal process, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

3.7. Business Transfers. In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you of any such change via email or prominent notice on the Platform.

3.8. With Your Consent. We may share information with third parties when you have given us explicit consent to do so.

3.9. SMS / Text Messaging. We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign. We may share your Personal Data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services, including but not limited to platform providers, phone companies, and any other vendors who assist us in the delivery of text messages. All of the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

4. Data Retention

4.1. Facility Operator Data. We retain Facility Operator account and business data for as long as your subscription is active and for a commercially reasonable period thereafter (typically ninety (90) days) to facilitate data export. After this period, data is deleted from active systems and from backups within ninety (90) additional days.

4.2. End User Data. We retain End User account and reservation data for as long as your account is active or as needed to provide services. If you request account deletion, we will delete your personal information from active systems within thirty (30) days, subject to Section 4.4.

4.3. Waiver Data. Digital waiver records are retained on behalf of Facility Operators in accordance with their instructions and applicable record retention laws. Facility Operators determine the retention period for waiver data.

4.4. Legal Obligations. We may retain certain information as required by law, for legitimate business purposes (such as resolving disputes or enforcing agreements), or as needed for our backup and disaster recovery processes.

5. Data Security

5.1. We implement commercially reasonable administrative, technical, and physical safeguards designed to protect your information, including:

1. Encryption of data in transit (TLS/SSL) and at rest;
2. Access controls limiting employee access to personal information on a need-to-know basis;
3. Regular security assessments and monitoring; and
4. Secure payment processing through Stripe's PCI-compliant infrastructure.

5.2. While we take reasonable measures to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

5.3. If we become aware of a security breach that affects your personal information, we will notify you and any applicable regulatory authorities as required by law.

6. Your Rights and Choices

6.1. Access and Correction. You may access and update your account information at any time by logging into your account. For additional requests, contact us at privacy@calibercontrol.com.

6.2. Account Deletion. You may request deletion of your account and associated personal data from your profile settings in the Platform or by contacting us at privacy@calibercontrol.com. We will process your request within thirty (30) days, subject to our retention obligations described in Section 4.

6.3. Data Export. Facility Operators may request an export of their data as described in our Facility Operator Terms of Service.

6.4. Marketing Communications. You may opt out of marketing emails by clicking the "unsubscribe" link in any marketing message, opt out of marketing text messages by replying STOP, and manage marketing preferences per channel in your notification settings. Transactional communications (booking confirmations, account alerts) are not optional while your account is active.

6.5. Notification Preferences. You can choose which categories of messages you receive on each channel (email, text, push) in your notification settings, and disable push notifications at any time in your device settings.

6.6. Location Data. Location access is requested only for specific features: waiver signing verification and, for facility staff, time clock punches. You may deny location access through your device or browser settings, though this may prevent you from completing a digital waiver that requires location verification.

6.7. Do Not Track. The Platform does not currently respond to "Do Not Track" browser signals. We continue to monitor industry standards regarding Do Not Track.

7. Cookies and Tracking Technologies

7.1. What We Use. We use cookies and similar technologies (local storage, pixels) for the following purposes:

1. Essential Cookies: Required for the Platform to function (authentication, session management, security);
2. Analytics: We use Vercel Analytics and Vercel Speed Insights to understand how users interact with the Platform, which pages are visited most often, and where performance can be improved. These tools collect anonymized usage data such as pages visited, time on site, and general geographic location. No personally identifiable information is stored by these tools; and
3. Preference Cookies: Remember your settings and preferences (such as theme and facility selection) to enhance your experience.

7.2. Analytics Disclosure. Vercel Analytics and Speed Insights are loaded on all pages of the Platform. These tools collect only anonymized, non-personally-identifiable usage data (page views, time on site, general geographic region, performance metrics) and do not track individual users across sites. We do not use any advertising, cross-site tracking, or behavioral profiling technology.

7.3. Managing Cookies. You can control or delete cookies at any time through your browser settings. Disabling essential cookies may impair Platform functionality.

7.4. Third-Party Cookies. Vercel Analytics and Speed Insights may set their own cookies. For more information, see Vercel's privacy policy at https://vercel.com/legal/privacy-policy.

8. Children's Privacy

8.1. Platform accounts are intended for adults. The Platform is not directed to children under the age of thirteen (13), and we do not knowingly collect personal information directly from children under 13, in compliance with the Children's Online Privacy Protection Act ("COPPA").

8.2. Facilities on the Platform may offer activities in which minors participate, such as junior classes, leagues, and family bookings. In those cases, a minor's information (such as name, birth date, program registrations, and waiver coverage) is provided to us by the minor's parent or legal guardian, or by the Facility Operator, for participation purposes only.

8.3. A parent or legal guardian may review the information they have provided about their minor, request corrections, or request its deletion by contacting us at privacy@calibercontrol.com, subject to the Facility Operator's record retention obligations.

8.4. If we become aware that we have collected personal information directly from a child under 13 without parental consent, we will promptly delete that information. If you believe a child under 13 has provided us with personal information, please contact us at privacy@calibercontrol.com.

9. California Residents: Your Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"):

9.1. Right to Know. You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purposes for collection, and the categories of third parties with whom we share it.

9.2. Right to Delete. You have the right to request that we delete the personal information we have collected about you, subject to certain exceptions.

9.3. Right to Correct. You have the right to request that we correct inaccurate personal information we maintain about you.

9.4. Right to Opt Out of Sale/Sharing. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

9.5. Sensitive Personal Information. We use and disclose sensitive personal information (such as account log-in credentials and the location data described in this policy) only as reasonably necessary to provide the services and for purposes permitted by the CCPA. We do not use sensitive personal information to infer characteristics about you.

9.6. Non-Discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights.

9.7. How to Submit a Request. To exercise any of these rights, contact us at privacy@calibercontrol.com. We will verify your identity before processing your request and respond within forty-five (45) days.

9.8. Authorized Agents. You may designate an authorized agent to submit requests on your behalf, provided you verify the agent's authority.

Categories of Personal Information Collected (CCPA Disclosure)

10. Other US State Privacy Rights

10.1. Residents of other states with comprehensive privacy laws (including Colorado, Connecticut, Texas, Utah, and Virginia) may have similar rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, sales, and certain profiling. We do not sell personal data or process it for targeted advertising or profiling with legal effects.

10.2. To exercise any right available to you under your state's law, contact us at privacy@calibercontrol.com. If we decline to act on a request, you may appeal by replying to our response, and we will review the appeal as your state's law requires.

11. Users Outside the United States

11.1. The Platform is operated from the United States. If you access the Platform from outside the United States, your information will be transferred to, stored, and processed in the United States.

11.2. By using the Platform, you consent to the transfer of your information to the United States, which may not provide the same level of data protection as your home jurisdiction.

12. Third-Party Links and Services

12.1. The Platform may contain links to third-party websites or services. This Privacy Policy does not apply to third-party sites. We encourage you to review the privacy policies of any third-party services you access through the Platform.

13. Changes to This Privacy Policy

13.1. We may update this Privacy Policy from time to time. When we make material changes, we will update the "Effective Date" at the top and notify you through the Platform or by email.

13.2. Your continued use of the Platform after changes take effect constitutes your acceptance of the updated Privacy Policy.

14. Governing Law

14.1. This Privacy Policy shall be governed by and construed in accordance with the laws of the State of Utah, without regard to its conflict of laws principles.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Maxdev Contracting LLC, d/b/a CaliberControl
Email: privacy@calibercontrol.com
Website: https://calibercontrol.com

For general support inquiries: support@calibercontrol.com