Privacy Policy

This Privacy Policy describes how BrinkOps Camps ("BrinkOps", "we", "us", "our") collects, uses, and protects personal information. We are based in Alberta, Canada. Canadian private-sector privacy law — the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA) — applies to how we handle that information. Which of PIPEDA or Alberta PIPA governs, and how they interact for operators outside Alberta, needs legal confirmation.

1. Who this policy covers

Three different groups of people appear in this product, and the relationship is different for each:

• Operators — the camp, clinic, or training business that runs sessions on BrinkOps. For an operator's own account information, we are the organisation responsible for that information.
• Bookers — the person who registers for a session. That may be a parent or guardian registering a child, or an adult registering themselves.
• Participants — the person actually attending. Often a child, sometimes the booker themselves.

For booker and participant information, the operator decides what is collected and why. We hold and process that information on the operator's behalf, under their instructions — we do not decide how it is used, and we do not use it for our own purposes. In privacy terms the operator is the controller and BrinkOps is the processor. If you registered for a session and want your information corrected or deleted, the fastest route is to contact the operator you registered with; see section 7.

2. Information we collect

From operators

• Account information: name, email, password (hashed by our authentication provider), business name, phone number.
• Payout information: handled by Stripe during Connect onboarding. We store a Stripe account identifier, not bank or card details.
• Usage information: pages visited, features used, IP address, browser and device information.
• Push notification device tokens, if notifications are enabled in the browser.
• Communications: support email and in-app messages.

From bookers and participants

When someone registers for a session, the registration form collects:

• Participant details — first and last name, date of birth, skill or experience level, and any jersey or sizing information the operator asks for.
• Health and safety information — allergies, medications, medical notes, and any special requests. This is the most sensitive information in the product and is treated as such; see section 9.
• Photo consent — whether the operator may photograph the participant.
• Booker details — name, email address, and phone number.
• Emergency contact — name, phone number, and relationship to the participant.
• Signed waivers — the full text and version of the waiver as it was presented, together with the signer's typed name, email, IP address, and browser user-agent string. This snapshot is kept deliberately: a waiver is only meaningful if we can show precisely what was agreed to and when.
• Payment records — amounts, currency, status, refunds, and Stripe identifiers. Card numbers are entered directly with Stripe and never reach our servers.
• Attendance — check-in records for each day of a session.

Operators choose which of these fields to require. If you are a booker and would rather not provide something optional, leave it blank or ask the operator.

3. How we use information

• To provide, operate, maintain, and improve the Service;
• To process registration payments and payouts through Stripe;
• To send transactional messages — registration confirmations, session reminders, sign-in links for the parent portal, and account or billing notices;
• To make health and emergency-contact information available to the operator and their assigned coaches at the point it is needed, such as day-of check-in;
• To respond to support requests;
• To detect, prevent, and address fraud, abuse, or technical problems;
• To comply with legal obligations.

We do not sell personal information, and we do not use participant information to advertise to anyone. We do not use registration or health information to train AI models.

4. How we share information

We share personal information only with the service providers we need in order to operate the product, and only as far as each one needs:

• Supabase — database hosting and operator authentication;
• Vercel — application hosting;
• Stripe — payment processing and operator payouts;
• Resend — transactional email delivery;
• Telnyx — SMS delivery for confirmations and reminders;
• Anthropic — AI drafting assistance where an operator uses it. Participant health information is not sent to this provider by any current feature.

A current subprocessor list, with each provider's data-processing terms and hosting regions, should be published and kept up to date here.

We may also disclose information when required by law, court order, or government request, or where necessary to protect someone's safety.

5. International data transfers

Several of the providers listed above operate outside Canada, primarily in the United States. Personal information stored or processed there may be subject to the laws of that country, including lawful access by foreign authorities. The actual hosting region of each provider needs to be confirmed and stated here, rather than described in general terms.

6. How long we keep information

We keep operator account information for as long as the account is active.

Registration records, including health information, belong to the operator, and how long they are kept is the operator's decision. There are competing pressures here: a signed waiver may need to be producible years later, while there is no good reason to keep a child's medical notes indefinitely after a camp has ended. Retention periods — for registrations, health information, signed waivers, and data after an operator closes their account — are a policy decision that has not been made yet. They must be set, implemented, and stated here before launch.

7. Your rights

Under Canadian privacy law you have the right to:

• Access the personal information held about you;
• Request correction of information that is inaccurate or incomplete;
• Withdraw consent, where consent is the basis for processing;
• Request deletion, subject to legal retention requirements;
• Complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner of Alberta.

If you registered for a session, contact the operator you registered with — they control that information and can act on it directly. If you cannot reach them, email hello@brinkops.io and we will route the request to them and help where we can.

If you are an operator, email hello@brinkops.io.

8. Security

Information is encrypted in transit using TLS. Operator passwords are hashed by our authentication provider; we never see or store them in readable form. Each operator's data is isolated from every other operator's at the database level, and coaches see only the sessions they are assigned to. Card details are collected directly by Stripe and do not pass through our servers.

No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, email hello@brinkops.io — we would much rather hear about it.

A breach-notification process — who is told, how quickly, and by whom — needs to be written down before launch.

9. Children and participant health information

Most participants registered through BrinkOps Camps are children, and their registrations include health information. This is the core of what the product handles, and it is held to a higher standard than anything else in it.

Children do not create accounts and do not interact with BrinkOps directly. A child's information reaches us because an adult — a parent or legal guardian — entered it while registering them for a session. By registering a child, that adult confirms they have the authority to provide the child's information, including health information, for that purpose.

How this information is handled:

• It is visible to the operator the registration was made with, and to coaches assigned to that participant's session. It is not visible to other operators, other families, or other coaches.
• It is used to run the session safely — allergy and medication awareness, emergency contact, check-in — and for nothing else.
• It is never sold, never used for advertising, and never used to train AI models.

A parent or guardian may review, correct, or ask for the removal of their child's information at any time, through the parent portal or by contacting the operator. Removal may be limited where a record has to be retained — a signed waiver for a session that already took place is the usual example.

If operators outside Canada use the product, children's-privacy regimes such as COPPA in the United States and the UK and EU children's codes impose additional obligations. Whether to accept non-Canadian operators, and what would be required first, is an open decision.

10. Cookies

We use cookies that are necessary for the product to work: keeping operators signed in, and keeping parent-portal and coach sessions active. We do not use advertising cookies, and we do not use third-party analytics trackers. Blocking cookies will prevent signing in.

11. Changes to this policy

We may update this policy. Where a change is material we will notify operators by email or in-app notice. The effective date at the top of the page shows when the current version took effect.

12. Contact

Privacy questions or requests: hello@brinkops.io.

The operating legal entity and a mailing address must be stated here. Canadian privacy law requires a reachable, accountable contact — an email address alone is not sufficient.