Privacy Policy

Effective Date: April 28, 2026 Last Updated: November 3, 2026

1. Introduction

Welcome to Pinpoint ("we," "us," "our"). Pinpoint is a bowling league management platform. We respect your privacy and are committed to protecting the personal information you share with us.

This Privacy Policy explains what information we collect, how we use it, who we share it with, and the rights you have over your information. It is designed to comply with the EU/UK General Data Protection Regulation (GDPR), the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable privacy laws. We are also working toward compliance with South Korea's PIPA and Japan's APPI; updates will be reflected here.

By using Pinpoint, you agree to the practices described in this Policy. If you do not agree, please do not use the Service.

2. Who We Are and Our Role

2.1 Data Controller

The data controller responsible for personal information processed under this Policy is:

• Company: Pinpoint Labs Inc. ("Pinpoint")
• Trading as: Pinpoint
• Incorporated in: Ontario, Canada
• Email: privacy@pinpointbowl.com
• Postal mail: Available on request — please email us first.
• Privacy lead: We have not formally appointed a Data Protection Officer because our processing does not require one under GDPR Art. 37. Privacy matters are overseen by an internal privacy lead, contactable at the email above.
• EU/UK Representative (GDPR Art. 27): Not currently appointed. EU and UK users may direct privacy inquiries to the email above. We are evaluating appointment of a representative.

If you are in the European Economic Area (EEA) or the United Kingdom, you may have additional rights as described in Section 10.

2.2 When Pinpoint Is a Controller vs. a Processor

Pinpoint plays two different roles depending on whose data is being processed and why:

• Controller. When you create your own Account and use Pinpoint directly, Pinpoint is the controller of the personal information related to your Account, your authentication, your direct interactions with the Service, and the analytics or marketing preferences you set. This Policy describes how we handle that data.
• Processor. When a Center, League Admin, or organizer ("Customer") uses Pinpoint to manage their league, team, event, or roster — including by adding "Guest" entries for people who do not have their own Pinpoint Account (such as bowlers, dues payers, or registrants) — Pinpoint acts as a processor on the Customer's behalf for that information. The Customer is the controller of that information and decides why and how it is collected and used. In this context:
  • Pinpoint processes the data only on the Customer's documented instructions, under contractual terms (a Data Processing Addendum) that meet GDPR Art. 28 and applicable PIPEDA requirements;
  • If you are a person whose information has been added by a Customer (rather than someone who created their own Account), you should direct privacy requests (access, correction, deletion, etc.) to that Customer first. We will support the Customer in fulfilling such requests, and where required by law we will respond to you directly;
  • The Customer is responsible for having a lawful basis for collecting your information and for telling you how it will be used.

If you are unsure who controls your data, contact us at privacy@pinpointbowl.com and we will help direct your request.

2.3 How We Handle Guest Entries

Because Customers can add Guest entries for people without Pinpoint Accounts, we apply specific limits to how that Guest data is used:

• We require only the Guest's first and last name to add a Guest entry. Email and other contact details are optional.
• If a Customer chooses to enter a Guest's email address, the Customer must affirmatively confirm that the Guest has consented to be contacted at that email. We do not automatically add Guests to any mailing list or marketing program.
• We never use Guest information for marketing purposes. Guest information is used only to support the Customer's league or Event administration.
• We may use anonymous, aggregate Guest counts (for example, "how many Guests are in the system?") for our internal analytics and service-health metrics. These counts do not identify individual Guests.
• In the future, we may send a single transactional email to a Guest whose email was provided — for example, "An admin has posted your scoring on Pinpoint. View it online and create an Account to claim your scores." This kind of email is operational, not marketing. If the Guest creates an Account, they will go through the standard onboarding consent flow, including separate opt-in for marketing communications.

We never automatically subscribe a Guest to marketing emails without their direct, affirmative consent obtained through the standard onboarding flow.

3. Information We Collect

We only collect personal information that we genuinely need to provide and improve the Service.

3.1 Information You Provide Directly

• Account information: name, email address, profile photo (optional), display name, time zone, language preference.
• Optional contact information: city or region, phone number (used for SMS notifications where you opt in).
• Bowling profile information: bowling federation or association license number(s) (for example, USBC, CTF, or other governing-body identifiers), bowling average, handicap, and hand dominance (left/right). These fields are optional unless required by an Event you register for.
• Billing information (for paid Organizer accounts): if you are a League Admin, Tournament Organizer, or Center Admin who pays for the Service, billing details (such as billing name, billing address, and email used for invoicing) and your payment method information are collected and processed by Stripe, our third-party payment processor. Pinpoint does not collect or store full payment card numbers ourselves. We may receive limited information from Stripe (such as the last four digits of a card, card brand, country of issue, and the success/failure of a transaction) to manage your subscription and to comply with our financial record-keeping obligations.
• League and event data: team rosters, match results, scores, statistics, event registrations, comments, and any other content you submit.
• Communications: messages you send to us (support requests, feedback).
• Parent/guardian information (where applicable): see Section 9.

We may add additional features over time (such as photo and video uploads, or device identifiers for push notifications). When we do, we will update this Policy and, where required by law, request your consent before collecting that additional information.

3.2 Information from Authentication Providers

When you sign in using a third-party identity provider, that provider shares limited account information with us as authorized by you. The providers we currently support at launch are:

• Google
• Facebook (Meta)
• Apple
• Discord

We may add additional identity providers in the future (and will update this Policy when we do). The information we receive typically includes your name, email address, profile picture, and a unique identifier from the provider. We do not receive your password. Each provider has its own privacy policy that governs the data it shares with us.

3.3 Information Collected Automatically

When you use the Service, we automatically collect limited technical information to ensure the Service functions, is secure, and can be improved.

Always collected (Strictly Necessary):

• IP address, used for security, abuse prevention, geolocation at the country/region level, and as required for the Service to function.
• Operational request metrics for service-health monitoring (for example, how many requests succeeded or failed), separate from PostHog page-view analytics.
• Error and security logs, including timestamps and error messages.

Image moderation records:

When an image you upload is checked before publication (see Section 4.2), our servers send PostHog a record of each check: the kind of image (for example, a profile photo or a logo), the check's scores and outcome, any failure reason, and how long each step took. A record carries only a random reference to that one upload attempt. It contains no account, person, or organization identifier, no image, URL, or file name, and no IP address or device information of yours, because our servers send it. We use these records only to measure and tune moderation, and we do not link them to you. A record's scores match the result we keep with the uploaded image (Section 4.2), so matching the two would be technically possible; we do not do it. Your analytics choices, "Turn off all analytics", Global Privacy Control, and Do Not Track do not apply to these records.

Calendar Feed records:

Your Calendar Feed is the private calendar link you can get from your Account, which your calendar app reads again from time to time to keep your events up to date. Each time a calendar app reads it, our servers send PostHog a record of that read naming only the kind of calendar app (Google, Apple, Outlook, or other), taken from the app's request. A record carries only a random reference to that one feed, which a new reference replaces when you reset your link. It contains no account, person, or event identifier, no link, and no IP address or device information of yours, because our servers send it. We use these records only to count how many Calendar Feeds are in use, and we do not link them to you. We keep the random reference with your feed, so matching the two would be technically possible; we do not do it. Your analytics choices, "Turn off all analytics", Global Privacy Control, and Do Not Track do not apply to these records, because your calendar app, not your browser, reads the feed.

Cookie-based product analytics, collected only with your opt-in consent:

If you opt in to analytics through our cookie banner, our analytics provider PostHog (see Section 5.1) collects additional information to help us understand how the Service is used and improve it. This typically includes:

• Device type, operating system, and browser
• Screen size and basic device characteristics
• Pages visited, features used, session duration, and click events; page and navigation URLs omit query strings and fragments
• A pseudonymous identifier so we can recognize the same browser across sessions; after sign-in, permitted activity on that browser, including activity before you signed in, can be linked to your internal Account identifier. We do not send your name or email to PostHog for identification.
• Sign-up, sign-in, and sign-out steps: that a step started, finished, or failed, the sign-in provider used, and a general reason for a failure. Authentication and profile-completion pages are not captured as pages; a step that happens on one waits in your browser and is sent from the next page you open, on that visit or one within a week; an older one is discarded instead of sent.
• IP-derived approximate location (country/region only)

We do not collect precise GPS location, biometric data, hardware fingerprints, or browser-plugin information.

Session recordings require a separate optional choice, together with analytics permission. PostHog can reconstruct permitted interactions to help us understand confusing flows. Inputs and ordinary page text are masked, images and embedded content are blocked, and authentication/profile-completion routes are excluded. We do not record request or response bodies or console output. URL query strings and fragments are removed from analytics and recording context.

Limited cookieless page-view analytics in approved locations:

After you explicitly reject product analytics under the current cookie notice, we may collect basic page views through PostHog in locations approved for this mode. It starts only after your current choice is recorded and the site's regional configuration permits it. Unanswered notices, pending choices, and rejections under an earlier notice do not activate this mode. An earlier rejection stays off until you make a new choice under the updated notice. This is analytics, separate from the necessary operational logs above.

In this mode, PostHog processes the IP address, user agent, and website hostname to calculate a salted hash that changes each day, and discards the raw IP address. That hash supports daily estimates; it is not a stable person identifier and is not linked to your Account or to cookie-based analytics. We send only page views, with URL credentials, query strings, and fragments removed and referrers limited to the referring domain. We do not use analytics cookies, localStorage or sessionStorage analytics persistence, stable browser or session identifiers, account identification, person-profile updates, session recordings, automatic interaction capture, feature flags, or custom product/error events in this mode. PostHog processes these events in the United States. Cookieless measurement is not treated as a universal exemption from applicable privacy requirements; it stays disabled outside approved locations or when location/configuration cannot be verified.

You can withdraw product analytics or recording consent at any time through the "Cookie preferences" control in the website footer or in your Account settings. Withdrawing consent stops cookie-based collection without interrupting your registration or scoring work. To stop both cookie-based analytics and the limited cookieless page views, select "Turn off all analytics" in cookie preferences. We store this separate preference without an analytics identifier so we can honor it on this site and browser. An active Global Privacy Control or Do Not Track signal also disables both analytics modes and recordings. Necessary operational logs continue for service-health and security purposes. Changing a preference does not itself delete information already collected; you can request deletion as described in Section 10.

3.4 Information We Do Not Collect

We do not request or collect special categories of data (such as racial or ethnic origin, political opinions, religious beliefs, health information, biometric data, or sexual orientation). Please do not submit such information through the Service.

4. How We Use Your Information and Legal Bases (GDPR)

Under GDPR, we must have a lawful basis for processing your personal information. We rely on the following bases:

You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Under PIPEDA, we collect, use, and disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances, and we obtain consent (express or implied, depending on context and sensitivity).

4.1 Marketing Communications

We may send marketing emails about Pinpoint features, new functionality, leagues, events, promotions, and similar topics. Marketing communications are only sent to Users who have given express opt-in consent, in line with the requirements of:

• Canada's Anti-Spam Legislation (CASL);
• the EU/UK GDPR and ePrivacy rules;
• and similar requirements in other jurisdictions.

You can withdraw marketing consent at any time by:

• clicking the unsubscribe link in any marketing email;
• changing your preferences in your Account settings; or
• emailing privacy@pinpointbowl.com.

Withdrawing marketing consent does not affect service-related communications (such as security alerts, billing notices, and changes to these terms), which we will continue to send as long as you have an Account.

4.2 AI and Machine Learning Features

We may introduce AI- or machine-learning-powered features in the future (for example, performance insights, suggested team placements, or score predictions). Before launching any such feature that processes your personal data, we will update this Policy and, where required, obtain your consent or rely on another appropriate legal basis. We will not introduce any feature that makes solely automated decisions producing legal or similarly significant effects on you (within the meaning of GDPR Art. 22) without specific notice and the protections required under applicable law.

Automated image moderation. Before an image you upload (such as a profile photo or an organization logo) is published, an automated model checks it against our content rules. We send Cloudflare Workers AI a copy of the image reduced to at most 1024 pixels on a side, and it returns a score for each rule. An image that fails a check is not published, and you can upload a different one. We keep the check's result with the uploaded image, and send PostHog the moderation records described in Section 3.3. We rely on our legitimate interest in keeping the Service safe and free of abusive content.

5. How We Share Your Information

We do not sell your personal information to third parties. Ever.

We share information only in the limited circumstances described below.

5.1 Subprocessors and Service Providers

We rely on a small number of carefully chosen service providers ("subprocessors") to operate the Service. They process personal data on our behalf, only on our instructions, and under contractual confidentiality and security obligations.

Each subprocessor processes only the data necessary to perform its function. We review their security and privacy practices before engaging them and require them to commit to GDPR-compliant data processing terms. Each of these providers publishes its own Data Processing Addendum or equivalent — links are available on our public subprocessors page (see below).

A current list of subprocessors is maintained at pinpointbowl.com/legal/subprocessors. We will notify users of material changes to this list.

5.2 Other Users of Pinpoint

The Service is collaborative. Information you share within a league, team, or event (e.g., your name, scores, comments) will be visible to other members of that league, team, or event. League administrators may have access to additional information about their league members.

Where the Service includes public-facing displays such as live scoring, leaderboards, center-wide score feeds, tournament pages, standings, brackets, or historical result archives, your Event-related information may be visible beyond a single league. This may include your name or display name, team, scores, standings, match results, awards, and other competition records.

Bowling leagues and tournaments often maintain public historical records, similar to other sports results. Unless the relevant Center, League Admin, or Event administrator removes or restricts the Event record, these public Event records may remain available after the Event ends and after you delete your Account. Account deletion removes or deactivates your Account and private profile/contact details; it does not necessarily remove your name, scores, standings, or other information from historical Event records where that information forms part of the official or public record of the Event.

League and Event administrators may configure privacy settings for their Events and may remove or correct Event records where appropriate. If you have a concern about a public Event record, contact the relevant administrator first. You may also contact us at privacy@pinpointbowl.com, and we will review the request or help direct it to the appropriate administrator. We may remove, anonymize, restrict, or correct public Event information where required by law, where the information is inaccurate, or where we determine that continued publication creates a disproportionate privacy or safety risk.

For children registered by a Parent, the additional protections in Section 9 apply. In particular, upon Parent request, we will anonymize or remove child-identifying information from public Event records where reasonably feasible, unless retention is required by law or needed for a specific safety, integrity, dispute-resolution, or legal purpose.

5.3 Legal Disclosures

We may disclose information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or subpoena), or where we believe in good faith that disclosure is necessary to protect our rights, your safety or the safety of others, or to investigate fraud.

5.4 Business Transfers

If Pinpoint is involved in a merger, acquisition, or sale of all or part of its assets, your information may be transferred. We will notify you and provide options where required by law.

6. International Data Transfers

Because many of our subprocessors (Convex, Railway, PostHog, Amazon SES, Stripe, Google Maps, and others) are located in the United States, Cloudflare operates a global edge network, and JetEmail Pty Ltd is based in Australia, your personal information may be transferred internationally.

When we transfer personal data out of the EEA or UK, we rely on appropriate safeguards as required by GDPR, including:

• The European Commission's Standard Contractual Clauses (SCCs) and the UK's International Data Transfer Addendum, as published by each of our subprocessors;
• Adequacy decisions, where they apply;
• Supplementary technical and organizational measures (such as encryption in transit and at rest) where necessary following the Schrems II decision.

Note on PostHog (analytics). PostHog is hosted in the United States (PostHog Cloud US). This applies to permitted cookie-based product analytics and, where enabled in approved locations, limited cookieless page-view measurement. We apply the identifier and URL limits described in Section 3.3. You can stop both analytics modes and recordings through "Turn off all analytics" in cookie preferences. An active Global Privacy Control or Do Not Track signal has the same effect. Necessary operational logs, and the image moderation records and Calendar Feed records described in Section 3.3, are separate from this PostHog collection.

For Canadian users, in accordance with PIPEDA, you should be aware that personal information processed by our subprocessors in the United States or other jurisdictions may be subject to the laws of those jurisdictions, including lawful access by foreign authorities. We use contractual measures to ensure a comparable level of protection.

You may request a copy of the safeguards in place by contacting us at privacy@pinpointbowl.com.

7. Data Retention

We keep personal information only as long as necessary for the purposes described in this Policy, or as required by law. Different categories of data are kept for different periods:

Even after these periods, we may retain personal data for longer if it is necessary to fulfil a legal obligation, or to establish, exercise, or defend legal claims. When data is no longer needed, it is deleted or anonymized.

7.1 Account Inactivity

If you do not log in to your Account for 24 consecutive months, we will send you a notice to your registered email address giving you a reasonable opportunity to keep the Account active. If you do not respond within the notice period, we will deregister your Account and delete or anonymize your private Account and profile information, except where retention is required by law or these terms.

Deregistering, deleting, or anonymizing your Account does not necessarily remove public Event records, historical scores, standings, tournament results, or league records that identify you by name or display name. Those records may continue to be retained and displayed as described above.

8. Cookies and Similar Technologies

We use a small number of cookies and similar technologies. We distinguish necessary storage, settings saved on your device, optional cookie-based analytics and recordings, and limited cookieless page-view measurement:

8.1 Strictly Necessary (always on)

Required to operate the Service: authentication, session management, security, load balancing, abuse prevention, and storage of your privacy preferences. These cannot be turned off because the Service would not function without them. Necessary operational request metrics, error logs, and security logs support service health independently of PostHog analytics. PostHog page-view measurement is not classified as strictly necessary.

8.2 Settings Saved on Your Device

Some screens remember display and convenience choices on this device, such as the last bank you opened from the payment panel or how a printed sheet is laid out, so they open the same way next time. These settings are kept in this browser's local storage, not in your Account. They are used only to show the screen the way you chose, they are not analytics, and clearing this site's data removes them.

8.3 Product Analytics and Session Recordings (opt-in only)

Cookie-based product analytics and recordings are only enabled if you give explicit consent through our cookie banner. Product analytics and session recordings have separate choices, and recordings also require analytics permission. Your choice applies to this site and browser; using another branded site or signing in does not automatically grant optional consent there. Rejecting optional categories does not affect sign-in, registration, or scoring.

We remember preferences for up to 180 days and ask again when a material consent notice changes. We keep a limited consent record, including the choice, notice version, site, language, timestamps, and a random browser reference, to document the decision. Records are scheduled for deletion after 730 days and removed during regular retention cleanup. This consent record applies to the browser and site and is not linked to your Account. It does not contain raw IP addresses, your name, or your email. You can change your preferences at any time through the "Cookie preferences" control in the footer or Account settings.

We do not use advertising cookies or share data with advertising networks.

8.4 Limited Cookieless Analytics and Full Opt-Out

Where enabled in approved locations, an explicit, recorded rejection of product analytics under the current notice can allow the limited cookieless page views described in Section 3.3. This does not enable analytics cookies, account linking, interaction capture, or recordings. We do not activate it while a notice is unanswered, while a choice is pending, or from a rejection under an earlier notice. Unknown or unapproved locations keep this mode disabled.

Select "Turn off all analytics" in cookie preferences to stop both analytics modes and recordings. This is a separate, non-identifying local preference, not an analytics cookie or a new consent purpose. Global Privacy Control and Do Not Track also stop all PostHog analytics collection. Essential operational logs, the image moderation records and Calendar Feed records described in Section 3.3, and the storage needed to honor your privacy choices continue.

9. Guests, Children, and People Without an Account

Pinpoint allows Customers (Centers, League Admins, Tournament Organizers) and Parents to add Guests — people who participate in an Event without creating their own Pinpoint Account. Guests can include adult bowlers (for example, a senior who doesn't want to manage an Account), other family members, or children registered by a Parent.

9.1 Guest Registration (General Rules)

When a Customer or Parent adds a Guest:

• We require only the Guest's first and last name.
• All other fields (email, phone, federation/association license number, bowling average) are optional.
• If an email is provided, the registering person must affirmatively confirm that the Guest has consented to be contacted at that email address. We will not automatically add Guests to any mailing list (see Section 2.3 for full Guest data handling).
• Event Organizers may, at their own discretion, ask a Guest to present identification matching the registered name on arrival at an Event. That identification check is between the Organizer and the Guest; Pinpoint does not store identification documents.

9.2 Children Specifically

If a Guest is under the digital consent age in their jurisdiction (under 13 in Canada and the U.S., or up to 16 in some EU member states under GDPR Art. 8), additional protections apply:

• A child cannot register a Pinpoint Account directly.
• A Parent or legal guardian must add the child as a Guest through their own Pinpoint Account, and must affirmatively confirm at the time of adding that:
  1. They are the child's parent or legal guardian and have the legal authority to provide consent on the child's behalf;
  2. They consent to our collection and use of the child's information solely to register and administer the child's participation in the relevant Event(s);
  3. They are providing only the minimum information necessary.
• The child does not receive Pinpoint communications, login credentials, or Account access. The Parent acts as the child's representative within the Service.
• The Parent can review, correct, delete, or request anonymization of the child's information at any time through their Account or by emailing privacy@pinpointbowl.com.
• The Parent can withdraw consent at any time. On withdrawal, we delete or anonymize the child's personal information within a reasonable period and remove the child from active Events (subject to Event-level rules administered by the relevant League Admin). Where the child's name or display name appears in public Event records, we will anonymize or remove child-identifying information where reasonably feasible, unless retention is required by law or needed for a specific safety, integrity, dispute-resolution, or legal purpose.

9.3 How We Verify Parental Consent

To meet the verifiable parental consent requirements of GDPR Art. 8, PIPEDA's meaningful consent guidance, and (where applicable) the U.S. Children's Online Privacy Protection Act (COPPA), we use the following process:

1. Parent-only registration. A child cannot register an Account directly. The Parent must first create their own Account using their own valid email and authentication.
2. Affirmative in-app consent. When a Parent adds a child as a Guest, the Parent must affirmatively confirm (via an explicit checkbox or equivalent action — not pre-ticked) that they are the child's parent or legal guardian and consent to our limited collection and use of the child's information.
3. Confirmation record. We log the date, time, and method of consent, and we send a confirmation email to the Parent's verified email address summarizing the information collected and how to withdraw consent.
4. Stronger verification where required. Where applicable law requires a stronger form of verifiable consent (for example, certain COPPA contexts), we may require additional verification steps, such as a credit card transaction (no charge), signed consent form, or government-ID check, before completing registration.
5. Withdrawal. Parents can withdraw consent at any time through their Account settings or by emailing privacy@pinpointbowl.com.

9.4 Limits on Use of Children's Data

Where we hold information about a child:

• We use it only for the limited purposes described in this Policy and to administer the child's participation in the Event(s) the Parent has registered them for.
• We do not send marketing communications to children.
• We do not publicly display the child's information beyond what is necessary for Event participation or limited historical Event records, and we will anonymize or remove child-identifying information from public Event records upon Parent request where reasonably feasible.
• We do not allow children to link their participation to any third-party social network from within the Service.
• We do not share children's personal information with third parties except our subprocessors acting on our behalf (see Section 5.1) or as required by law.

If we learn that a child's data has been submitted without proper parental consent, we will delete it as soon as reasonably possible. Parents who believe their child's data is in the Service without consent should contact us at privacy@pinpointbowl.com.

This approach is designed to comply with GDPR Art. 8, PIPEDA's principles regarding meaningful consent for minors, and (where applicable) COPPA.

10. Your Rights

10.1 If You Are in the EEA, UK, or Switzerland (GDPR / UK GDPR)

You have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten") in certain circumstances. This right is not absolute and may not require removal of historical Event records where continued retention or publication is lawful, necessary to preserve the integrity of competition records, or controlled by a Center, League Admin, or Event administrator.
• Restrict processing in certain circumstances.
• Data portability: receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests, including profiling.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local supervisory authority. A list of EU authorities is at https://edpb.europa.eu/about-edpb/about-edpb/members_en; the UK ICO is at https://ico.org.uk.

We do not engage in solely automated decision-making with legal or similarly significant effects.

10.2 If You Are in Canada (PIPEDA)

You have the right to:

• Access the personal information we hold about you and request information about how it is being used and to whom it has been disclosed.
• Correct inaccurate or incomplete information.
• Withdraw consent for collection, use, or disclosure (subject to legal or contractual limits). Withdrawal may not require removal of historical Event records where retention or publication remains appropriate in the circumstances or where the relevant Customer controls the record.
• Challenge our compliance with PIPEDA. You can also file a complaint with the Office of the Privacy Commissioner of Canada at https://www.priv.gc.ca.

10.3 How to Exercise Your Rights

Email us at privacy@pinpointbowl.com or use the in-app account settings. We will respond within one month (GDPR) or 30 days (PIPEDA), or otherwise notify you of any extension allowed by law. We may need to verify your identity before fulfilling certain requests.

11. Data Security

We use a combination of technical and organizational measures to protect personal information, including:

• Encryption of data in transit (TLS) and at rest where supported by our infrastructure providers;
• Access controls and authentication for our staff;
• Regular review of our subprocessors' security postures;
• Secure software development practices.

No system is completely secure, but we work continually to protect your information. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected users in accordance with GDPR (within 72 hours where feasible) and other applicable laws.

12. Changes to This Policy

We may update this Policy to reflect changes in our practices or legal requirements. The "Last Updated" date at the top will reflect the most recent revision. For material changes, we will notify you in-app or by email before they take effect. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

13. Contact Us

For any privacy-related question, request, or complaint:

• Email: privacy@pinpointbowl.com
• Mail: Available on request — please email us first.

We aim to respond to all inquiries promptly and in good faith.