Terms of Service
How GCN collects, uses, discloses, and protects information in connection with the Service.
Effective August 1, 2026. This Privacy Policy explains how Godfather Collective Network LLC ("GCN," "we," "us") collects, uses, discloses, and protects information in connection with the Service. It applies to Athletes, Brands, visitors to the Site, and applicants, and forms part of the TOS. GCN is the controller of the information described here. Where GCN processes information on a Brand's behalf as part of that Brand's campaign, GCN acts as that Brand's processor or service provider and the Brand's own privacy notice governs. Our postal address is 241 Atlantic Blvd., Neptune Beach, Florida.
It is as important to say what we do not hold. We do not collect a date of birth; you attest at registration that you are 18 or older. We do not collect or store Social Security numbers, taxpayer identification numbers, bank account numbers, payment card numbers, or government identification. Athletes provide those directly to Stripe through Stripe's own hosted onboarding, and Brands enter card details directly into Stripe Checkout; that information never passes through our systems, and we hold only Stripe's opaque reference identifiers. We do not collect precise geolocation, biometric or genetic data, health information, or data revealing racial or ethnic origin, religious beliefs, sexual orientation, immigration status, union membership, or the contents of your private communications outside the Platform. We do not perform device fingerprinting or location tracking.
The only information we hold that a state privacy statute would classify as sensitive is your account log-in credential, which we hold as a hash and use solely to authenticate you. We do not use it to infer any characteristic about you, so no right to limit its use arises under those statutes.
We do not use your information for targeted advertising, we do not profile you in furtherance of decisions that produce legal or similarly significant effects, and we do not use it to train artificial-intelligence models unless you have separately opted in as described in the Terms of Use. The gig alerts you can enable are filtered against tags and a pay threshold you choose yourself; that is preference-based filtering you control, not scoring or profiling of you.
We share information with the counterparty to a campaign (e.g., sharing an Athlete's profile and rate with a Brand, or a Brand's campaign brief with a matched Athlete), and with the following service providers, which is the complete list as of the effective date: Supabase, which hosts our database, authentication, and file storage; Stripe, which handles payments, payout onboarding, identity verification, and tax reporting; Resend, which sends transactional email and receives the recipient's address and the message contents; Vercel, which hosts the application and generates standard server request logs; and the third-party AI providers described below. We also disclose information where required by law, to respond to lawful process, to enforce the TOS, to protect the rights or safety of any person, and to a successor in connection with a merger, acquisition, or sale of assets, in which case we will give notice before your information becomes subject to a different privacy policy. Each service provider is bound by contract to process information only for the purposes we specify. We have not sold personal information and do not sell it, as "sell" is defined under California and other state privacy statutes. We do not share personal information for cross-context behavioral advertising, and we do not disclose personal information to any third party for that party's own independent purposes. We have not sold or shared the personal information of any consumer, including any consumer we know to be under 16, in the preceding twelve months. Payment card and bank account details are collected and processed directly by Stripe under Stripe's own privacy policy and security standards; GCN does not store your full payment card or bank account numbers.
Athlete profiles are public by design. The roster page and each athlete page, including display name, location, ranking, biography, profile photo, social handles, follower counts, category tags, and rate card, can be viewed by anyone on the internet without an account, and may be indexed by search engines and copied or cached by third parties beyond our control. Please do not include information in your profile that you would not want published. Brand company information is visible to Athletes matched to a campaign. Messages, negotiation history, deal records, and content submissions are not public and are visible only to the parties to the deal and to authorized GCN staff.
We set authentication cookies only, for the purpose of keeping you signed in. We do not set advertising cookies, analytics cookies, or any third-party tracking cookie, and there are no advertising or analytics tags anywhere on the Site. Because we do not track you across sites, there is nothing for a Do Not Track browser setting to change, and we do not respond to those signals. We honor Global Privacy Control and other recognized universal opt-out signals to the extent they apply; as we neither sell personal information, share it for cross-context behavioral advertising, nor conduct targeted advertising, such a signal has no practical effect on our processing.
Certain features of the Platform use third-party large language models to process Inputs you provide (such as campaign briefs, deliverables, and profile information) and generate Outputs (such as match recommendations, compliance flags, and draft reports). These third-party AI providers process data solely to support the Platform's functionality and are contractually restricted from unauthorized use of your information. Our contracts with those providers prohibit them from using your Inputs or Outputs to train their own models and from retaining your data beyond what is needed to return a response. AI Tool output is advisory, is reviewed by a GCN operator before it affects account status or campaign eligibility, and no decision producing a legal or similarly significant effect is made about you by automated means alone.
We retain account and transaction information for as long as necessary to provide the Service, comply with legal and tax obligations, and resolve disputes. You should understand how deletion currently works. When a record is deleted, it is marked as deleted and hidden from the application, and the underlying row remains in the database; we do not currently run an automated purge on a fixed schedule. Two categories are retained deliberately. Signature records, including the verbatim text of the document you accepted, exist to evidence what you agreed to, and erasing them would destroy the evidence they exist for. Deal and payment history underpins our financial records and our reconciliation with Stripe, and is retained for at least the period required by tax and accounting law, which is generally seven (7) years. Where you exercise a right to deletion, we will delete or de-identify your information other than these two categories and anything else we are required or permitted to keep, and we will tell you what we kept and why.
Subject to the exceptions described in this policy, you may ask us to confirm whether we process your personal information and give you access to it; provide a copy in a portable, machine-readable format; correct inaccurate information; delete your information; opt out of the sale of your information, of sharing for cross-context behavioral advertising, and of profiling in furtherance of significant decisions, none of which we do; limit the use of sensitive personal information; and obtain a list of the categories or, in some states, the specific third parties to which we have disclosed your information. You will not be discriminated or retaliated against for exercising any of these rights, and we will not deny you service, charge you a different price, or give you a lower quality of service because you did so.
How to submit a request. Email legal@pickleballdealroom.com. Please tell us which right you are exercising and the email address on your account. We will verify your identity before acting, ordinarily by confirming control of the account email, and for sensitive requests we may ask for additional information, which we use only to verify the request and then delete. We do not require you to create an account to submit a request. An authorized agent may submit a request on your behalf with written permission signed by you, and we may still contact you to confirm.
Timing. We acknowledge requests promptly and respond within forty-five (45) days. Where reasonably necessary we may extend once by a further forty-five (45) days, and will tell you within the first period if we do. There is no charge for the first two requests in a twelve-month period; we may charge a reasonable fee for a manifestly unfounded, excessive, or repetitive request, or decline it and tell you why.
Appeals. If we decline your request in whole or in part, you may appeal by replying to our decision with the word "Appeal" in the subject line, or by writing to legal@pickleballdealroom.com. We will review the appeal and give you a written decision, including the reasons, within sixty (60) days. If we deny the appeal, we will give you a means to contact your state attorney general to submit a complaint.
Requests are currently serviced manually by a member of GCN staff; there is not yet a self-service export or deletion tool in the Platform. That does not affect your rights or our response timelines.
Twenty states now have comprehensive consumer privacy statutes in effect. Nearly all of them apply only above a threshold, most commonly processing the personal data of 100,000 residents of that state in a year, or 25,000 to 35,000 where a share of revenue comes from selling personal data. Connecticut lowered its threshold to 35,000 residents effective July 1, 2026, and removed the minimum entirely for businesses that sell personal data or process sensitive data. Texas and Nebraska take a different approach and apply to any business that is not a small business under the federal Small Business Administration size standards, with a prohibition on selling sensitive data without consent that applies to businesses of every size. Florida's statute reaches only very large technology companies.
GCN is below every one of these thresholds and is a small business under the SBA size standard for its industry, so most of these statutes do not currently apply to it. We have chosen not to rely on that. The rights and processes described in this policy are offered to every resident of the United States regardless of state and regardless of whether a statute compels them, and we will continue to honor them if our size changes.
As of the effective date, the following statutes are the ones in effect: the California Consumer Privacy Act as amended by the California Privacy Rights Act; the Virginia Consumer Data Protection Act; the Colorado Privacy Act; the Connecticut Data Privacy Act; the Utah Consumer Privacy Act; the Iowa, Indiana, Tennessee, Montana, Texas, Oregon, Delaware, New Jersey, New Hampshire, Kentucky, Nebraska, Maryland, Minnesota, and Rhode Island consumer data protection or privacy acts; and the Florida Digital Bill of Rights.
If you are a California resident, the CCPA gives you the rights described above and requires us to disclose the following for the twelve months preceding the effective date of this policy. We collect the following statutory categories: identifiers, including name, email address, account identifier, and IP address; customer records information, including phone number and contact details; commercial information, including campaign, deal, and transaction records; internet or other electronic network activity information, limited to server request logs and browser user-agent; audio, electronic, or visual information, being profile photographs and uploaded content submissions; and professional or employment-related information, including ranking, rate card, category tags, and biography. We collect account log-in credentials, which the statute classifies as sensitive personal information, and use them only to authenticate you.
We do not collect the following categories: characteristics of protected classifications; biometric information; precise geolocation; education information; or inferences drawn to create a profile about you. We obtain information directly from you, automatically from your device in the form of server logs, and from Stripe in the form of payout and verification status. We use it for the business purposes listed in the How We Use Information section, and we disclose it for business purposes to the service providers named above. We have not sold or shared personal information, and we do not use or disclose sensitive personal information for any purpose that would give rise to the right to limit under Section 1798.121. We retain each category for the periods described in the Data Retention section.
California residents may also designate an authorized agent, and may request information under California's Shine the Light law, Civil Code Section 1798.83, about disclosures to third parties for their direct marketing purposes; we make no such disclosures. California law provides a private right of action for certain data breaches. If you are under 16, we do not knowingly collect your information at all, and we do not sell or share it.
If you are a resident of Colorado, Connecticut, Virginia, Delaware, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, or Texas, you have the rights to confirmation and access, correction, deletion, portability, and to opt out of targeted advertising, sale, and profiling in furtherance of decisions producing legal or similarly significant effects. We do none of those three things. You also have the right to appeal a denied request, as described above, and to complain to your state attorney general. We process sensitive data only in the narrow sense described in the Information We Do Not Collect section, and we do not process it for any purpose requiring consent. We recognize universal opt-out mechanisms including Global Privacy Control in the states that require it.
Some of these states add specific rights. Oregon residents may request a list of the specific third parties to which we have disclosed personal data, not merely the categories, and we will provide the list in the How We Share Information section. Minnesota residents may question the result of profiling, be informed of the reason for it, and review the personal data used; because we do not profile, this right has no application to us. Maryland residents benefit from a strict data minimization standard and a prohibition on selling sensitive data, which we meet by not selling any data and by collecting only what the Platform needs. Utah and Iowa provide a narrower set of rights than the states above; Utah added a right to correct effective July 1, 2026, which we honor. Texas and Nebraska residents should note the sensitive-data provisions described above; we do not sell sensitive data and therefore no consent notice is required.
Nevada residents may opt out of the sale of certain covered information under Nevada Revised Statutes Chapter 603A; we do not sell covered information. Washington's My Health My Data Act and comparable consumer health data laws in Nevada and Connecticut apply to consumer health data, which we do not collect. Every state has a data breach notification statute, and we will comply with the one applicable to you. If your state enacts a comprehensive privacy law after the effective date of this policy, the rights described here will already be available to you.
The Platform lists athletes who reside outside the United States, and Brands may be located outside it. If you are in the United Kingdom or the European Economic Area, we process your personal data on the following legal bases: performance of a contract with you, for account, campaign, deliverable, and payment processing; our legitimate interests in operating, securing, and improving the Platform and preventing fraud and abuse, balanced against your rights; compliance with a legal obligation, for tax and accounting records; and your consent, for marketing communications and for the two opt-in uses of your content described in the Terms of Use, which you may withdraw at any time. In addition to the rights described above you have the rights to restrict processing, to object to processing based on legitimate interests, and to lodge a complaint with your supervisory authority, and in the United Kingdom with the Information Commissioner's Office.
Your information is stored and processed in the United States. Where we transfer personal data out of the United Kingdom or the European Economic Area we rely on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum.
We implement reasonable administrative, technical, and physical safeguards designed to protect information from unauthorized access, use, or disclosure. No system is completely secure, and we cannot guarantee absolute security. Our safeguards include row-level security enforced in the database itself rather than only in the application, so that Athletes can read only their own records and Brands only theirs, and payment-bearing tables reject direct writes from user sessions entirely. Staff access is limited by role. Passwords are stored only as hashes. If a breach of your personal information occurs, we will notify you and the relevant regulators as required by Florida law and by the breach notification law of your state or country, within the timeframes those laws require.
The Service is not directed to individuals under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected information from a person under 18, we will delete it and close the account. Arkansas, Connecticut, and several other states impose additional obligations on services directed to children or teenagers, and a small number of statutes now reach users up to age 16 or 17; because the Platform is restricted to adults and we do not run targeted advertising, those obligations do not currently apply. If a parent or guardian believes a minor has provided information to us, please contact legal@pickleballdealroom.com and we will delete it.
We may update this Privacy Policy from time to time. Material changes will be posted to the Site with an updated effective date. For changes that materially expand how we use information already collected, we will give at least thirty (30) days' advance notice by email and, where the change requires it, seek your consent. We will keep prior versions available on request.
If you have questions about this Privacy Policy, contact us at legal@pickleballdealroom.com, or write to Godfather Collective Network LLC, 241 Atlantic Blvd., Neptune Beach, Florida. We will respond within thirty (30) days.
Godfather Collective Network, LLC. Questions: support@pickleballdealroom.com. Legal notices and privacy requests: legal@pickleballdealroom.com