Curling IO Privacy Statement

Who we are and what this covers​

2508941 Ontario Inc. operates Curling IO. This statement describes information handled through Curling IO accounts, registrations, club and association administration, competition results, club websites and hosted assistants.

A club or association also decides how to use the information it collects for its own activities. Contact that organization about its registration questions, participation rules and use of its members' information. Contact Curling IO about the service and the information we hold.

Administrators decide which people and external tools they authorize and what information they export or share through those choices. Curling IO remains responsible for its own handling of information and the providers it selects. An administrator's agreement does not remove anyone's applicable privacy rights or authorize unrelated processing.

Information we collect​

The information depends on the features you use. It can include:

• account identifiers, sign-in email addresses and verified email records;
• participant names, contact information, dates of birth and other profile fields supplied by you, a guardian or an authorized organization;
• registration answers, waivers, surveys, supporting uploads and membership or association-fee information;
• orders, payment and refund references, billing records and payment states;
• team lineups, schedules, game scores and club website content;
• support requests, attachments and information needed to investigate errors;
• administrator actions, agreement decisions and assistant interactions.

Requests also supply technical information such as an IP address and browser information. Sign-in and preference cookies help the service maintain your session and remember settings.

Only provide information you have the right to provide. Avoid putting sensitive information in public website content or an assistant prompt when the task doesn't require it.

How information is used​

We use information to provide accounts and registrations, manage competitions and club websites, process and reconcile transactions, deliver requested messages, support users, investigate errors, protect the service and keep records of administrative activity.

Assistant and audit records also support investigation, product improvement and review of the prompts and information supplied to our assistant. These uses are distinct from a club's optional marketing activity. The marketing and documentation website also has advertising measurement and can use a connected search service. Its request information and search terms can reach those services where enabled.

Organizations, other users and public pages​

Authorized Managers can access information relevant to the features and organizations their permissions cover. Membership associations can receive association-related information through the features available to them. A person managing a participant profile can act for that profile where the service permits it, including a guardian managing a child's profile.

Some features share information with other participants. For example, opting into an event's free agent list shares the profile's available email and phone with eligible registrants in that event. Check the feature's explanation and your profile settings before choosing to share contact details.

An organization can publish website content, schedules, results and other information through public display settings. Information published on a public page can be viewed and copied by visitors. Ask your club or association what it publishes and how to request a correction.

Service providers and connected services​

The V3 hosting configuration uses OVH Beauharnois, Quebec, for primary production and OVH Gravelines, France, for a standby host and development copies of customer data used for migration and validation. During a failover, production data can be stored and served from Gravelines. BHS-region object storage holds uploads and retained backups. OVH Toronto, Ontario (Canada), holds live database replication. Cloudflare provides network and web-traffic services where enabled. DeepInfra processes hosted-assistant requests in the US or Canada using DeepSeek models. Postmark handles transactional email. Payment processing uses Stripe or SportsPay, depending on the organization and payment method.

The website uses Google advertising measurement and can use Algolia search when connected. These services can receive website request information or search terms. They are separate from a club's optional marketing integration.

Payment processors receive information needed for a payment under their own privacy terms. Curling IO retains the associated transaction records and references. An organization's optional Mailchimp integration sends selected contact information to that organization's connected service. Connected Intuit QuickBooks and configured webhooks can also transmit service data to the organization's selected recipients. When you choose Google sign-in, Google processes the sign-in request and Curling IO uses the verified identity to sign you in. These connected services have their own privacy terms.

Optional integrations, exports, external agents and the built-in assistant are choices; ordinary administration does not require them. Account terms acceptance does not activate those features. An administrator may also move information by manual export/import or an external workflow, including tools such as Zapier or n8n where supported. Naming a service does not promise a native connector. Outside accounts and downstream copies are subject to the selected service's practices and the administrator's access decisions; revoking a Curling IO grant does not delete copies already held outside the platform.

Each provider processes in the place the table above lists. Live database replication is in Toronto, Ontario, Canada. Production hosting and storage are normally in Canada; during a failover they run from France. The standby host, redundancy backup and development copies are in France. DeepInfra processes assistant requests in the US or Canada. Postmark processes email in the United States, partly on Amazon Web Services. Information processed outside Canada may be subject to access by authorities under that jurisdiction's laws.

Administrator records​

Record History records selected business changes with their actor, time and changed values. It supports accountability and investigation. It is not a log of every database write, and it does not guarantee that a change can be undone.

An operation log separately records administrator request metadata, including the operation, path without its query string, outcome, user, organization and available impersonation or agent flags. That log doesn't store request bodies. Entries may be incomplete or unavailable, and neither that log nor Record History is a complete record of every administrative action, every field read or downstream outside-service activity. Other records, such as registration answers and assistant history, can still contain information submitted in a request.

Agreement records can include the user, organization, document key and version, request or display time, decision time, acceptance or decline, and optional agent-access intent. A new chat or a declined proposal doesn't erase those separate records. Administrator Agreement acceptance is recorded for the account across its Organizations. Customer external native-agent access has a separate user-and-Organization grant that can be revoked independently. Revocation does not erase the historical agreement or operation records.

Hosted assistants, Prompt Audit and your own agent​

Our hosted assistant processes your prompts, relevant conversation and page context, and reference images with its AI service provider. Its proposed writes follow the service's approval and authorization rules. Review the proposed change before approving it. Choosing the built-in assistant does not require the separate external Agent Access Agreement.

DeepInfra processes assistant prompts and responses in the US or Canada. Content stays in memory, is deleted after inference, is not stored on disk or logged, and is not used for training. DeepInfra retains service metadata such as request identifiers, cost and sampling parameters. See DeepInfra's data privacy policy.

Provider ZDR does not change the chat history, audit, usage and other records Curling IO keeps under the retention periods below. It does not cover an external agent or provider you choose yourself.

Saved chat history and live working conversation state are separate. Clearing a chat starts fresh working context; it doesn't immediately delete the saved history. Usage and accounting records can remain after content is removed.

Website Studio Prompt Audit records selected manager prompts for asynchronous review and product improvement. The review produces sanitized prompt text and sensitivity information, and removes the raw prompt after the review or its expiry. Sanitization is a processing step, not a guarantee that all identifying information is removed.

An external agent you connect can see and act on information available through your permissions. Its provider is your chosen provider and has its own data practices. Curling IO can record access requests and attempts to use automated agent interfaces. Connecting an agent doesn't give it permissions you lack. For customer administrators, access through native WebMCP requires the separate Agent Access Agreement for that user and Organization. Browser automation remains subject to the ordinary server permissions and applicable administrator duties. Neither general administrator acceptance nor a native-access grant approves an individual action.

Retention and deletion​

The application's scheduled maintenance distinguishes the following records:

Saved chat history retains visible text and page context, rather than an image archive. The two-day Studio cutoff is not a promise that image data in every conversation, provider or backup is removed after two days. Other live context follows its own content retention.

These periods describe application content maintenance. They don't establish retention at an AI or payment provider, and maintenance may complete after its cutoff. These are scheduled application cutoffs, not a guarantee that all content or copies disappear at that moment.

Order, financial, agreement and other records follow their own purposes and retention requirements. Expiry of assistant text doesn't delete those records. A request to remove a participant or cancel a registration doesn't necessarily remove transaction or audit records.

Backups can retain information after it is removed from the working database. The configured database replica has a 30-day snapshot retention period. That setting is not a guarantee that every backup, uploaded file or provider copy expires on the same schedule, or that an offsite restore has been tested. We don't promise immediate deletion from every backup or from a service provider's independent records.

Your choices and requests​

Contact [email protected] to request access to, correction of or deletion of personal information held by Curling IO, to withdraw consent where applicable, or to raise a privacy concern. We may need to verify your identity and authority to act for a participant or organization.

Requests about a club's or association's own records may need that organization's involvement. Some records may need to be retained for legal, financial or security reasons. We will explain applicable restrictions when responding to a request.

Security​

We use access controls and other safeguards to protect information. The service uses server authorization for organization and account actions. Administrators must protect their sign-in email accounts, grant appropriate roles and remove access that is no longer needed.

No system can promise perfect security. Report suspected unauthorized access to [email protected].

Changes to this statement​

We identify when a change takes effect in its notice. Material changes receive notice to affected organizations or accounts, and we request additional consent when required. The Terms of Use describe public-service obligations and common rules. Authenticated administration has a separate versioned Administrator Agreement; external native-agent access has its own Agent Access Agreement. Neither acceptance grants blanket permission for new purposes or replaces a separate consent required for a particular use.