Privacy Policy

1. Introduction

WilDi Maps, Inc. ("WilDi Maps", "we", "us", "our") operates a two-sided mobile advertising platform. Members use the WilDi Maps mobile app to receive geo-triggered advertising events and earn passive income. Advertisers use our business portal to configure campaigns, view analytics, and manage billing.

We also operate WilDi Golf and WilDi Events, a separate service in which a course, club, or event organizer runs events from a dashboard at wildimaps.com/events/dashboard, local businesses sponsor holes or event locations, and golfers and attendees use the WilDi mobile app at the venue. In this policy, "WilDi Golf" covers both, and "golfer" includes an event attendee.

This Privacy Policy explains how we collect, use, retain, and protect information from (a) members, (b) advertisers, and (c) WilDi Golf organizers, sponsors, and golfers.

WilDi Golf and WilDi Events

This policy is the only privacy policy for WilDi Golf and WilDi Events. The former WilDi Golf Privacy Policy at wildigolf.com/privacy now redirects here. If you are an organizer, a sponsor, a golfer, or an event attendee, these are the parts written for you:

• Section 3.4: what we collect from organizers, sponsors, golfers, and attendees.
• Section 5.4: what we use it for.
• Section 6.4: location, exactly what the app sends and what we keep, and when it stops.
• Section 7.6: the wildigolf.com cookie.
• Section 9: who sees what. Section 10: how long we keep it.
• Section 15: WilDi Golf and WilDi Events are for people 18 or older only.

In short: inside the venue, location places the phone on a hole or zone for card delivery and requests. After a dated event ends, the app records only whether the phone arrives at a sponsor's address, for 30 days after the event end date, and then stops. At a standing venue, such as an ongoing golf course, the same 30 days run from the phone's last visit to the venue, and each return visit to the venue restarts the 30-day window. We do not sell location data.

2. Definitions

• Personal Information: Information that identifies or can reasonably be linked to an individual.
• Member Data: Location, device, and event-level data collected from the member app strictly for delivering and verifying campaigns.
• Advertiser Data: Account, billing, usage, and campaign configuration data submitted through the advertiser portal.
• Organizer Data: Account, course, event, roster, sponsor, and message data submitted through the WilDi Golf and Events organizer dashboard at wildimaps.com/events/dashboard (formerly wildigolf.com).
• Sponsor Data: The business name, offer, and card content a sponsor supplies, or that an organizer enters on a sponsor's behalf, for a hole.
• Golfer Data: Account, event participation, check in, service request, and on course location data collected from the WilDi Golf mobile app.
• Non-Personal Information: Aggregated, de-identified, or anonymized data not capable of identifying an individual.
• Controller: WilDi Maps acts as the controller of personal information collected from members, advertisers, and WilDi Golf and Events users.
• Processor: Third-party services that process data on our behalf (e.g., hosting, payments, analytics).

3. Information We Collect

3.1 Member Information

Information provided directly:

• Name (optional)
• Email
• Phone number, if you provide one

Payment Information (Members)

WilDi Maps does not collect or store bank account numbers, card numbers, or other sensitive payout credentials. All payout-related financial data is collected and processed directly by Stripe. WilDi only receives non-sensitive payout metadata (such as payout status and timestamps).

Earnings, pools, referrals and rewards

• Your earnings and monthly payouts, and whether your Stripe payout account is set up
• When you check in at a location pool: the time, the positions the app reports during the check in, a short record of the positions on your way there (up to the last two hours, which the app sends once at check in), whether the app was open or in the background, and the result, such as a win or a recorded purchase
• A cashier code a business enters, or a receipt photo you choose to take, to record a purchase (Section 3.5)
• The referral code you share or enter, and whether a referral qualified for a reward
• Your answers to a WilDi survey or vote you choose to take part in, and any one-time reward you received

Information collected automatically:

• Device and other identifiers, including the push notification token assigned to your device (the Firebase Cloud Messaging registration token), Firebase installation identifiers, and Mapbox device and session identifiers. We use these to deliver ad notifications to your device, credit earnings to the correct account, generate crash and diagnostic reports, and detect fraud. We do not collect the Android Advertising ID or the Apple Identifier for Advertisers (IDFA), and we do not use device identifiers for cross-app tracking or for third-party advertising networks.
• OS version and app version
• IP address
• Diagnostic logs and crash reports, collected through Google Firebase Crashlytics, which may include device state and the identifiers listed above
• Precise location data, including background location. Background location (location collected while the app is not visible on screen) is collected only while you are logged in and have chosen to actively participate in ad delivery through the WilDi Maps member app. It is required to detect ad delivery area entry/exit, verify CPVD (Cost Per Verified Delivery) events, calculate earnings, and prevent fraud. Collection stops when you log out, turn off location for the app in your device settings, or uninstall the app. See Section 6 for full details.
• Motion/route information used exclusively to:
  • Detect ad delivery area entry and exit
  • Verify ad delivery events
  • Prevent fraud and falsified movement

WilDi Maps does not collect contacts, messages, or unrelated device data. It collects a photo only when you choose to take a receipt photo in the app (Section 3.5).

3.2 Advertiser Information

• Name, business name, and contact details
• Email and account credentials
• Your confirmation that you are 18 or older, with the time and the version of the wording, recorded on your account
• Campaign configuration (areas, streets, messaging)
• Uploaded ad content

CRM Enrichment Data (Advertisers)

WilDi Maps may enhance advertiser account records using information that is publicly available (such as business websites, social media pages, public business listings, or government-registered business data). This enrichment is used solely for:

• Verifying business legitimacy
• Improving advertiser qualification and fraud prevention
• Enhancing sales and onboarding efficiency

We do not purchase third-party marketing lists, and we do not combine advertiser data with non-public third-party datasets.

Billing Information (Advertisers)

WilDi Maps does not collect or store full credit card numbers, bank account details, or other sensitive billing credentials. All billing information is transmitted directly to Stripe and processed under Stripe's own Privacy Policy. WilDi only receives limited non-sensitive billing metadata (such as subscription status and payment success/failure notifications).

• Usage logs and dashboard interactions

3.3 Automatically Collected Technical Data (All Users)

• Browser type (for portal users)
• IP address and region
• Session logs
• Cookies and analytics data

3.4 WilDi Golf and Events Information

From organizers:

• Account and contact details for the course, club, or organizer
• Event setup: holes, sponsors, event dates, and event status
• Roster names and email addresses the organizer uploads for check in
• Messages the organizer sends to golfers in an event
• Billing records for event fees and ongoing golf subscriptions (plan, payment and renewal status, invoices). Payments are processed by Stripe; we never see the card number

From sponsors:

• Business name, offer text, and any images that make up the sponsor card
• Contact details where a sponsor works with us or with the organizer directly
• Where a sponsor holds a sponsor account, its sign-in details and, only if it separately agrees, its consent to hear from WilDi about WilDi Maps

From golfers and attendees, through the app:

• When you sign up: the name you type, your email address, your ZIP code, and the time and version of the notices you accepted
• Your confirmation that you are 18 or older, with the time and the version of the wording, recorded on your account and copied onto each event you join
• The event a phone joined, and how it joined: event code, QR code, or a join prompt accepted inside the venue; and when it left
• The roster name a golfer selects at check in, where the golfer chooses to check in
• The phone's position while the app runs, as Section 6.4 describes, including each stay inside the venue or on a hole, booth, or zone, and each arrival at an event sponsor's address within the period in Section 6.4
• Cards delivered, opened, and tapped, with the hole or zone where each was delivered
• Requests sent from a hole for the refreshment cart or for assistance, and any note typed in one
• Hole by hole scores you choose to keep in the scorekeeper at a standing golf venue
• A receipt photo you choose to take for an event's receipt reward (Section 3.5), and whether the organizer approved it
• When the welcome offer launches: which WilDi Maps welcome offer and amount you were shown when you left a venue
• When Remind me launches: whether you opted in on a sponsor's card, when, and the wording you agreed to
• Device and app identifiers, including the push notification token used to deliver cards and course messages, the app version, and the operating system

Golf and Events records (events, venues, rosters, sponsors, stays, arrivals, requests) are kept in a dedicated golf schema, separate from WilDi Maps advertiser data. App accounts and the account-level location data in Section 6.4 are kept in the same account store the WilDi app uses. The app has no claims, no payouts, and no Stripe account at a venue, so it collects no payment or payout information from golfers or attendees for time at a venue. A golfer or attendee who sets up WilDi Maps payouts with Stripe, for example to receive the welcome reward when it launches, is handled as any member under Section 3.1.

3.5 Receipt Photos

The app collects a receipt photo only when you choose to take one: to record a purchase after checking in at a location pool, or for an event's receipt reward. We store the photo in private storage, linked to that check in or event, and check whether the same image was submitted before so a receipt cannot be reused.

• Who sees it. For a location pool, the business where you checked in, and WilDi staff. For an event receipt reward, that event's organizer, and WilDi staff. They view it through a short lived private link and never receive your email address or phone number with it.
• What it is used for. Recording and reviewing the purchase, deciding an event receipt reward, and preventing reuse and fraud. We do not use receipt photos for advertising and do not sell them.
• How long we keep it. A location pool receipt photo is deleted automatically 90 days after it is taken. An event receipt photo is kept with the event data and deleted when the organizer deletes the event or closes the account (Section 10).

4. Legal Basis for Processing (EEA, UK, etc.)

• Contract: Required to provide app functionality and advertiser services.
• Legitimate Interests: Security, fraud prevention, service improvement, analytics.
• Consent: For marketing communications and any optional features requiring opt-in, such as receipt photos and, when it launches, Remind me.
• Legal Obligations: Tax requirements, accounting, compliance.

5. How We Use Your Information

5.1 Member Data is used to:

• Deliver geo-triggered campaigns
• Verify CPVD (Cost Per Verified Delivery) events
• Calculate earnings and route-based payouts
• Run location pools, referral rewards and one-time rewards, and record purchases you choose to prove
• Detect falsified or simulated movement
• Prevent bot activity, spoofing, or mapping exploits
• Improve member experience and app performance

5.2 Advertiser Data is used to:

• Provide access to the advertiser portal
• Process payments, including Auto-Refill and event fees, via Stripe
• Configure, optimize, and deliver campaigns
• Provide analytics dashboards
• Communicate account notices and service updates

5.3 Aggregated Analytics

We generate aggregated, anonymized insights such as:

• Total verified deliveries
• Area/street performance summaries
• Attribution events (e.g., a recipient later visiting a business)

Advertisers never receive:

• Individual member identity
• Individual location trails
• Per-member attribution data

All analytics provided to advertisers are strictly aggregated.

5.4 WilDi Golf and Events Data is used to:

• Run the event the organizer set up, including holes, sponsors, and event status
• Place a phone on a hole or zone while it is inside the venue boundary, so the right sponsor card is delivered
• Record arrivals at an event sponsor's address, only for the period in Section 6.4, so the sponsor and organizer can see how many phones from the event came through the door
• Support optional check in against the roster the organizer uploaded
• Route refreshment cart and assistance requests to the organizer
• Keep the scorecard you choose to keep, and show the course its rounds report
• Let the organizer review receipt photos for its event's receipt rewards
• Deliver course condition messages the organizer sends
• Produce reports for organizers and sponsors that are counts of phones and counts of taps
• Detect abuse and keep the service working

Golf and Events data is not used to calculate earnings, because golfers and attendees are not paid for being at a venue, and it is not used for WilDi Maps advertising. One exception, when the welcome offer launches: when you leave a venue, we use where your phone is at that moment to check whether WilDi Maps businesses are active nearby, so the WilDi Maps welcome offer we show you is the right one. We keep which offer and amount you were shown, not that location.

When Remind me launches, it is a second exception, and only for a person who taps Remind me on a sponsor's card: we use that phone's position after the event, for 30 days from the opt-in, to deliver that sponsor's offer when the phone is near one of its locations. You can turn it off sooner at any time in the app, and it stops when you turn off location or uninstall the app. The sponsor sees only how many reminders were delivered.

6. Location Data

WilDi Maps collects precise location data from members (including background location) to operate the core ad-delivery and earnings features of the platform. This section explains what we collect, when, why, and how you can control it.

6.1 Foreground Location

While the WilDi Maps member app is open and visible on your screen, we collect your precise location to display your position on the map, detect entry into ad delivery areas, validate ad delivery events, and calculate earnings.

6.2 Background Location

WilDi Maps collects background location data (that is, your precise location while the app is not visible on your screen) when you are logged in and have voluntarily chosen to participate in ad delivery through the member app. Background location is required because the core function of the member app (delivering geo-triggered ads as you move) cannot work if location is only available when the screen is open.

We use background location to:

• Detect when you enter or exit an ad delivery area
• Verify CPVD (Cost Per Verified Delivery) events
• Calculate your earnings accurately
• Check you in at a location pool and confirm you stayed for the time required
• Detect and prevent fraudulent or simulated movement
• Generate aggregated, anonymized campaign metrics

Background location collection stops when:

• You log out of the member app
• You revoke background location permission via your device settings
• The app is uninstalled

You can disable background location access at any time through your device's location settings (iOS or Android). However, disabling background location will prevent you from earning while the app is not in the foreground, and may prevent you from earning at all.

6.3 Limits on Use

We do not:

• Provide advertisers with user-level GPS tracks
• Sell or broker personal location data
• Use member movement for third-party advertising networks
• Collect location data after you log out
• Use location data for any purpose other than those listed in Sections 6.1 and 6.2

Use of the member app is voluntary and subject to the Member Terms (Part B of our Terms of Service), which include important provisions on lawful operation, distracted-driving safety, and the non-employment nature of member participation.

6.4 WilDi Golf and Events App

This part describes the location mechanism for WilDi Golf and WilDi Events as it is built. Sections 6.1 to 6.3 describe WilDi Maps members.

1. The app asks for permission to read the phone's location, including in the background. You can say no, or allow it only while the app is open.
2. While the app runs, the phone sends its position to our servers, wherever the phone is. That is about every 30 seconds in normal use, sooner when the phone is moving, and more often near the venue of an event you joined. In the background, the operating system decides how often. Each report carries latitude, longitude, accuracy, speed, and time.
3. We compare each position with the boundaries and sponsor addresses of the events you have joined. Inside the venue, we record when the phone enters and leaves the venue and each hole, booth, or zone, so the right sponsor card is delivered and a cart or assistance request carries the right place. When a card is delivered, we record where. Outside the venues and sponsor addresses of your events, we record nothing for an event about where the phone was.
4. Arrivals at a sponsor's address. Each sponsor's street address is converted once to a small map cell. If a phone that belongs to the event is later observed in that cell, we record an arrival for that sponsor: the time in, the time out, and how long it stayed. We record the fact and the time, not a path to get there.
5. The window. A dated event stops delivering cards and stops placing the phone at the venue at its end date and time. After that, the app records only whether the phone arrives at a sponsor's address, for 30 days after the event end date, and then stops. A standing venue, such as an ongoing golf course, has no end date: the phone is placed on a hole or zone whenever it is inside the boundary, and arrivals at a sponsor's address are recorded for 30 days after the phone was last at the venue. Each return visit to the venue restarts the 30-day window.
6. What we keep on your account. We keep the phone's most recent position, which the next report replaces, a short rolling list of its last 30 reported positions, which we use to check that reported positions are genuine and each new report pushes the oldest out of, and one distance total per day. Beyond that short list, we do not build or keep a continuous trail of your positions.
7. It stops sooner for an event when you leave the event in the app, turn off location for the app, or uninstall it.

• No earnings are tied to a golfer's or attendee's location at a venue, because nobody is paid for being there. When the welcome offer launches, the offer shown on leaving depends only on whether WilDi Maps businesses are active near that point.
• When Remind me launches: only if you tap Remind me on a sponsor's card, your phone's position after the event is also compared with that sponsor's locations, so its offer reaches you when you are near one. This lasts 30 days from when you opt in, and stops sooner if you turn it off in the app, turn off location, or uninstall the app.
• Sponsors never receive a golfer's location, identity, or trail. Sponsors receive counts and taps.
• We do not sell location data. Nothing the app reads for an event is used for WilDi Maps advertising.
• An attendee who separately joins WilDi Maps as a member is governed by Sections 6.1 to 6.3 and the Member Terms for WilDi Maps.

A golfer or attendee can revoke location permission at any time in device settings. Doing so stops sponsor cards and hole based requests from working.

7. Cookies and Similar Technologies

We use cookies and similar identifiers on the public marketing site and the advertiser portal in four categories. Where you are decides the default. In the EEA, the UK and Switzerland, a banner asks you before any non-essential cookie is set. Everywhere else, including the United States, analytics and advertising cookies are on by default and you can turn them off at any time with the Cookie Settings button in the footer of every page. We read your location for this from your connection (country only), and we honor Global Privacy Control automatically.

7.1 Strictly necessary

Always active, required for core site function:

• wdm_consent: your cookie preference state (1-year max-age)
• sb-*: Supabase authentication session
• __stripe_*: Stripe checkout flow + fraud prevention
• Cloudflare Turnstile session cookies on lead-form pages

7.2 Analytics

_ga, _ga_*, _gid, _gat*: set by Google Analytics for aggregated traffic metrics. Default-on under our notify policy; off when you opt out via the banner or under Global Privacy Control.

7.3 Marketing & attribution

wdm_vid: our first-party visitor identifier (HttpOnly, SameSite=Lax, Secure, 1-year max-age) used solely to attribute your visit to the marketing source you arrived from. _gcl_au: Google Ads click attribution. Default-on under our notify policy; off when you opt out or under Global Privacy Control.

7.4 Customer Match (ad-platform sharing)

No client-side cookies in this category. Server-side flow: with your separate explicit opt-in (the "ad-platform matching" checkbox on lead forms, or the separate "share a hashed copy of my email with Google" toggle in Cookie Settings; "Accept all" never turns it on), we may share your hashed email address with Google Customer Match to enable personalized re-engagement. Always default-off; requires affirmative consent. You can withdraw consent at any time.

7.5 Universal opt-out signals

We honor the Global Privacy Control (GPC) browser signal automatically. If your browser advertises GPC (Brave, DuckDuckGo, Privacy Badger, Firefox with the preference enabled, etc.), we treat it as a binding opt-out of analytics and marketing cookies, with no manual interaction required. We display a visible confirmation that the signal has been honored.

7.6 wildigolf.com

wg_src: a first party cookie set on wildigolf.com that records which link brought the visitor to the site, with a 30 day lifetime. We also log a landing hit for the visit, containing city level IP geolocation, a hashed IP address, and the user agent string. These landing hits are stored in the same table as taps on wildimaps.com/app and are used to understand which links bring organizers to WilDi Golf.

Members (mobile app) do not receive third-party tracking for advertising purposes.

8. Subprocessors

We share personal information with the third-party service providers listed below, each of which has agreed to confidentiality and data protection terms via a Data Processing Agreement or equivalent contractual mechanism (Standard Contractual Clauses for international transfers, EU-US Data Privacy Framework participation where applicable).

• Vercel (US + global edge): hosts the Next.js application; processes server logs and request data
• Supabase (US-East-1): primary Postgres database; stores all persisted personal data; authentication identity
• Resend (US): transactional email (lead-form notifications + confirmations, support replies, privacy-request verification, deletion confirmations)
• Stripe (US + global): payment processing; checkout sessions; subscription management. We never see raw payment-card data; Stripe holds it under PCI DSS Level 1
• Cloudflare (global): Turnstile bot protection on lead forms; edge DNS
• Google (US + global): Google Ads (Click Conversion uploads; Customer Match only with consent); Google Analytics (Consent Mode v2, cookieless pings while denied; full hits after consent)
• Google Firebase (US + global): push notification delivery to the member app (Firebase Cloud Messaging) and crash and diagnostic reporting (Crashlytics). Processes the device push token and Firebase installation identifiers
• Mapbox (global): map tile rendering, geocoding, and navigation in the member app and inside the authenticated dashboard; not loaded on public marketing pages. Processes device and session identifiers
• MongoDB Atlas (US): ad asset storage in the dashboard; not in scope for the marketing site or lead pipeline
• DigitalOcean (US): our application servers, which run the member app's back end and process the data in Sections 3.1 and 3.4
• Apple Push Notification service (US + global): push delivery of offers and messages to iPhones running the WilDi app. Processes the device push token
• Anthropic (US): powers the AI assistants on our website and in the dashboard; processes the messages you type to an assistant
• OpenAI (US): creates search embeddings of our help content and of the questions you ask an assistant, so the assistant can find the right answer

All subprocessors operate under contractual confidentiality and data protection requirements. A current list with detailed DPA mechanisms is available on request at legal@wildimaps.com.

WilDi Golf and WilDi Events run on the same subprocessors: Supabase for authentication and the Postgres database, MongoDB for app accounts and the account-level location in Section 6.4, Google Firebase Cloud Messaging and the Apple Push Notification service for push delivery of sponsor cards and course messages, Mapbox for maps and for converting sponsor and venue addresses to coordinates, DigitalOcean for our application servers, Vercel for hosting, and Resend for email.

9. Information Sharing

We do not sell personal information for monetary or other valuable consideration.

We may share limited data with:

• Subprocessors (listed in Section 8)
• Legal authorities, when required by court order, subpoena, or other binding legal process
• Successors in a merger or acquisition, under equal or greater privacy commitments

Customer Match (separate explicit consent).

The only practice that may be classified as "sharing" under California law (CCPA) is the optional Customer Match flow: only with your affirmative opt-in via the lead-form checkbox or the separate, explicit Customer Match toggle in Cookie Settings (choosing "Accept all" on the cookie banner does not turn it on), we may share your hashed email address with Google so Google can match you to ad impressions and personalized retargeting. The upload of your hashed email happens only when you tick the lead-form checkbox; the separate Cookie Settings toggle only controls whether your browser gives Google the ad-matching consent signal. Both are always default-off, and you can opt out at any time via:

• The "Cookie Settings" button in the footer of every page
• The "Do Not Sell or Share My Personal Information" button in the footer of every page
• Sending a deletion request via /privacy/request
• Enabling Global Privacy Control in your browser

WilDi Golf and WilDi Events.

• Organizers see phone counts by hole, check ins, and the roster they uploaded.
• Sponsors see counts of phones and counts of taps only.
• Sponsors never receive golfer identities, contact details, or location trails.
• A count of phones is not a count of people.
• Sponsor perk (when it launches): when an organizer provides a perk toward a sponsor's WilDi Maps budget, the organizer sees whether the sponsor took it up, the amount the sponsor paid at that checkout and whether it was one time or monthly, when the sponsor's offer starts or whether it is live, and the WilDi credit it earns, which is based on the sponsor's WilDi Maps deposits in the sponsor's second through seventh months. The organizer does not see the sponsor's card details, balance, later spending line by line, or any member data. The organizer's saved card is held by our payment processor (Stripe), not by WilDi.

For rosters and organizer messages, the organizer decides what to collect and why, and we process them on its behalf; questions about why your name is on a roster go to the organizer. For everything the app collects from a golfer or attendee, we decide and we are responsible.

Aggregated, de-identified data may be shared without restriction.

10. Data Retention

• Marketing-site visitor tracking events: 90 days from event, then automatically hard-deleted by our retention cron
• Sales inquiries and lead forms: 7 years from creation, then automatically hard-deleted by our retention cron. Anonymized immediately on a verified deletion request: identifying fields (name, email, phone, message, IP, user-agent) are removed; the residual record is hard-deleted at the 7-year mark
• Privacy-request audit log: 7 years for accountability
• Member earnings & event logs: retained as long as required for accounting and fraud prevention (typically 24-36 months)
• Fraud review flags (for example, a location your phone reported as simulated) and the review alerts they raise: 24 months from when they are recorded, or longer while a review or dispute about them is open. They are kept as fraud prevention records when a member account is deleted
• Advertiser account & billing records: account life + 7 years
• Campaign analytics: 24 months by default
• Support communications: 3 years
• Job applications: 2 years from application
• WilDi Golf and Events event data (events, holes, sponsors, check ins, stays at the venue, arrivals at a sponsor's address, phone and tap counts): retained until the organizer deletes the event or closes the account. New arrivals at a sponsor's address are recorded only for the period in Section 6.4; records made in that period are kept with the rest of the event data
• Account-level location for the WilDi app: the most recent position and the last 30 reported positions, each replaced as new reports arrive, and one distance total per day, kept for the life of the account
• Location pool receipt photos: 90 days from when they are taken, then deleted automatically
• Event receipt photos and golf scores: kept with the WilDi Golf and Events event data above
• WilDi Golf roster names and emails: retained for the life of the organizer's account, and deleted when the organizer deletes the event or closes the account

De-identified, aggregated datasets may be retained indefinitely. Our retention enforcement runs as an automated daily process and is auditable in our records of processing.

11. Data Security

• Encryption of data in transit and at rest
• Strict access controls
• Fraud monitoring (bot/spoof detection)
• Routine security reviews and AI-assisted penetration testing of our code and systems

Users are responsible for protecting their login credentials.

12. International Data Transfers

Data may be processed in the United States and other regions where service providers operate. We use recognized safeguards, including Standard Contractual Clauses.

13. Your Rights

Depending on your jurisdiction, you may have rights to:

• Access your data (we provide a JSON export)
• Correct inaccurate data
• Request deletion (anonymization for active records; hard delete after the retention window)
• Restrict or object to processing
• Download a machine-readable copy (portability)
• Withdraw consent at any time
• Opt out of "sale" or "sharing" via the footer link or Global Privacy Control
• Lodge a complaint with your local data protection authority (EU/UK)

California residents have additional CCPA / CPRA rights, including the right to know what categories of data we collect, why, and with whom we share it; the right to limit use of sensitive personal information (for WilDi that is the precise location the member app collects, described in Section 6; we use it only to deliver and verify offers, attribute visits and pay members, and you can stop it at any time by turning off location for the app); and the right to non-discrimination for exercising any privacy right.

14. Exercising Your Rights

We provide a self-serve, identity-verified portal for access and deletion requests at /privacy/request.

How verification works. Submit your email address and choose an action (access or delete). We send a verification link to your inbox via an HMAC-signed token (24-hour expiry). Clicking the link confirms you control the address. No password or account required. Once verified, we carry out an access request and email you confirmation. Account deletion requests are verified immediately and completed within 30 days. This protects you from unauthorized requests in your name and protects us from acting on unverified requests.

For other privacy inquiries, email privacy@wildimaps.com. We respond to verified requests within 30 days. We may extend by up to 60 days for complex requests, and we'll notify you if we do. We do not charge a fee for the first request in any 12-month period.

To control cookies: use the "Cookie Settings" button in the footer of every page or enable Global Privacy Control in your browser (we honor it automatically).

To opt out of "sale" or "sharing" (CCPA): click the "Do Not Sell or Share My Personal Information" button in the footer of every page.

15. Children's Privacy

WilDi Maps, WilDi Golf, and WilDi Events are not intended for anyone under 18. This applies to golfers and event attendees as well as members, advertisers, organizers, and sponsors.

We do not knowingly collect information from anyone under 18. The app asks every golfer and attendee to confirm, once for their account and before joining their first event, that they are 18 or older. Accounts found to belong to anyone under 18 are deleted.

If you believe someone under 18 has provided information to WilDi, contact us immediately at privacy@wildimaps.com, and we will delete the data.

16. Policy Updates

Material changes will be announced via email or prominent notice. The "Last updated" date at the top of this page reflects the current revision.

17. Contact Us

WilDi Maps, Inc.
Jacksonville, Florida, USA
privacy@wildimaps.com