Privacy policy

HiO Booking Inc. (“HiO”, “we”), of Ontario, Canada, provides online booking, payments, memberships and door access to venues such as golf simulator lounges, studios, courts and rooms. This policy explains what personal information we handle, why, how long we keep it and who can see it. It is written for Canada first (PIPEDA and Quebec's Law 25).

Who is responsible for your information

When you book with a venue that uses HiO, the venue decides what it collects and how it uses it; we process that information on the venue's behalf, under our agreement with them. For our own sites (hiobooking.com) and for the people who run venues on HiO, we are responsible. Tenant data is separated by business: one venue can't see another venue's customers.

What we collect

Your profile

• Always: your name, email, mobile number (used to log in with a texted code) and whether you prefer email, texts or both.
• Only if the venue asks: birthdate, address, handedness, how you heard about the venue, gender (optional, with “Prefer not to say”) and marketing consent. Gender and marketing consent are never required, and gender is never used for prices.

Bookings, players and agreements

• Your bookings, the players you name (name, and optionally an email or mobile), and any add-ons.
• When you agree to a venue's waiver or terms: the exact wording, both links, the time, your IP address and device, and a copy of the linked pages. For a minor, the parent or guardian's name, relationship and contact details, and the player's date of birth (seen only by the venue's staff).

Payments, memberships and credits

• Card payments run through Square. We never see or store your full card number: only Square's card reference, the brand, the last four digits and the expiry.
• For a membership billed by HiO, your recurring-charge consent exactly as shown, with the amount, period, time, IP address and device.
• Credits, prepaid cards and packages are kept as ledger entries with amounts and reasons.

Rewards programs

• If a venue runs a rewards program: your points history, reward claims, redemptions and raffle entries.
• When you claim a reward with a screenshot (for example a follow or a review), the screenshot is checked by an AI provider. Only the image and the type of claim are sent, never your name, email or phone number. The image is deleted after the venue's retention period (90 days unless the venue sets another); the decision on the claim is kept.
• If you win a raffle, your first name and last initial may be shown as a winner.

The venue's app and notifications

• If you use a venue's app, it registers your device so we can send you notifications: a device identifier the app creates, the app's version, the platform (iOS, Android or web) and the push token the phone gives the app. The push token is kept only for sending (it is never shown to staff or written in logs) and is passed to Expo, which delivers app notifications. A token another member of the same venue later uses on that device moves to them.
• Your notification settings: which kinds of program messages (points, tier, expiry) and promotional notices you want, and when you changed them.
• Your marketing consent records: each time you agree to or withdraw promotional notifications, emails or texts, we keep the exact wording you saw, its version, the time, how you did it (sign-up, settings or an unsubscribe link) and, from the app, its version and the device identifier. These records are never edited.

Email verification codes

We may email you a 6-digit code to confirm that an email address is yours: when you create an account, after you change your email, and before you claim points from a venue's earlier rewards program. Only a scrambled form of the code is stored; it expires after 10 minutes and works once. We use the code only to confirm the address.

Visitor and device logging

The activity log

Every change and every refused attempt in the app is recorded: who acted, what they did, what changed, and a request reference. With each entry we keep the IP address (from our hosting provider), an approximate city, region and country, and the device type, operating system, browser and phone model as your browser reports them. Login attempts store only the last four digits of the phone number. We use this for security, to resolve disputes and for support. Full IP addresses are shortened after 12 months. Venue staff see their own location's log; customers don't see it; nobody, including HiO, can edit or delete an entry.

Anonymous page visits

For visits to booking pages and this site we record the page, the business it belongs to, a shortened IP address, the device type, operating system, browser and the referring site's domain. No cookies or identifiers are used, nothing links visits together or to you, and visits are deleted after 30 days.

Cookies and tracking

We use only the cookies the service needs (keeping you logged in, and the preview password on this site before launch). A venue may add Meta, Google Analytics or Google Ads tags to its booking pages; they load only after you accept the cookie banner, and they receive page views, checkout started and booking completed with the value and currency only, never your name, email or phone. The address of a booking's confirmation page contains that booking's reference number, so a page view of that page tells the tag provider the reference number too.

Messages

Venues send booking and payment messages (confirmations, reminders, receipts, membership notices) by your chosen channel. These are transactional. We keep a copy of each message as sent, with its delivery status, as the venue's record. Replying STOP to a text, or marking an email as spam, stops further messages there; reply HELP to a text for help. Email goes through Resend and texts through Twilio.

We don't share or sell your mobile number or your consent to receive texts with third parties or affiliates for their marketing. Twilio receives your number only to deliver our texts.

Promotional notices

A venue's app may show promotional notices in the app and as push notifications. You agree to these when you sign up, and you can turn them off at any time in your notification settings. Turning them off only removes the notification bonus on points; you still earn points and can still use rewards. Promotional emails and texts are different: they are sent only if you give a separate opt-in for them, which is never bundled with this policy, as Canada's anti-spam law requires. Every promotional email or text names the venue and its address and has a one-step unsubscribe link that works without signing in; your notification settings also turn each one off. Unsubscribing takes effect at once and stops promotional messages already waiting to be sent. Program messages about your points, tier and expiry can be turned off in the same settings; booking messages follow the venue's booking rules.

Who we share it with

• The venue you book with, and its staff.
• Service providers that run parts of HiO for us: Square (payments), Resend (email), Twilio (texts), Expo (app notifications), Anthropic (the AI model behind the venue staff's Assistant, which sees your booking or profile details when staff ask it about them, and the check of reward screenshots, which sees only the image and the claim type), Supabase (database) and Vercel (hosting). They may process information outside your province or Canada, under contracts that protect it.
• Integrations a venue switches on (for example its CRM), which get only what the venue sends them.
• When the law requires it.

We don't sell personal information.

Support access

To fix a problem, HiO's platform administrator can open a time-limited support session into a venue's account. Sessions start read-only, changes need a second confirmation, and every action is recorded in an internal support log. Outside a support session, HiO cannot browse a venue's customer data.

How long we keep it

• Bookings, payments, agreements, membership consents, the credit ledger, messages and the activity log are the venue's records and are kept for the life of its account.
• Page visits are deleted after 30 days; full IP addresses in the activity log are shortened after 12 months.
• Rewards: points history, claims, redemptions and raffle entries are kept while your account is active and as required by law. Reward screenshots are deleted after the venue's retention period (90 days unless the venue sets another); the claim decision is kept. Email verification codes expire after 10 minutes.
• Marketing consent records are kept indefinitely, also after you withdraw, as proof of what you agreed to and when. A device's push token is removed when you sign out of the app, when the device stops accepting notifications or when another member takes it over; the device record without the token stays with the messages sent to it.

Deleting your information and your rights

You can ask a venue to see, correct or delete your information, from “Your account › Delete my account” or by contacting them. Requests are answered within 30 days. Deleting erases your name, contact details, profile fields, notes, tags and the wording of stored messages, removes saved cards and unlinks your login. Some records are kept because the law or a dispute may need them: payments, refunds, the credit ledger, memberships and their consents, agreements (as signed) and bookings, shown as “Deleted customer”. Your earlier activity log entries are redacted, not deleted. If two profiles of yours are merged, nothing is lost and nothing personal stays on the merged-away profile.

Security

Access is limited by role and enforced in the database for every business separately. Payment tokens are kept in an encrypted vault, never in tables. Logins use one-time codes, and staff accounts can use a second factor.

Changes and contact

We'll update this page when what we collect changes, and note the date and version above. Version 2 (October 7, 2026) added rewards programs, reward screenshot checks, email verification codes and promotional notices. Version 2.1 (October 8, 2026) added that a raffle winner's first name and last initial may be shown. Version 3 (October 8, 2026) added the venue's app and notifications (the device identifier, app version, push token and Expo), notification settings, marketing consent records and how long they are kept, and the one-step unsubscribe. Questions or requests about HiO's own handling of information: HiO Booking Inc., Ontario, Canada, hello@hiobooking.com. For a venue's records, contact the venue first.