RandomTeeBox California Privacy Notice

Effective Date: October 1, 2026 · Last Updated: October 1, 2026

This California Privacy Notice ("Notice") is provided by BNN INNOVATIONS, LLC, an Arizona limited liability company doing business as RandomTeeBox, together with its subsidiaries and affiliates ("RandomTeeBox," "we," "us"). It applies only to California residents ("you") and supplements the RandomTeeBox Privacy Policy. It is our privacy policy and notice at collection under the California Consumer Privacy Act as amended by the California Privacy Rights Act and its regulations (Cal. Code Regs. tit. 11, § 7000 et seq.) (together, "CCPA"). It also covers the California Online Privacy Protection Act (Bus. & Prof. Code §§ 22575–22579), the "Shine the Light" law (Civ. Code § 1798.83), the Privacy Rights for California Minors in the Digital World law (Bus. & Prof. Code §§ 22580–22582), and the California Invasion of Privacy Act (Pen. Code § 630 et seq.). Words defined in the CCPA have the same meaning here. If this Notice conflicts with the Privacy Policy for a California resident, this Notice controls.

At a glance:

We may sell certain personal information of account holders, and share it for cross-context behavioral advertising. You may opt out at any time (Section 9).
We never sell or share sensitive personal information, information about visitors who do not have an account, or information about anyone we know is under 18.
We honor Global Privacy Control signals.
We offer no financial incentives in exchange for your personal information.

1. Notice at Collection: Categories We Collect

In the preceding 12 months we collected the categories of personal information below, and we will continue to do so. We present this Notice at or before the point of collection: it is linked on our account sign-up page and in the footer of every page.

CCPA category	Collected?	RandomTeeBox examples	Retention
A. Identifiers	Yes	Username, real name (optional), email address, IP address, account ID, cookie and device IDs	Account identifiers: life of account + 30 days. IP address and device IDs: 13 months
B. Personal records (Civ. Code § 1798.80(e))	Yes	Name, email address	Life of account + 30 days
C. Characteristics of protected classifications	Yes	Date of birth or age	Life of account + 30 days
D. Commercial information	No	We process no purchases; bookings happen on third-party sites	Not applicable
E. Biometric information	No	None	Not applicable
F. Internet or other electronic network activity	Yes	Courses generated, filters chosen, re-spins, pages viewed, outbound clicks to course and booking sites, ad interactions, crash logs	13 months
G. Geolocation data	Yes	Approximate region from IP address; precise device location only if you switch it on	Approximate: 13 months. Precise: used for the search and not stored
H. Audio, electronic, visual, or similar information	Yes	Profile photos and images you post	Until you delete them, or life of account + 30 days
I. Professional or employment information	No	None	Not applicable
J. Non-public education information	No	None	Not applicable
K. Inferences	Yes	Skill level, handicap, course-type preferences, and interests drawn from your activity	Life of account + 30 days
L. Sensitive personal information	Yes	Account login and password (stored hashed); precise geolocation; contents of messages you send to other golfers	Login: life of account + 30 days. Precise location: not stored. Messages: life of account + 30 days

CCPA category	Disclosed for a business purpose to	Sold to or shared with
A. Identifiers	Our affiliates; service providers and contractors (hosting, database, email, analytics, security, support, moderation)	Advertising networks, marketing partners, analytics providers, data partners (account holders only; never passwords)
B. Personal records	Our affiliates; hosting and email providers	Marketing partners, data partners (account holders only)
C. Protected classifications	Hosting provider	Advertising networks, data partners (age range only, never date of birth)
F. Internet or network activity	Hosting and analytics providers	Advertising networks, analytics providers, data partners, golf industry partners (account holders only)
G. Geolocation data	Hosting and mapping providers	Approximate location only: advertising networks, data partners. Precise location: never
H. Visual information	Hosting and moderation providers; other users according to your settings	Not sold or shared
K. Inferences	Hosting provider	Advertising networks, marketing partners, data partners, golf industry partners (account holders only)
L. Sensitive personal information	Hosting, security, and moderation providers	Not sold or shared

We may also disclose any category to government authorities or others when required by law or needed to protect anyone's safety; to a buyer or successor in a merger, acquisition, or sale of assets; and to anyone you direct us to.

12-month statement. As of the Effective Date, RandomTeeBox has not yet sold or shared personal information. The table above shows the categories we may sell or share going forward, and we will update this statement within 12 months.

3. Sources

We collect personal information directly from you (when you register, build a profile, post, message, or contact us); automatically from your browser or device (through cookies, pixels, and similar tools); and from social platforms you choose to link to your account.

4. Business and Commercial Purposes

We collect, use, and disclose personal information to:

provide the Service, including accounts, the course randomizer, profiles, and social features;
verify eligibility, including that account holders are 18 or older;
help ensure security and integrity, and detect and act on fraud, abuse, harassment, threats, and illegal activity;
debug and repair errors;
perform short-term, transient uses, such as showing content during your current visit;
perform services on our behalf through service providers, including hosting, analytics, email, support, and moderation;
maintain, improve, and develop the Service;
advertise and market RandomTeeBox and third-party products, including cross-context behavioral advertising;
sell personal information to third parties as described in Section 5 (our commercial purpose); and
comply with law, respond to legal process, and establish, exercise, or defend legal claims.

Who we sell to or share with: advertising networks, marketing partners, analytics providers, data partners, and golf industry partners, as shown in Section 2.
Whose data: only account holders, who must be 18 or older.
What we never sell or share: sensitive personal information; information about visitors who browse without an account; and information about anyone we know is under 18.
Contracts: every third party that buys or receives personal information from us must agree in writing to use it only for the limited purposes we specify, to comply with the CCPA and give the same level of privacy protection, to let us take reasonable steps to stop unauthorized use, and to tell us if it can no longer comply.
Consumers under 16: we have no actual knowledge of selling or sharing the personal information of any consumer under 16, and we would not do so without the affirmative opt-in consent the CCPA requires.

6. Sensitive Personal Information

We collect the sensitive personal information listed in category L only to provide the Service you request, to secure accounts, and to keep users safe. We use and disclose it only for the purposes permitted by Cal. Code Regs. tit. 11, § 7027(m). We do not use it to infer characteristics about you, and we do not sell or share it. For that reason the right to limit the use of sensitive personal information does not apply, but you may switch off precise location at any time in your device or browser settings.

Reserved account identifiers. Unique numeric account IDs and used email addresses remain reserved permanently after account deletion to prevent reuse. The deletion timestamp and reason are retained separately from the deleted golfer profile. Returning users must use a different email address. Contact inquiries are retained for staff review and response.

Retention criteria. We keep each category for the period shown in Section 1, and no longer than reasonably necessary for the purposes in Section 4. Records of safety reports, bans, and Terms violations are kept as long as needed to keep banned users off the Service and protect others. Backups are overwritten within 90 days. We keep information longer only when the law requires it or a legal claim is pending.

7. Your California Privacy Rights

Right	What it lets you do
Right to know and access	Learn the categories of personal information we collected about you, its sources, our purposes, the categories of third parties we disclosed it to, and the categories we sold or shared and to whom; and get the specific pieces we hold. Requests cover the preceding 12 months; on request we will go back to January 1, 2022, unless that proves impossible or would involve disproportionate effort.
Right to delete	Have us delete personal information we collected from you, subject to CCPA exceptions such as completing a transaction you requested, security and fraud prevention, debugging, complying with law, and Terms enforcement. We will also tell our service providers, contractors, and third parties to delete it.
Right to correct	Have us correct inaccurate personal information, considering its nature and purpose. We may ask for documentation supporting the correction.
Right to opt out of sale and sharing	Direct us to stop selling your personal information and sharing it for cross-context behavioral advertising (Section 9).
Right to limit use of sensitive personal information	Not applicable, because we use sensitive personal information only for permitted purposes (Section 6).
Right to non-discrimination and no retaliation	Exercise any of these rights without being denied the Service, charged a different price, or given a different quality of service (Section 11).

8. How to Submit a Request

Methods. Email hello@randomteebox.com with the subject "California Privacy Request," or use the request form on our Your Privacy Choices page. Because RandomTeeBox operates only online and has a direct relationship with its users, email is our designated method; no toll-free number is required. Requests are free.

Verification. We verify your identity before acting on requests to know, delete, or correct, matching what you give us against what we hold:

Account holders: we confirm the request through your logged-in account or account email.
Requests for categories of information: we match at least two pieces of personal information you provide (reasonable degree of certainty).
Requests for specific pieces of information, or deletion of sensitive information: we match at least three pieces and require a signed declaration under penalty of perjury that you are the person whose information is requested (reasonably high degree of certainty).

We never ask you to create an account to make a request. Information you provide for verification is used only for verification and deleted afterward.

Timing. We confirm receipt within 10 business days and explain how we will process the request. We respond within 45 calendar days, and may extend once by another 45 days with notice and an explanation.

Limits and denials. We need not respond to more than two requests to know from the same consumer in a 12-month period, and may refuse or charge a reasonable fee for requests that are manifestly unfounded or excessive. If we deny a request in whole or part, we will explain why. You may ask us to reconsider by replying with "Appeal."

Records. We keep records of consumer requests and our responses for at least 24 months.

Methods: click "Do Not Sell or Share My Personal Information" in the footer of any page or in account settings; turn on Global Privacy Control (GPC) in your browser; or email hello@randomteebox.com with the subject "Do Not Sell or Share."
No verification needed. You do not need an account or to prove your identity to opt out. We may ask only for what we need to apply the opt-out.
Global Privacy Control. We treat a GPC signal as a valid request to opt out of sale and sharing for that browser or device and, if you are logged in, for your account. If you later visit while logged in without the signal, we will not treat you as having opted back in.
Confirmation. Our Your Privacy Choices page shows the status of your opt-out, including "Opt-Out Request Honored" when we have processed a GPC signal.
Timing. We stop selling and sharing within 15 business days and tell any third party that received your information between your request and our compliance to stop selling or sharing it.
Opting back in. We will wait at least 12 months before asking you to opt back in. Opting back in requires a two-step confirmation.

10. Authorized Agents

An authorized agent may submit a request for you with your signed written permission. We may require the agent to provide proof of that permission and may ask you to verify your identity directly with us and confirm the agent's authority. These steps do not apply if the agent holds a valid power of attorney under Cal. Probate Code §§ 4121–4130. Agents may use information about you only to fulfill your request.

11. Non-Discrimination and No Financial Incentives

We will not discriminate or retaliate against you for exercising any CCPA right, including by denying the Service, charging a different price, or providing a different level of quality. RandomTeeBox offers no financial incentive, discount, or price or service difference in exchange for personal information. If that changes, we will provide a notice of financial incentive and obtain your opt-in consent first.

12. Minors

Accounts are limited to adults 18 and older. Visitors 13–17 may use only account-free features, and we do not sell or share their information.
We would not sell or share the personal information of a consumer aged 13 to 15 without that consumer's affirmative opt-in, or of a child under 13 without a parent's or guardian's opt-in.
We do not knowingly collect information from children under 13 and will delete it if we learn of it.
Content removal (Bus. & Prof. Code § 22581): a California resident under 18 who posted content on the Service may ask us to remove it by emailing hello@randomteebox.com. Removal may not ensure complete erasure if others copied or reposted it.

13. Recording, Monitoring, and Wiretapping Disclosure (CIPA)

What is recorded: messages between golfers, posts, comments, support chats, and reports are received, recorded, and stored by RandomTeeBox and by service providers acting on our behalf, and may be reviewed by automated tools or staff for safety, security, and Terms enforcement.
Website tools: analytics, session-recording, and advertising tools, including third-party pixels, collect information about how you use our pages (clicks, scrolling, page views, and device identifiers). Session tools mask password and free-text fields.
Consent first: no non-essential tool loads, and no information is sent to any advertising or analytics partner, until you click "Accept" in our cookie banner. Closing the banner without choosing counts as declining.
Your consent: by accepting our Terms and Conditions, you consent to the recording of communications sent through the Service. By clicking "Accept" in the cookie banner, you consent to the website tools above. Both consents are given for purposes of Cal. Penal Code §§ 631, 632, 637.2, and 638.51 and the federal Electronic Communications Privacy Act.
Withdrawal: you may withdraw cookie consent at any time on the Your Privacy Choices page. Withdrawal does not affect collection that occurred lawfully before it.
Do not send anything through the Service that you expect to remain confidential from RandomTeeBox.

14. Shine the Light (Civ. Code § 1798.83)

RandomTeeBox may disclose personal information to third parties for their own direct marketing purposes. Once per calendar year, you may request the categories of personal information we disclosed for that purpose in the preceding calendar year and the names and addresses of the recipients, by emailing hello@randomteebox.com with the subject "Shine the Light Request" or writing to the address in Section 20. We respond within 30 days. You may stop these disclosures at any time through the Do Not Sell or Share link.

15. CalOPPA Disclosures

Do Not Track and GPC: we respond to Do Not Track and GPC signals by treating them as an opt-out of sale, sharing, and non-essential tracking.
Third-party tracking: third-party advertising and analytics partners may collect personally identifiable information about your online activities over time and across different websites when you use RandomTeeBox, but only after you consent and only until you opt out.
Reviewing and changing your information: you can review and update your account and profile information at any time in account settings, or by emailing hello@randomteebox.com.

16. De-identified Information

When we de-identify information, we maintain it in de-identified form, do not attempt to re-identify it except to test our de-identification methods, and require recipients by contract not to re-identify it.

17. Automated Decision-Making

RandomTeeBox does not use automated decision-making technology to make significant decisions about consumers, such as decisions about financial services, housing, education, employment, or healthcare. Random course selection and content personalization are not significant decisions.

18. Accessibility

This Notice is designed to be readable by people with disabilities. To request it in an alternative format, email hello@randomteebox.com or write to the address in Section 20.

19. Changes to This Notice

We review this Notice at least once every 12 months. We will post any update here with a new "Last Updated" date and notify account holders of material changes by email or in-app notice before they take effect.

20. Contact

BNN INNOVATIONS, LLC d/b/a RandomTeeBox · Attn: California Privacy · 9375 E Shea Blvd, Suite 100, Scottsdale, AZ 85260 · hello@randomteebox.com