Privacy Policy

Effective Date: 2026-09-11 Document version: 2.1.0

This Privacy Policy explains how SSA MEDIA LLC ("we", "us", "our"), the company that operates SplashPad (the "Service"), collects, uses, and protects information when you use https://splashpad.pro or any of our coach landing pages, parent portals, or instructor tools.

If you have any questions about this policy you can reach us at:

SSA MEDIA LLC
616 Claremore Dr, West Palm Beach, FL 33401
Email: support@splashpad.pro

1. Who this policy applies to

The Service is used by three groups of people, and this policy covers all of them:

Swim instructors / coaches who subscribe to SplashPad to manage their swim-lessons business.
Parents and guardians who apply to or enroll their children with a coach who uses SplashPad.
Visitors who simply browse a coach's public page or our marketing site.

We never knowingly collect personal information directly from children under 13. When a parent or legal guardian enters information about their child (such as the child's first name, date of birth, swim level, or medical notes) they are doing so on behalf of the child as the consenting parent/guardian.

2. Information we collect

2a. Information you give us directly

Account information — name, email address, password (stored as a one-way hash, never in plain text), role (instructor/parent), phone number.
Instructor business information — display name, biography, location, service area, certifications, profile photo, logo, pricing packages, social-media links, waiver text, scheduling links.
Parent/guardian information — name, email, phone, mailing address, emergency contact name and phone.
Student information (provided by the parent/guardian) — first and last name, date of birth, swim level, and any medical notes the parent chooses to share with the coach.
Sensitive information. Medical notes, allergy information, and similar health details you choose to share are provided for one purpose only: so your coach can plan safe lessons. We show that information only to the coach(es) you enroll with, never use it for advertising or profiling, and delete it on request (see Section 7).
Waiver and consent records — digital signature, timestamp, IP address, and the policy text in effect at the time you signed.
Payment records — the last four digits and brand of a saved card, and records of payments, credits, and refunds (see 2b).
Communications — messages you send through the Service (e.g. support tickets, broadcast emails authored by the coach).

2b. Payment information

We do not store full credit-card numbers. Payments are processed by our PCI-compliant payment processor (Stripe, Inc.). Stripe receives the card details directly from your browser via Stripe Elements and returns a non-sensitive token to us. We retain only the last four digits, card brand, and expiration date for display purposes.

2c. Information collected automatically

When you use the Service we may automatically collect:

IP address, user-agent string, device type, browser type
Pages viewed, features used, approximate location derived from IP
Cookies and similar technologies, including those set by Stripe.js to protect against fraud, and — on our public marketing site only — a first-party ad-attribution cookie (__oppref) that is set when you arrive from an ad in ChatGPT (see "Advertising measurement" in Section 4)
Email delivery telemetry (open/bounce status) from our email provider

3. How we use information

We use information to:

Operate, maintain, and improve the Service
Create and manage your account
Process subscription payments and apply promotional discounts
Send transactional emails (signup confirmations, password resets, application/approval notifications, waiver receipts, billing receipts)
Allow coaches to communicate with their own approved parents ("Broadcast" feature) — we do not send marketing to parents on a coach's behalf without that coach initiating it
Provide customer support
Detect, prevent, and respond to fraud, abuse, security incidents, or violations of our Terms
Comply with legal obligations

4. How we share information

We do not sell personal information. We do not run targeted advertising inside the Service — the coach portal, the parent portal, and coaches' booking pages — and we do not use advertising cookies there. The only advertising-related processing we do is the ad measurement on our public marketing site described below; to the extent that counts as "sharing" for cross-context behavioral advertising under California law, you can opt out as explained there. To record a "Do Not Sell or Share" preference or exercise any other privacy right, use the Your Privacy Choices form at https://splashpad.pro/privacy/delete-my-data or email support@splashpad.pro.

Advertising measurement (marketing site only). We advertise SplashPad to swim coaches in ChatGPT. To know whether those ads work, our public marketing pages (for example the home page, pricing, features and the coach signup page) load a measurement pixel provided by OpenAI. When a coach arrives from one of our ads, the pixel stores a first-party __oppref cookie containing a privacy-preserving click identifier, and it reports back which marketing page was viewed and whether a coach account was created, a trial started, or — from the coach's own billing page — a plan upgrade completed, together with the plan name and price, a random event ID, and the technical information any web request carries (IP address, browser type). It does not receive names, email addresses, phone numbers, or payment details in plain text, and it is never loaded in the parent portal, on coaches' booking or registration pages, or anywhere a child's information is entered; children's information is never used for advertising. We honour the Global Privacy Control (GPC) browser signal: when it is on, the pixel is not loaded at all. You can also block it with standard browser cookie or tracker settings, or ask us to record an opt-out through the Your Privacy Choices form above. OpenAI's privacy policy is at https://openai.com/policies/privacy-policy.

We share information only with:

Service providers acting on our behalf, who may use it only to provide their service to us:
Stripe, Inc. — payment processing (subject to Stripe's own privacy policy at https://stripe.com/privacy)
Resend, Inc. — outbound transactional email (with IONOS SE as a fallback email delivery provider)
Twilio, Inc. — outbound SMS/text-message delivery, when you have explicitly opted in to receive text messages from us. Twilio receives only the phone number, message body, and metadata needed to deliver the message; it does not use your information for its own marketing. (Twilio privacy policy: https://www.twilio.com/legal/privacy)
Cloud hosting and database providers — infrastructure for the Service, located in the United States
OpenStreetMap / Nominatim — converting a lesson or pool address a coach enters into map coordinates so families can get directions; only the address text is sent
Google (Gemini API) — AI image generation when a coach uses the "Generate logo" feature; only the prompt and any image uploaded for that purpose are sent
Analytics — privacy-respecting, aggregated usage analytics on our marketing pages so we can understand how the site is used; we do not use analytics inside the parent portal to profile families
OpenAI (ChatGPT Ads measurement pixel) — ad attribution on our public marketing site and coach plan upgrades only, as described under "Advertising measurement" above (OpenAI privacy policy: https://openai.com/policies/privacy-policy)
The coach you applied to or enrolled with — your guardian and student information is visible to that specific coach (and to staff coaches on that coach's team) so they can run lessons. Different coaches cannot see each other's parents/students.
As required by law — in response to a valid subpoena, court order, or other lawful process, or to protect the rights, safety, or property of you, us, or others.
In a business transfer — if we are acquired, merged, or our assets are sold, your information may transfer to the successor entity under the same protections set out here; we will notify you of any change in ownership or in how your information is used.

Mobile phone numbers and SMS opt-in data are never sold, rented, or shared with third parties or affiliates for their marketing or promotional purposes. Phone numbers are shared only with Twilio (our SMS delivery provider) solely to deliver the messages you asked us to send. This restriction is also stated in our SMS Terms.

5. How long we keep information

We keep information only as long as we need it for the purposes described in this policy:

Account and profile information — for as long as your account is active, and for up to 90 days after you close it so you can change your mind or export your data.
Payment, billing, and tax records — up to 7 years after the transaction, as required by tax and accounting rules.
Signed waivers and consent records — for as long as the coach may need them as evidence of consent, generally until the statute of limitations for a personal-injury claim in the relevant state has expired (often up to 4–7 years after the child's last lesson, or longer where a minor's claim is tolled by law). Coaches may download their waiver PDFs at any time.
Server logs and security records — typically 30–90 days.

You can request earlier deletion as described in Section 7; we will honor it except where we must keep specific records for the legal reasons above.

6. Security

We protect information using industry-standard safeguards including encryption in transit (HTTPS/TLS), encryption at rest for our database, one-way password hashing, role-based access controls, rate limiting, and audit logging. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security.

Breach notification. If we become aware of a breach of security that affects your unencrypted personal information, we will notify you and any regulators as required by applicable law — without unreasonable delay and in any event within the time limits set by the laws that apply to you (for example, no later than 30 days after the breach is determined under the Florida Information Protection Act, and within 72 hours to the relevant supervisory authority where the GDPR applies).

7. Your privacy rights

Depending on where you live, you may have the following rights with respect to your personal information:

Access — request a copy of the personal information we hold about you
Correction — ask us to fix inaccurate information
Deletion — ask us to delete information we no longer need to keep
Portability — receive your information in a structured, machine- readable format
Opt-out of marketing — although we do not currently send marketing email from SplashPad, you can always reach us to opt out of any non-essential communication
Non-discrimination — we will not discriminate against you for exercising any of these rights

To exercise any of these rights, use the Your Privacy Choices form at https://splashpad.pro/privacy/delete-my-data or email us at support@splashpad.pro from the address associated with your account. We will respond within the time period required by your applicable law (generally 45 days in the U.S.; 30 days under the GDPR). We may need to verify your identity before fulfilling the request, and you may designate an authorized agent to make a request for you.

U.S. state privacy laws. Residents of California (CCPA/CPRA), Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws have the rights listed above to the extent those laws apply to us. In the last 12 months we collected the categories of personal information described in Section 2, for the purposes in Section 3, and disclosed them only to the service providers and coaches described in Section 4. We do not sell personal information. Other than the marketing-site ad measurement described in Section 4 (which you can opt out of, and which honours Global Privacy Control), we do not share personal information for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. We do not use or disclose sensitive personal information for any purpose other than providing the Service.

Nevada residents — we do not sell covered information as defined by Nevada law.

7b. Users in the United Kingdom, European Union, or Switzerland (GDPR). If you use the Service from these regions, SSA MEDIA LLC is the "controller" of the personal data you provide to us directly, and the coach you enroll with is an independent controller of the information you share with them. Our legal bases for processing are: performance of a contract (running your account and the lessons you book), legitimate interests (securing and improving the Service, preventing fraud), consent (SMS messages, optional features — you may withdraw consent at any time), and legal obligation (tax and accounting records). You have the rights of access, rectification, erasure, restriction, portability, and objection described above, and the right to lodge a complaint with your local supervisory authority. Your data is processed in the United States; we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) for those transfers, and our service providers are bound by equivalent commitments.

7a. SMS / text-message communications

If you give us your mobile number AND explicitly tick the SMS opt-in box during registration (or later enable SMS in your account settings), we may send you text messages related to your child's swim lessons. SMS opt-in is always optional — you can use SplashPad without ever enabling text messages.

Message categories. Messages will only be one of the following:

Lesson reminders (e.g. *"SplashPad — Coach Sarah: Reminder, Emma's lesson is tomorrow at 4 PM."*)
Lesson cancellations, reschedules, or weather closures
Coach broadcasts to their enrolled families (e.g. holiday schedule)
Two-way confirm/cancel — you can reply to certain messages to confirm or cancel a single lesson

Brand prefix. Every message starts with SplashPad — Coach [Name]: so you always know which coach is contacting you.

Frequency. Message frequency varies but can be as high as daily during active lesson seasons. We send only operational messages related to lessons you or your child are enrolled in — never marketing.

Costs. Message and data rates may apply, set by your wireless carrier. SplashPad does not charge anything for SMS.

Opt-out and help. You can opt out at any time by:

Replying STOP to any message — Twilio will immediately remove your number from all SplashPad SMS lists
Reply HELP for help — you'll receive a short reply explaining how to reach support
Toggling SMS off in your parent dashboard
Emailing support@splashpad.pro with subject "STOP SMS"

After opting out you may still receive transactional emails (lesson reminders by email, receipts) and continue to use the Service normally.

Phone numbers are never sold or shared with third parties other than Twilio, our SMS delivery provider, who processes them solely to deliver the messages you asked us to send. See our SMS Terms at https://splashpad.pro/sms-terms for the full opt-in disclosure.

8. Children's privacy (COPPA)

SplashPad is not directed to children under 13, and children may not create accounts. We do not knowingly collect personal information directly from children. When a parent or guardian creates a profile for a child as part of a swim-lessons enrollment, the parent/guardian provides that information and consents on the child's behalf; it is used only to run the child's lessons and is shared only with the coach the parent chose. We do not use children's information for marketing, advertising, or profiling, and we do not require a child to disclose more information than is reasonably necessary to participate. Parents may review, correct, or delete their child's information at any time from the parent portal or by contacting us. If you believe a child under 13 has provided information to us directly without parental involvement, please email support@splashpad.pro and we will delete it promptly.

9. International users

The Service is operated from the United States and is intended for users in the United States. If you access it from outside the United States, your information will be transferred to, stored, and processed in the United States, where data-protection laws may differ from those of your home country. See Section 7b for the safeguards we apply to European and UK data.

10. Changes to this policy

We may update this policy from time to time. When we make a material change we will bump the version number and ask you to re-accept on your next login. The "Effective Date" at the top of this page reflects the most recent update.

11. Contact us

If you have any questions about this Privacy Policy or want to exercise a privacy right, please reach us at:

SSA MEDIA LLC
616 Claremore Dr, West Palm Beach, FL 33401
Email: support@splashpad.pro