Privacy Policy

This policy explains what personal data Pontafex collects through this website, how we use it, who processes it on our behalf, and what rights you hold under applicable law — including GDPR (EU/EEA), PIPA (Republic of Korea), the Thai PDPA, and Vietnam Decree 13/2023/ND-CP.

01 Who We Are

Pontafex, Inc. ("Pontafex", "we", "our") is the data controller for the purposes of this policy. We are incorporated and headquartered in Seoul, Republic of Korea, and operate the website at pontafex.ai.

Contact for all data-related matters: sales@pontafex.ai

02 Data We Collect

Form submissions (inquiry and waitlist). When you submit the inquiry or waitlist form we collect: full name, work email address, company or golf course name, job role, country, an optional message, your consent timestamp, and the interface language you were using at the time.

Server-side technical data. Our servers record a SHA-256 hash of your IP address (we never store the raw IP address), your browser user agent string, and a submission timestamp. These are used solely for abuse prevention and rate-limiting.

Browser storage. We store your language preference in localStorage and a one-time coming-soon splash dismissal flag in sessionStorage. These are first-party only and contain no personally identifiable information.

No third-party tracking. As of the effective date of this policy, we do not use Google Analytics, Meta Pixel, Segment, PostHog, Sentry, or any equivalent behavioural-tracking or advertising tool. No tracking cookies are set.

03 Why We Collect It

• To respond to your inquiry — we need your contact details to reply.
• To notify you at launch — if you joined the waitlist we will email you when CaddAi becomes available, subject to the consent you gave at submission.
• To prevent fraud and abuse — hashed IPs and user agents enable rate-limiting and honeypot checks without identifying you personally.

04 Lawful Basis

Consent (GDPR Art. 6(1)(a)). You provide explicit consent by ticking the checkbox before submitting the inquiry form. You may withdraw consent at any time by emailing sales@pontafex.ai; withdrawal does not affect the lawfulness of processing prior to that point.

Legitimate interest (GDPR Art. 6(1)(f)). We rely on legitimate interest for abuse prevention using hashed IP addresses. The privacy impact is minimal because we store only a one-way hash, not the raw address.

Under PIPA (Korea) processing rests on the same consent and legitimate-interest foundations. Under the Thai PDPA, processing rests on consent. Under Vietnam Decree 13/2023/ND-CP, processing rests on the consent given at submission.

05 Data Processors

We share your data only with the sub-processors listed below. We do not sell, rent, or trade personal data to any third party.

• Netlify, Inc. — website hosting and serverless functions (US and EU regions).   Netlify Privacy Policy
• Supabase, Inc. — database storage for inquiry submissions (AWS us-east-1 and/or EU regions).   Supabase Privacy Policy
• Resend, Inc. — transactional email delivery to our team.   Resend Privacy Policy

No other processors receive your personal data.

06 Retention

Inquiry and waitlist submissions are retained until the inquiry is fulfilled or 24 months from collection, whichever is shorter. Hashed IP addresses are retained for 12 months for abuse prevention purposes and then permanently deleted. You may request earlier deletion at any time (see §08).

07 International Transfers

Because our processors (Netlify, Supabase, Resend) operate infrastructure in the United States and/or the EU, your data may be transferred internationally. Where required under GDPR, transfers from the EEA rely on Standard Contractual Clauses (SCCs) adopted by the European Commission. We take equivalent contractual steps to protect data originating from Korea, Thailand, and Vietnam.

08 Your Rights

Depending on your jurisdiction you hold some or all of the rights below. To exercise any of them write to sales@pontafex.ai; we will respond within 30 days.

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your data.
• Portability — receive your data in a structured, machine-readable format (GDPR / Thai PDPA).
• Objection — object to processing based on legitimate interest (GDPR).
• Suspension of processing — request that we suspend use of your data (PIPA).
• Withdraw consent — withdraw consent at any time without penalty.

EEA residents may lodge a complaint with their national data protection authority. Korean residents may complain to the Personal Information Protection Commission (PIPC). Thai residents may contact the Personal Data Protection Committee (PDPC). Vietnamese residents may contact the Ministry of Information and Communications (MIC).

09 Children

This website is not directed at children. Under GDPR we do not knowingly collect data from persons under 16 years of age. Under PIPA (Korea) the minimum age is 14. If you believe we have inadvertently collected data from a child please contact us immediately and we will delete it.

10 Policy Changes

We may update this policy. The effective date at the top of this page reflects the date of the most recent revision. We will not send unsolicited email to notify you of routine updates. Material changes affecting your rights will be communicated prominently on this page.

11 Contact

For any data-related questions, requests, or complaints:
sales@pontafex.ai
Pontafex, Inc., Seoul, Republic of Korea