OutdoorBoost AI

Privacy Policy

Official policy text maintained in the OutdoorBoost legal policy source.

**Last Updated: July 29, 2026**

Outdoor Boost AI LLC ("OutdoorBoost AI," "we," "our," or "us") operates the OutdoorBoost AI booking platform and the OutdoorShifts.com gig marketplace (collectively, the "Services"). This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our Services.

By using the Services, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please discontinue use of the Services.

---

## 1. Information We Collect

We collect several categories of information when you use our Services:

### 1.1 Information You Provide Directly

- **Account information**: Name, email address, phone number, username, and password when you register an account
- **Profile information**: Business name, business type, location, photos, biography, certifications, qualifications, and other information you choose to add to your profile
- **Booking information**: Activity preferences, booking history, number of participants, participant names, special requests, and emergency contact information
- **Payment information**: Billing address and payment method details (note: full card numbers are processed and stored by Stripe, not by OutdoorBoost AI; cryptocurrency transactions are processed through Coinbase Commerce)
- **Identity verification**: Government-issued ID or professional certification documents submitted for identity or credential verification
- **Waiver information**: Information you provide in digital liability waivers, including health disclosures and acknowledgments of risk
- **Biometric identifiers**: Voice recordings (captured through Phonely voice AI calls), facial imagery in activity photos or videos, and any other biometric data integral to the service. Biometric data is collected only when necessary for service delivery and with appropriate consent. When the data subject is a child under 13, biometric identifiers are treated as children's personal information subject to COPPA requirements — see Section 9.
- **Communications**: Messages you send to businesses, our support team, or through our AI chatbot; reviews and ratings you submit
- **Business data**: For business accounts — activity listings, pricing, availability calendars, staff information, customer data uploaded to the platform, and business documents

### 1.2 Information Collected Automatically

When you use our Services, we automatically collect:

- **Usage data**: Pages visited, features used, links clicked, time spent on pages, booking flows initiated and completed
- **Device information**: IP address, browser type and version, operating system, device identifiers, and screen resolution
- **Log data**: Server access logs, error logs, and performance data
- **Location data**: General location inferred from IP address; precise location if you grant permission through a mobile application
- **Booking and transaction history**: Records of all bookings, payments, cancellations, and platform interactions
- **Referral and marketing data**: How you arrived at our platform (referral URL, UTM parameters, advertising campaign identifiers)

### 1.3 Information from Third Parties

- **Authentication providers**: When you sign in using SSO through Clerk (e.g., Google, Apple), we receive your name, email address, and profile picture from that provider per your permissions
- **Payment processors**: Stripe and Coinbase Commerce provide transaction confirmation data, payment status, and fraud signals; they do not share your full card numbers with us
- **Background check providers**: If you or your business uses optional background check or credential verification services, we receive the results from our third-party verification provider
- **Social media**: If you connect social media accounts, we receive the data you authorize per that platform's permissions
- **Business integrations**: If you connect third-party calendar, accounting, or booking tools to our platform, we receive data from those integrations per your authorization

### 1.4 B2B Prospect Data (Outbound Sales Pipeline)

OutdoorBoost AI conducts outbound business-to-business (B2B) sales outreach to identify and contact outdoor recreation businesses (rafting outfitters, ski resorts, climbing gyms, etc.) that may benefit from our booking platform. This section describes how we collect, use, and protect data about individuals at those businesses.

**What we collect about B2B prospects:**

- Business contact information: business name, website, physical address, and general business phone number / email address found in publicly available directories
- Professional contact information: first name, last name, job title, and work email address of individuals in a business role relevant to booking or operations decisions
- Business characteristics: estimated employee count, estimated revenue, geographic location (state/city), Google or Yelp review count, current booking software used, and social media follower counts where publicly visible
- Engagement data: whether and when we sent outreach emails, whether those emails were opened or clicked, and whether the recipient replied or unsubscribed

**Sources of B2B prospect data:**

- **Outscraper** — local business discovery tool that aggregates publicly available information from Google Maps and similar sources
- **Apollo.io** — B2B data enrichment provider that sources professional contact information from publicly available business registries, websites, and professional networks
- **Public directories** — state business registries, industry association websites, and other publicly available records
- We do **not** purchase or use scraped Google Maps data in violation of Google's Terms of Service; Outscraper accesses Maps-adjacent data through methods that comply with applicable ToS

**How we use B2B prospect data:**

- To send outbound sales emails about OutdoorBoost AI's products and services, in compliance with the CAN-SPAM Act (see our [CAN-SPAM Compliance Policy](CAN-SPAM_COMPLIANCE_POLICY.md))
- To prioritize and score outreach based on business characteristics (e.g., current booking software, business size, geographic market)
- To track engagement with our outreach for campaign optimization
- We do **not** sell B2B prospect data to third parties

**Automated decision-making on B2B prospects:**

We use automated lead-scoring algorithms to prioritize outreach. These algorithms consider publicly available business signals (booking software used, review count, business size) and assign a numeric score that determines outreach timing and sequence. No adverse action is taken against any business based on this score — it only affects when and how we contact them.

**Your rights as a B2B prospect:**

- **Opt out / unsubscribe:** Every outbound email we send includes a one-click unsubscribe link. Clicking it immediately adds your email address to our suppression list and removes you from all future outreach. We honor unsubscribe requests within 24 hours (CAN-SPAM requires 10 business days; we act immediately).
- **Request deletion:** To request that we delete all information we hold about you as a B2B prospect, email privacy@outdoorboost.ai with subject "B2B Prospect Data Deletion Request." We will process verifiable requests within 30 days.
- **Request access:** To request a copy of the B2B prospect information we hold about you, email privacy@outdoorboost.ai with subject "B2B Prospect Data Access Request."
- **Do not contact:** If you do not wish to receive any outreach from us, email privacy@outdoorboost.ai with subject "Do Not Contact Request." We will add you to our global suppression list within 24 hours.

**Retention of B2B prospect data:**

| Data Category | Retention Period |
|---|---|
| Prospect contact information (active pipeline) | Until unsubscribe/deletion request, or 2 years from last engagement |
| Suppressed / unsubscribed contact records | Permanent (to prevent re-adding to outreach lists) |
| Email engagement logs (opens, clicks) | 3 years (CAN-SPAM record-keeping requirement) |
| Closed-won customer records | Transition to standard customer data retention (see Section 10) |

**Legal basis for B2B outreach:**

B2B cold email outreach to business email addresses is permitted under the CAN-SPAM Act without prior consent, provided all required disclosures are included and an opt-out mechanism is provided. We comply with these requirements in all outreach. Recipients in jurisdictions with stricter consent requirements (e.g., EU/EEA) will only be contacted where a legitimate interest or consent basis applies.

---

## 2. How We Use Your Information

We use the information we collect to:

### 2.1 Provide and Operate the Services

- Create and manage your account
- Process bookings and payments
- Facilitate connections between businesses and outdoor professionals on OutdoorShifts
- Send booking confirmations, reminders, and receipts
- Process refunds and cancellations
- Manage digital waivers and legal documentation
- Provide customer support

### 2.2 AI-Powered Personalization and Features

- Power AI chatbot responses to customer inquiries
- Generate personalized activity recommendations based on your booking history and preferences
- Provide AI-powered dynamic pricing suggestions to businesses
- Generate automated content (descriptions, summaries, marketing copy) for business accounts
- Improve AI model responses based on aggregate, de-identified usage patterns

### 2.3 Analytics and Platform Improvement

- Analyze how users interact with the Services to improve functionality
- Conduct A/B testing and performance analysis
- Generate aggregated, de-identified analytics for internal reporting and business insights provided to business account users
- Monitor and improve platform security and reliability

### 2.4 Marketing and Communications

- Send you promotional emails about new features, products, and offers (you can opt out at any time)
- Show you relevant advertisements on third-party platforms (where permitted by law)
- Operate referral and affiliate programs

### 2.5 Legal and Safety

- Comply with applicable laws and regulations
- Respond to legal process (subpoenas, court orders, government requests)
- Detect, investigate, and prevent fraud, abuse, and security incidents
- Enforce our Terms of Service and other policies
- Protect the rights, safety, and property of OutdoorBoost AI, our users, and the public

---

## 3. Cookies and Tracking Technologies

We use cookies, web beacons, pixel tags, and similar tracking technologies to operate and improve our Services.

### 3.1 Types of Cookies We Use

| Type | Purpose |
|------|---------|
| **Strictly necessary** | Required for the Services to function (authentication sessions, shopping cart, security tokens) |
| **Functional** | Remember your preferences and settings (language, location, display options) |
| **Analytics** | Understand how users use our Services (page views, session duration, feature usage) |
| **Marketing** | Track conversions and show relevant advertising on third-party platforms |

### 3.2 Third-Party Tracking

Our Service pages may include tracking technologies from third-party analytics and advertising providers. These providers may collect information about your online activities across different websites and services.

### 3.3 Your Cookie Choices

Most browsers allow you to refuse or delete cookies. Refusing strictly necessary cookies may prevent some parts of the Services from functioning. For other cookies, you may opt out through:

- Your browser's cookie settings
- Industry opt-out tools (e.g., the NAI opt-out tool, DAA opt-out page)
- Our cookie preference center (where available)

We do not currently respond to browser Do Not Track signals, but you may use the opt-out methods described above.

---

## 4. Third-Party Services

We share data with third-party service providers to operate our Services. These providers process your data on our behalf subject to contractual obligations protecting your information.

| Provider | Purpose | Data Shared |
|----------|---------|-------------|
| **Clerk** | Authentication and identity management (SSO, MFA) | Account credentials, authentication events |
| **Stripe, Inc.** | Credit and debit card payment processing | Name, billing address, payment method (card data processed by Stripe, not stored by us) |
| **Coinbase Commerce** | Cryptocurrency payment processing | Transaction data, wallet addresses |
| **Anthropic (Claude)** | AI chatbot, content generation, pricing recommendations | Query text, relevant context (not linked to your identity by default) |
| **OpenAI** | AI features (fallback and specialized use cases) | Query text, relevant context |
| **Google (Gemini)** | AI features (fallback model) | Query text, relevant context |
| **Render** | Cloud hosting and infrastructure | All data processed on platform |
| **Cloudflare** | CDN, DNS, DDoS protection, and security | IP addresses, request logs |
| **Resend** | Transactional email delivery | Email address, email content |
| **Twilio** | Transactional SMS and voice communications | Phone number, message or call content, and delivery metadata |
| **Convex** | Real-time database and backend infrastructure | All platform data |
| **Background check providers** | Identity and credential verification (optional) | Name, date of birth, ID documents (per your consent) |

We do not sell your personal information to third parties for their own marketing purposes.

### 4.1 SMS Opt-In Data and Consent

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

We do not sell, rent, or use SMS opt-in data or consent for third-party marketing. Phone numbers and message content may be processed by our messaging service provider only as necessary to deliver the messages a recipient requested.

---

## 5. AI Data Processing Disclosure

### 5.1 How AI Models Process Your Data

Our AI-powered features (chatbots, recommendations, content generation, dynamic pricing) send queries to third-party AI model providers including Anthropic, OpenAI, and Google. When you interact with an AI feature, relevant context (such as the text of your query, activity type, or booking information) is transmitted to the AI provider to generate a response.

### 5.2 No Training on Personal Data

OutdoorBoost AI does not use your personal data to train AI models, and our agreements with AI providers prohibit them from using data submitted through our platform's API calls to train their models.

### 5.3 AI Data Retention by Providers

AI providers may retain query data for a limited period for safety monitoring and compliance purposes, subject to their own privacy policies. We encourage you to review the privacy policies of Anthropic, OpenAI, and Google for details.

### 5.4 Sensitive Information and AI

We advise you not to submit sensitive personal information (such as Social Security numbers, full financial account numbers, or medical details beyond what is necessary for waiver completion) through our AI chat features.

---

## 6. Data Sharing and Disclosure

Beyond the service providers listed above, we may share your information in the following circumstances:

### 6.0 Prohibition on Sale of Sensitive Personal Data

**OutdoorBoost AI does NOT sell sensitive personal data.** This includes consumer health data (waiver health disclosures), biometric identifiers (voice recordings, photos with identifying features), precise geolocation, data of known minors, and any other sensitive data category enumerated under applicable state privacy law (including but not limited to Md. Code Ann. § 14-4602(j)). This commitment applies in all jurisdictions, even where consumer consent might otherwise permit a sale.

"Sale" for this purpose means any exchange of sensitive personal data for monetary consideration, and any use of sensitive personal data to enable targeted advertising or cross-context behavioral profiling by a third party.

This prohibition is absolute and platform-wide. OutdoorBoost AI does not maintain an opt-in or consent mechanism that would permit the sale of sensitive personal data, because no such mechanism is legally available under applicable law.


### 6.1 With Other Platform Users

- When you make a booking, your name, contact information, and booking details are shared with the business you are booking with
- When a business hires a worker through OutdoorShifts, relevant profile and contact information is shared between the parties
- Reviews and ratings you submit may be publicly visible

### 6.2 Business Transfers

If OutdoorBoost AI is acquired, merges with another company, or sells all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you of any such change via email or prominent notice on our platform.

### 6.3 Legal Requirements

We may disclose your information if we believe in good faith that disclosure is necessary to:

- Comply with applicable law, legal process, or government request
- Protect the rights, safety, or property of OutdoorBoost AI, our users, or the public
- Detect, prevent, or investigate fraud or security incidents
- Enforce our Terms of Service

### 6.4 Aggregate and De-Identified Data

We may share aggregated or de-identified data that cannot reasonably be used to identify you with partners, researchers, or the public for business analysis or industry research purposes.

---

## 7. California Consumer Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

### 7.1 Right to Know

You have the right to request that we disclose:

- The categories and specific pieces of personal information we have collected about you
- The categories of sources from which we collected that information
- Our business or commercial purpose for collecting that information
- The categories of third parties with whom we share that information

### 7.2 Right to Delete

You have the right to request that we delete the personal information we have collected about you, subject to certain exceptions (e.g., where we are required to retain information to complete transactions, fulfill legal obligations, or for other permitted purposes).

### 7.3 Right to Correct

You have the right to request that we correct inaccurate personal information we hold about you.

### 7.4 Right to Opt Out of Sale or Sharing

We do not sell your personal information for money. To the extent we share your information for cross-context behavioral advertising purposes, you have the right to opt out. You may submit an opt-out request at privacy@outdoorboost.ai.

### 7.5 Right to Limit Use of Sensitive Personal Information

For sensitive personal information (as defined by CPRA), you have the right to limit our use to what is necessary to provide the Services.

### 7.6 Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

### 7.7 How to Submit a Request

To exercise your California privacy rights, contact us at:
- Email: privacy@outdoorboost.ai
- Subject line: "California Privacy Rights Request"

We will respond to verifiable requests within 45 days. We may extend this period by an additional 45 days where reasonably necessary and with notice to you.

---

## 8. State Privacy Laws

In addition to California, we comply with applicable privacy laws in the states where we operate:

| State | Law | Key Rights |
|-------|-----|-----------|
| **Colorado** | Colorado Privacy Act (CPA) | Right to access, correct, delete, portability, opt out of targeted advertising and profiling |
| **Utah** | Utah Consumer Privacy Act (UCPA) | Right to access, delete, portability, opt out of sale and targeted advertising |
| **Montana** | Montana Consumer Data Privacy Act (MCDPA) | Right to access, correct, delete, portability, opt out |
| **Virginia** | Virginia Consumer Data Protection Act (VCDPA) | Right to access, correct, delete, portability, opt out of sale, targeted advertising, and profiling |
| **Vermont** | Vermont Data Broker Law and emerging privacy legislation | Rights as applicable under current law |
| **Maine** | Maine privacy laws as applicable | Rights as applicable under current law |
| **Wyoming** | Wyoming privacy laws as applicable | Rights as applicable under current law |

To exercise rights under these state laws, contact us at privacy@outdoorboost.ai with your state of residence and the specific right you wish to exercise. We will respond within the timeframe required by applicable law.

---

## 9. Children's Privacy (COPPA)

Our general Services are not directed to children under the age of 13. However, OutdoorBoost's booking platform facilitates youth outdoor activities (rafting, ski lessons, climbing, summer camps) where parents and guardians book on behalf of children under 13. In those contexts, we collect children's personal information with verifiable parental consent (VPC) as required by COPPA (16 CFR Part 312, as amended by 90 Fed. Reg. 16,918–16,983, April 22, 2025).

### Children Under 13 — COPPA Disclosures

**Verifiable Parental Consent**: Before collecting, using, or disclosing personal information from a child under 13, we obtain verifiable parental consent using methods accepted under the amended COPPA Rule. Our default method is e-signature plus email confirmation; high-risk activities escalate to government ID upload. See [Minors Data Handling Policy](legal/MINORS_DATA_HANDLING_POLICY.md) for the full list of accepted VPC methods.

**Separate Consent for Third-Party Disclosure**: We do not bundle consent for sharing a child's personal information with third parties (such as the outfitter or operator who will conduct the activity) into the general booking or waiver consent. A separate, affirmative consent step names the specific recipient and the data categories being shared.

**Biometric Identifiers**: Voice recordings (Phonely calls where a child speaks), facial imagery in activity photos or videos, and any other biometric data are treated as children's personal information when the data subject is under 13. Biometric data on children is collected only with separate consent and is subject to the retention periods in our [Children's Data Retention Schedule](legal/CHILDREN_DATA_RETENTION.md).

**Retention**: We do not retain children's personal information indefinitely. Children's data is retained according to our written [Children's Data Retention Schedule](legal/CHILDREN_DATA_RETENTION.md), which governs waiver records, voice recordings, activity photos, and related data. Retention periods are tied to the purpose of collection and applicable statute-of-limitations periods.

**Parental Rights**: Parents and legal guardians may at any time:
- Review the personal information we have collected about their child.
- Request correction of inaccurate information.
- Request deletion of their child's personal information (subject to legal retention exceptions).
- Revoke consent for further collection or use.

To exercise these rights, contact privacy@outdoorboost.ai with subject line "COPPA Parental Rights Request."

**Security**: We maintain a written information security program for children's data with a designated security coordinator (privacy@outdoorboost.ai) and annual risk assessments, consistent with the amended COPPA Rule.

If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete that information promptly. If you believe we have inadvertently collected a child's information without proper consent, contact privacy@outdoorboost.ai immediately.

For activities that may involve minors ages 13–17, a parent or legal guardian must review and consent to the applicable activity waiver and booking terms on behalf of the minor.

---

## 10. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law.

| Data Type | Retention Period |
|-----------|----------------|
| Account information | Duration of account plus 3 years after closure |
| Booking and transaction records | 7 years (tax and legal compliance) |
| Payment records | 7 years (financial records requirements) |
| Digital waivers | 7 years or as required by applicable state law (whichever is longer) |
| Communications and support records | 3 years |
| AI interaction logs | 90 days (de-identified after 30 days) |
| Marketing preferences and opt-outs | Duration of account plus 5 years |
| Security and fraud logs | 2 years |
| Aggregated analytics data | Indefinitely (cannot identify individuals) |

You may request deletion of your personal information before the end of the retention period. We may retain certain information as required by law or for legitimate business purposes even after such a request.

---

## 11. Security Measures

We implement technical and organizational security measures to protect your personal information:

- **Encryption**: Data in transit is protected using TLS/SSL encryption. Sensitive data at rest is encrypted using industry-standard methods.
- **Authentication security**: Account access is managed through Clerk with support for MFA. Strong password requirements are enforced.
- **Access controls**: Employee access to personal data is restricted on a need-to-know basis. Access is logged and reviewed.
- **Infrastructure security**: Our Services are hosted on Render with Cloudflare providing DDoS protection and network security monitoring.
- **Payment security**: Payment card data is processed and stored by Stripe (PCI-DSS compliant). We do not store full card numbers.
- **Security monitoring**: We monitor for suspicious activity, unauthorized access attempts, and security incidents.
- **Incident response**: We maintain a documented data breach response plan and will notify affected users and regulatory authorities as required by applicable law.

No security system is completely impenetrable. While we take reasonable steps to protect your information, we cannot guarantee absolute security. In the event of a security incident that affects your personal information, we will notify you as required by applicable law.

---

## 12. International Data Transfers

OutdoorBoost AI is based in the United States. If you are accessing the Services from outside the United States, please be aware that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

At this time, our Services are primarily offered to users in the United States. If we expand to international markets, we will implement appropriate safeguards for international data transfers as required by applicable law.

---

## 13. Your Privacy Rights and Choices

Regardless of your state of residence, you have the following general rights:

### 13.1 Access and Portability

You may request a copy of the personal information we hold about you, including in a portable format.

### 13.2 Correction

You may update or correct most of your account information directly through your account settings. For other corrections, contact us at privacy@outdoorboost.ai.

### 13.3 Deletion

You may request deletion of your personal information. Note that some information may be retained as required by law, for fraud prevention, or to complete outstanding transactions.

### 13.4 Opt Out of Marketing Communications

You may opt out of marketing emails by clicking the "unsubscribe" link in any marketing email, or by emailing privacy@outdoorboost.ai. You may still receive transactional emails related to your account and bookings.

### 13.5 Opt Out of Analytics and Tracking

You can manage cookie preferences through your browser settings or our cookie preference center. Note that opting out of certain tracking may limit functionality.

### 13.6 Push Notifications

If you use our mobile application, you can manage push notification preferences through your device settings.

### 13.7 How to Exercise Your Rights

To exercise any of the above rights, contact us at:
- **Email**: privacy@outdoorboost.ai
- **Subject**: "Privacy Rights Request — [Type of Request]"

We will verify your identity before processing requests to protect your information from unauthorized access. We will respond within the timeframe required by applicable law (generally 30–45 days, with possible extension for complex requests).

---

## 14. Links to Third-Party Sites

Our Services may contain links to third-party websites and services. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party sites you visit.

---

## 15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

- Posting a notice on our website
- Sending an email to the address associated with your account
- Displaying a prominent notice within the Services

Changes will be effective on the date stated in the updated policy. Your continued use of the Services after the effective date of an updated policy constitutes your acceptance of the changes.

We encourage you to review this policy periodically.

---

## 16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

- **Privacy inquiries**: privacy@outdoorboost.ai
- **General support**: support@outdoorboost.ai
- **Mailing address**: Outdoor Boost AI LLC, 127 N Higgins Ave, Missoula, MT 59802

For urgent security or data breach concerns, contact us at privacy@outdoorboost.ai with the subject line "URGENT: Security/Privacy Concern."

---

*This Privacy Policy is effective as of July 29, 2026. Section 4.1 was added to clarify protections for SMS opt-in data and consent. Section 9 reflects the FTC's amended COPPA Rule (90 Fed. Reg. 16,918–16,983; full compliance deadline April 22, 2026). Section 1.4 covers B2B prospect data collected for the outbound sales pipeline.*