Privacy policy

The short version

• Outdoor Grid is booking and shop software for rental and tour shops, made by HowTheF.
• If you book with a shop, the shop decides what happens with your details. We run the software for the shop.
• For our website, the contact form and shop accounts, we decide, and this policy explains how.
• We do not sell your details, we do not share them for advertising and we use no advertising or tracking cookies.
• You can ask to see, correct or delete your details at any time by writing to hello@howthef.ai.

Who we are

Outdoor Grid is a product of HowTheF. The company behind it is HOWTHEF AI, LLC, a limited liability company registered in Delaware, USA (file number 10453311). Postal address: 1111B S Governors Ave, STE 98848, Dover, DE 19904, USA.

For anything about your personal data, write to hello@howthef.ai. We read every message ourselves.

Our representative in the European Union under GDPR article 27: Oliver Gattermayr, reachable at hello@howthef.ai.

Our two roles

When we decide (controller)

We decide how your details are used, and are responsible for them, when you visit our website, send us the contact form or an email, or have an account as a shop owner or shop staff.

When we work for a shop (processor)

When you book with a shop, sign at pick-up or write to a shop, the shop decides what happens with your details. In US law terms, we are the shop's service provider. We use your details only to run Outdoor Grid for that shop and on its instructions, never for our own purposes.

Each shop agrees data processing terms with us, as article 28 of the GDPR requires. A shop can ask us for them at hello@howthef.ai. If you booked with a shop, the shop's own privacy policy applies too, and the shop is the first place to ask about your booking details.

What we collect and why

For each activity below you find what we collect, why, and the legal reason that allows it under EU and UK law.

The contact form

What: your first and last name, email address, phone number if you give it, your shop's name, what you rent or run and how many locations if you say so, your message, the language of the page, the page you sent it from and the campaign tags in its address (such as utm_source).

How: the form sends your message straight to a private channel in Slack, where our team reads it and replies by email. We do not save it in our own database. To stop too many messages from one place, the server keeps your internet address in its memory for a short while and never writes it down.

Why: to answer you and, if you want, to set up a call and show you Outdoor Grid. Legal reason: steps you ask for before a possible contract, and our legitimate interest in answering people who contact us.

Emails you send us

What: your email address, your name and whatever you write. Why: to answer you. Legal reason: our legitimate interest in answering you, or steps before a contract when you ask about Outdoor Grid for your shop.

Shop owner and staff accounts

What: name, email address, the shop you belong to, your role and what you may do there, the details needed to sign in (your password is stored only in a scrambled form), and a record of important changes you make, such as who changed a booking and when.

Why: to give you access, keep each shop's information separate and safe, and send you emails you need, such as an invitation or a link to reset your password. Legal reason: our contract with your shop, and our legitimate interest in keeping accounts secure.

Guests who book with a shop

We handle these details for the shop. The shop chooses what to ask; typically it is:

• your name, email address, language and, if you give it, your phone number;
• for each person who will use equipment: name, height, weight, shoe size and skill level, so the shop can choose the right size;
• your booking: the days, what you booked, the booking number, what you paid and what is still to pay;
• at pick-up: the name you type and your tick to say you read the shop's rental terms.

The shop uses them to run your rental or tour. The legal reason is the shop's, usually carrying out your booking.

Messages and the AI assistant

A shop can connect its own WhatsApp, Instagram, Messenger or email account, so messages from guests arrive in Outdoor Grid. A shop can also let an AI assistant answer guests' questions and suggest bookings, with the shop's staff able to step in at any time. We handle these messages for the shop, as described above. When the assistant is on, the text of a conversation is sent to an AI model provider to write the answer. The provider works under a contract with us and may use the text only to write the answer.

Payments

When a guest pays a deposit or a booking online, the payment is taken on a page run by Stripe for the shop. We never see or store card numbers. Stripe tells us whether the payment went through, the amount and a payment reference, so the booking shows what is paid.

Security and server records

What: technical records such as your internet address, the time, the page asked for and your browser type. On a shop's booking page, a check run by Cloudflare tells people from automatic bots. Why: to keep the service safe, stop abuse and fix errors. Legal reason: our legitimate interest in a safe, working service.

When the law requires it

We keep records the law requires, such as accounting records, and answer lawful requests from authorities. Legal reason: our legal duties.

Where we rely on our legitimate interest, you can object at any time (see Your rights). We do not use your details for advertising and we do not send newsletters.

Who receives your details

We use these service providers to run Outdoor Grid. Each one gets only what it needs for its job, works under a contract with us and may not use your details for its own purposes.

• Supabase: our database and sign-in. The database is in the EU (Frankfurt, Germany).
• Hetzner: the servers that run Outdoor Grid, in the EU.
• Vercel: delivers our website and the app's pages.
• Cloudflare: our domain names, network protection and the bot check on booking pages.
• Stripe: online payments for shops (Stripe Connect).
• Resend: sends emails such as booking confirmations and sign-in links.
• Slack: receives the contact form so our team can reply.
• Meta (WhatsApp, Instagram, Messenger), Google (Gmail) and Microsoft (Microsoft 365): only when a shop connects its own account. These services also follow their own privacy policies.
• An AI model provider: only when a shop turns on the AI assistant.

Guests' details also go to the shop they booked with. We may share details with advisers such as accountants and lawyers, with authorities when the law requires it, or with a buyer if our business is sold, who must then protect them as this policy says.

We do not sell your details and we do not share them for advertising across other websites. We have not done so in the past 12 months.

Details sent outside the EU

HOWTHEF AI, LLC is a US company, and some of our providers (such as Vercel, Cloudflare, Stripe, Slack and Resend) may handle details in the United States or other countries. When details from the EU, the EEA, the UK or Switzerland leave Europe, we protect them with the EU-US Data Privacy Framework where the provider is certified under it, or with the Standard Contractual Clauses approved by the European Commission (and the UK and Swiss versions). You can ask us for a copy of these safeguards at hello@howthef.ai.

Cookies and browser storage

We only use what the service needs to work. Because of that, there is no cookie banner.

• og-locale: remembers the language you chose, for one year.
• Sign-in cookies (their names start with sb-): keep shop staff signed in. They are set only when you sign in and removed when you sign out.
• Small settings in the browser's storage, in the staff app only: for example how you like a list shown. They never contain guests' details.
• On a shop's booking page, Cloudflare's bot check may store a small value to do its job.
• When you pay, you are on Stripe's own page, and Stripe's cookie policy applies there.

We use no advertising, analytics or tracking cookies, and no tracking pixels. You can delete cookies in your browser at any time; you will then need to choose your language or sign in again.

How long we keep your details

• Contact form messages and emails: as long as we need them to answer you and follow up, then we delete them. If you become a customer, they become part of your shop's records.
• Shop and staff accounts: while the shop uses Outdoor Grid. When a shop leaves, we hand over its information if it asks and then delete it, as agreed with the shop.
• Guests' booking details: as long as the shop decides, and never longer than our agreement with the shop.
• Server records: only as long as needed for security and fixing errors.
• Records the law tells us to keep, such as accounting records: for as long as the law requires.

Your rights in the EU, the EEA, the UK and Switzerland

You can ask us to:

• show you the details we have about you and give you a copy;
• correct details that are wrong or incomplete;
• delete your details;
• limit how we use them;
• give you your details in a file you can take elsewhere;
• stop using them where we rely on our legitimate interest (your right to object).

Write to hello@howthef.ai. We answer within one month; if your request is complicated we may need up to two more months, and we tell you why. It is free. If you booked with a shop, we pass your request to the shop, or help the shop answer it.

You can also complain to a data protection authority, in the country where you live or work or where you think the problem happened. In Italy that is the Garante per la protezione dei dati personali (https://www.garanteprivacy.it). The list of all EU authorities is at https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK it is the Information Commissioner's Office (https://ico.org.uk).

Your rights in the United States

This part is our notice for California (CCPA, as changed by the CPRA) and for the other US states with privacy laws, where they apply to us.

What we collect

In the past 12 months we collected these kinds of personal information, for the reasons in What we collect and why:

• identifiers: name, email address, phone number, internet address, account sign-in;
• customer records: name, phone number and a physical description (height, weight, shoe size) for choosing equipment;
• commercial information: bookings, what was rented and what was paid;
• internet activity: server records of pages asked for;
• professional information: your shop's name and your role in it;
• sensitive personal information: only your account sign-in, used only to let you in.

We get it from you, from the shop you booked with, from Stripe (whether a payment went through) and from your browser. We keep it as described in How long we keep your details.

No sale, no sharing

We do not sell personal information and we do not share it for cross-context behavioral advertising, including of anyone under 16. We use sensitive personal information only for purposes the law allows, so there is nothing to limit.

Your rights

Depending on your state, you can ask to know what we collected and why, get a copy, correct it, delete it, and opt out of sale, sharing or targeted advertising (we do none of these). We will not treat you differently for using your rights: no different prices, service or quality.

How to ask

Write to hello@howthef.ai from the email address we know. We confirm we got your request within 10 business days and answer within 45 days, or tell you if we need up to 45 more. To protect you, we check it is you by replying to that address. Someone you authorize can ask for you with your signed permission. If we say no, you can appeal by replying with the word Appeal; we answer within the time your state's law sets, and if you are still not satisfied you can contact your state's attorney general.

Do Not Track and Global Privacy Control

We do not track you across other websites. We treat a Global Privacy Control signal from your browser as a request to opt out of sale and sharing; since we do neither, nothing else changes. A Do Not Track signal changes nothing either, for the same reason.

Automated decisions

We make no decisions about you by computer alone that have legal or similarly serious effects on you. The bot check only tells people from bots. The AI assistant answers questions and suggests bookings, and the shop's staff can step in at any time.

Children

Outdoor Grid is not meant for children. Bookings are made by adults, and we do not knowingly collect details from children under 13 (or under 16 in the EU). When a parent or guardian books for a child, they give the child's name and sizes, and these are used only for that booking. If you think a child gave us details, write to hello@howthef.ai and we delete them.

How we protect your details

Connections are encrypted. Each shop sees only its own information, and staff see only what their role allows. Passwords are stored only in a scrambled form. No system is perfectly safe; if something goes wrong that puts your details at risk, we tell you and the authorities as the law requires.

Changes to this policy

When something changes, we update this page and the date at the top. If a change is important, we tell shop owners by email before it applies.

Contact

Write to HOWTHEF AI, LLC, postal address 1111B S Governors Ave, STE 98848, Dover, DE 19904, USA, or email hello@howthef.ai.