Last updated: October 3, 2026

1. Who we are

CatchMoreWaves LLC, a Wyoming limited liability company (“CatchMoreWaves,” “we,” “us”) operates catchmorewaves.com and the CatchMoreWaves booking application at book.catchmorewaves.com. We connect people who want surf lessons with independent surf instructors. We currently operate in Puerto Rico and Hawaii.

We are a booking service. Instructors are independent businesses, not our employees, and the lesson itself is a contract between you and the instructor. This policy covers information we collect and control. It does not cover how an instructor handles information you give them directly, outside the platform.

Contact: privacy@catchmorewaves.com

Mail: CatchMoreWaves, P.O. Box 957, Haleiwa, HI 96712

2. Information we collect

Information you give us

Account information. Your name, email address, and password (stored hashed by our authentication provider, never in plain text), or, if you sign in with Google, the name and email address Google provides. Every account holder must be 18 or older.

Emergency contact. If you book lessons, we ask for one emergency contact: a name, phone number, and relationship to you. We give this to the instructor for the lesson you booked.

Mobile number and text messages. Every account has a mobile number, confirmed with a one-time code, which you can also use to sign in. If you choose to, you can opt in to text messages about your bookings. We record your consent and the wording you agreed to. Your mobile number, your consent, and the fact that you receive text messages from us are never shared with any third party or affiliate for marketing or promotional purposes. We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. You can opt out at any time by replying STOP to any message or by turning texts off in your account; opting out does not affect the emails we send about your bookings.

Participant information. When you book, you tell us who is taking the lesson: yourself, one or more children in your care, or both. For children, see Section 3.

Waivers. Before a lesson, you sign a liability waiver for each participant. We keep the signed waiver: who signed, for whom, the version of the waiver text, and when.

Booking information. The lesson, date, time, instructor, party size, and price. Once a lesson is confirmed, the instructor sees the participants’ details so they can teach safely.

Messages. Once a booking is confirmed, you and the instructor can message each other inside the app about that booking. We store those messages. Conversations are between the adult account holder and the instructor only; a child never has an account and is never a party to a conversation. Our staff can read a conversation for safety, support, or moderation, and every such read is logged.

Payment information. Payments are processed by Stripe, Inc. Your card details go directly to Stripe and are never stored on our systems. We keep a record of each transaction: the amounts charged and refunded, the platform’s fees, timestamps, and Stripe’s identifiers for the payment and any refund. Stripe’s handling of your payment data is governed by Stripe’s privacy policy.

Instructor information. If you list as an instructor, we additionally collect: a bio, profile photos, the languages you teach in, your home surf break (a name, map coordinates, and time zone), the certifications you list and any supporting documents you choose to upload, your lesson types and prices, your weekly availability and days off, and your booking preferences. Your identity, tax, and bank details for payouts are collected by Stripe directly through Stripe Connect; we receive only your Stripe account identifier, whether payouts are enabled, and the payout and balance information needed to show you your earnings.

What we do with instructor documents. We do not perform background checks on instructors and we do not verify an instructor’s identity, qualifications, or history. Where an instructor uploads a certification document, we may look at it and note on their profile that a document is on file; that note means only that a document was uploaded and reviewed by us, not that we have confirmed it is authentic, current, or that the instructor is competent. Students are responsible for their own judgment about an instructor, as our Terms of Service explain.

Support communications. Anything you send to support@catchmorewaves.com or privacy@catchmorewaves.com.

Information collected automatically

Device and usage data. When you use the app or the website, our hosting providers record standard server logs: IP address, browser and operating system, the pages or endpoints requested, and timestamps. We use these to run and secure the service and to debug problems.

Location. We do not collect or store precise device location. When you search for instructors you can type a surf break name, or choose “near me,” in which case your browser asks your permission and we use your device’s coordinates for that one search; we do not store them. Instructors choose the surf break they teach from; that location is part of their public profile.

Cookies and similar technologies. See Section 8.

Information from third parties

Google Calendar (instructors only). If you connect your Google account, we ask for permission to: (1) read the free/busy times of your primary calendar, so personal commitments block your lesson availability; (2) create, update, and delete calendar events for lessons booked through CatchMoreWaves; and (3) see the email address of the Google account you connected, so we can show you which account is linked. We do not read the titles, descriptions, attendees, or any other content of your calendar events; from the free/busy request we store only the time ranges during which you are busy. Your Google refresh token is stored encrypted.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to provide the calendar features described above. We do not use it for advertising, do not sell it, do not transfer it to others except as necessary to provide those features or as required by law, and do not allow humans to read it except with your explicit consent, for security purposes, to comply with applicable law, or where it has been aggregated and de-identified.

You can disconnect Google Calendar at any time from your instructor home. Disconnecting stops all calendar access and deletes the stored token. You can also revoke access at myaccount.google.com/permissions; we detect the revocation and disconnect on our side.

Stripe. Stripe sends us the outcome of each payment, refund, and payout, and whether an instructor’s account is able to receive payouts.

Google Sign-In. If you sign in with Google, Google sends us your name and email address.

3. Children

Our service is for adults. Accounts must be held by someone 18 or older, and our service is not directed to children under 13. We do not knowingly collect personal information directly from any child, and a child never has an account, a login, or the ability to message anyone through the platform.

Lessons booked for a child. An adult parent or legal guardian may book a lesson for a child in their care. To do that, the adult creates a child profile on their own account with the child’s first and last name, date of birth, surf skill level, swimming ability, and any medical, allergy, or other notes the adult chooses to add so the instructor can teach safely. The adult also signs the waiver on the child’s behalf.

Only the adult account holder can create, edit, or delete a child profile. By creating one, that adult confirms they are the child’s parent or legal guardian and consents to us handling the information as described here.
We do not collect a child’s contact details, location, photos, or device information.
A child’s information is shown to an instructor only for a lesson that adult has booked and paid for with that instructor, and only once the booking is confirmed. It is not shown on any public page, is never included in an email, and is never part of a message thread.
We share it with no one else, except as Section 5 describes.
Our staff can view a child’s profile through an internal tool for support and safety purposes; every such view is logged.
A parent or guardian can review, correct, or delete a child’s profile at any time in their account, or by contacting us at privacy@catchmorewaves.com. We will verify the request before acting on it.
Retention of a child’s information is described in Section 6.

If we learn we have collected personal information from a child under 13 without a parent or guardian’s consent, we delete it.

4. How we use information

To run the service: create accounts, show instructor availability, take bookings, sign waivers, process payments, refunds, and payouts, and sync lessons to an instructor’s calendar
To connect you with an instructor and give each of you what you need to hold the lesson safely, including a child’s skill, swim ability, and medical notes for a confirmed lesson
To send you transactional messages about your bookings and account: confirmations, changes, cancellations and refunds, reminders, new-message notifications, and (for instructors) booking requests and calendar-connection problems. Reminders and new-message notifications can be turned off in your email settings; the others cannot, because they concern money or a lesson you are part of
To send you transactional text messages about your bookings, only if you have opted in; every category of text can be turned off in your account, and STOP always works
To provide support, resolve disputes, and review cancellations and refunds
To decide whether to list an instructor and to enforce our listing requirements
To keep a log of actions our own staff take in our internal tools
To prevent fraud, abuse, and spam, and to enforce our Terms
To improve the service and debug problems
To comply with legal obligations and to establish or defend legal claims
To protect the safety of users and the public

We do not currently send marketing email. If we start, every marketing message will include an unsubscribe link and you will be able to opt out at any time without affecting the messages above.

We do not use your information to train machine-learning models.

With instructors. When your booking with an instructor is confirmed, that instructor receives your name, your emergency contact, and each participant’s details as described in Sections 2 and 3, along with the ability to message you about that booking. Instructors are independent and handle that information under their own practices.

With people booking lessons. An instructor’s public profile — name, bio, photos, languages, the certifications they list and whether a supporting document is on file, home surf break, lesson types, prices, and available times — is visible to anyone using the app. An instructor’s contact details, calendar, and earnings are not.

With service providers who process information on our behalf, limited to what they need:

Google LLC — hosting and infrastructure for the app (Google Cloud and Firebase: authentication, database, file storage, the application servers, and scheduled jobs), located in the United States; Google Sign-In; and Google Calendar where an instructor connects it
Stripe, Inc. — payments, refunds, instructor identity verification for payouts, and payouts
Resend, Inc. — sending our transactional email
Twilio Inc. — delivering our transactional text messages, where you have opted in
Cloudflare, Inc. — hosting, DNS, and security for our marketing website, catchmorewaves.com

For legal reasons. We may disclose information where we believe in good faith it is required by law, legal process, or a government request; to enforce our Terms; to detect or address fraud, security, or safety issues; or to protect the rights, property, or safety of CatchMoreWaves, our users, or the public.

Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that transaction. We will give notice before your information becomes subject to a materially different privacy policy.

With your direction. Where you ask us to share something.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law. We do not use advertising pixels or third-party analytics in the app.

6. How long we keep it

Category	Retention
Account information (name, email, emergency contact)	For the life of your account, then deleted within 30 days of a verified deletion request, except where retained below
Child profiles	Under the parent or guardian’s control: deleted when they delete the profile or the account, and within 30 days of a verified deletion request
Participant details on a booking (including a child’s skill, swim ability, and medical notes)	Retained with the booking record
Signed waivers	7 years from the lesson date, or, where the participant was under 18, until the participant turns 21, whichever is later
Booking and payment records (amounts, fees, refunds, Stripe identifiers)	7 years, for tax, accounting, and dispute purposes
Messages between an account holder and an instructor	Readable by the parties until 7 days after the lesson, then read-only; retained for 2 years for safety and dispute purposes
Instructor profile and uploaded documents	For the life of the instructor account, then 3 years
Google Calendar token and stored busy ranges	Deleted immediately on disconnect or revocation
Internal staff action logs	3 years
Support communications	2 years
Server and security logs	30 days

Where a legal obligation, dispute, or safety investigation requires it, we may keep specific records longer than the periods above.

7. Security

We use administrative, technical, and physical safeguards designed to protect your information: all traffic is encrypted in transit; stored data is encrypted at rest by our hosting provider; Google Calendar tokens are additionally encrypted with a key we control; access to data is controlled by role, and our own staff’s access to sensitive records is logged; and card data goes directly to Stripe and never touches our systems.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you and the relevant authorities as required by law, including under Hawaii’s and Puerto Rico’s breach-notification statutes where they apply.

8. Cookies and similar technologies

The app uses browser storage and cookies only to keep you signed in and to remember basic preferences. These are strictly necessary; blocking them will break sign-in. We do not use analytics, advertising, or tracking cookies in the app.

Our marketing website, catchmorewaves.com, is served by Cloudflare, which processes visitors’ IP addresses and request data to deliver and secure the site. Any analytics we use on the marketing site are Cloudflare’s cookie-free Web Analytics, which do not identify you or track you across sites. We do not run advertising or cross-site tracking on it.

Do Not Track and Global Privacy Control. Because we do not sell or share personal information, there is nothing for these signals to opt you out of. We do not otherwise respond to them.

9. Your rights

Everyone. You can view and edit your account information, emergency contact, child profiles, and (for instructors) your profile and availability in the app. You can turn off reminder and new-message emails in your email settings. You can turn off text messages, or change your mobile number, in your account. To delete your account, or to exercise any other right, email privacy@catchmorewaves.com. We will verify your identity before acting.

California residents (CCPA/CPRA). You have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to opt out of sale or sharing (we do neither); to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. Submit a request at privacy@catchmorewaves.com. An authorized agent may submit a request on your behalf with proof of authorization. If we deny a request, you may ask us to reconsider by replying to our response.

Residents of other US states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others) have similar rights, including the right to appeal a denied request. Contact us the same way.

Hawaii and Puerto Rico. Both are part of the United States, and the protections described in this policy apply to you. Hawaii and Puerto Rico residents may contact us at the same address with any request or question.

Visitors from outside the United States. We offer the service in the United States and do not target it to residents of the European Union, the United Kingdom, or other jurisdictions with their own data-protection regimes. If you use the service while visiting Puerto Rico or Hawaii, your information is processed in the United States as described in Section 10, and you may exercise the rights in this section by contacting us.

10. Where we process information

We are based in the United States and process and store information there, on Google Cloud infrastructure in the central United States and with the providers named in Section 5. If you access the service from outside the US, your information will be transferred to and processed in the US, where privacy laws may differ from those in your country.

11. Third-party links

The service links to Stripe, Google, and instructors’ own pages or profiles we do not control. We are not responsible for their privacy practices; read their policies.

12. Changes

We may update this policy. If the changes are material, we will notify you by email or through the app before they take effect. The “Last updated” date above always reflects the current version. Continuing to use the service after changes take effect means you accept the updated policy.

13. Contact

Email: privacy@catchmorewaves.com (privacy requests) · support@catchmorewaves.com (everything else)