Privacy Policy
Effective Date: August 19, 2026 Last Updated: August 19, 2026
1. Introduction
Golden West Games ("we," "our," or "us") operates Underway, a cloud-based field service and customer management platform built for service businesses — pool table dealers, mechanics, and similar trades. Underway was formerly known as Billiard CRM; you may still see that name on some emails and card statements. Both names refer to the same service and this same policy.
This Privacy Policy explains what information we collect, how we use it, who we share it with, and what rights you have. It applies to:
- Shop owners and their team members (businesses that subscribe to Underway, and the technicians and staff they add)
- End customers (the clients of those shop owners whose information is stored in the platform)
By using Underway, you agree to this policy. If you don't agree, please don't use the service.
Questions? Email us: info@itsunderway.com
2. Information We Collect
2a. Account Information
When you sign up for Underway, we collect:
- Your name and email address
- Your business name, phone number, and address
- Your password (stored as a one-way hash — we never see your plaintext password)
- Your subscription plan, trial status, and billing history (payment card details go directly to Stripe — see Section 2e)
2b. Customer and Client Data You Enter
Underway is a tool you use to manage your own customers. When you use it, you may enter:
- Your customers' names, addresses, phone numbers, and email addresses
- Job records (service work, deliveries, notes, etc.)
- Photos of jobs and installations (stored in Google Cloud Storage). Job photos are stored at full resolution, including any metadata your phone's camera embeds in the file (such as the time and location a photo was taken). That's deliberate: job photos are your business's evidence record of the work, and the embedded time and place are part of what makes them useful. They're private to your store unless you choose to publish one to your public directory listing — anything you publish there is visible to anyone. When you do publish a photo to a public listing, the public copy has its embedded metadata (including location) removed; the full-resolution original, metadata intact, stays private to your store.
- Payment history and invoice records
- Text message conversations with your customers, and logs of calls to your business number (caller number, time, duration, and outcome — we do not record ordinary phone calls)
We are a data processor for this information. You — the shop owner — are the data controller. You are responsible for having a lawful basis to collect and store your customers' information, and for telling them how you use it.
2b-1. Technician Time Clock and Location
If your team uses the built-in time clock, we record each clock-in/clock-out punch. Where the technician's device allows it, a punch also records the GPS location at the moment of the punch (latitude, longitude, and accuracy). We never track location continuously or in the background — the only locations ever recorded are the single point at each punch, and a one-time location when a technician chooses to send an "on my way" ETA to a customer. Location capture is best-effort: if the technician's device denies or can't get a location, the punch still works and we simply record that no location was available. Punch locations are visible to the store's admins. If you are a shop owner using this feature, you are responsible for telling your technicians about it and for complying with any employee-monitoring notice laws in your state.
2b-2. AI Phone Answering (Where Enabled)
Some businesses on Underway use an AI phone agent (powered by Retell) to answer calls. Where enabled, those calls are processed by Retell and may be recorded and transcribed to capture the caller's request (for example, name, phone number, and what they need) and deliver it to the business. The AI agent's greeting tells the caller they're talking to an automated assistant and that the call may be recorded.
2c. Usage Data
We automatically collect certain technical data when you use the app:
- Pages and features you interact with
- Browser type, operating system, and device type
- IP address
- Error reports and crash logs (via Sentry)
- Timestamps of actions
2d. Cookies and Similar Technologies
We use the following technologies to keep you signed in and protect against abuse:
| Technology | Purpose | Retention |
|---|---|---|
| NextAuth session cookie | Keeps you logged in | Session / 30 days |
| Upstash KV | Rate limiting to prevent abuse | Ephemeral |
| Sentry session replay (if enabled) | Helps us debug errors | 90 days |
We do not use third-party advertising cookies or tracking pixels.
2e. Payment Information
Payments are processed by Stripe. When you enter payment card information, it goes directly to Stripe's servers — we never see, store, or have access to your full card number, CVV, or expiration date. We receive only a Stripe token and limited metadata (last four digits, card brand, expiration month/year).
If you use Stripe Connect to process payments for your own customers, the same principle applies: your customers' card data goes directly to Stripe.
3. How We Use Your Information
We use the information we collect to:
- Deliver the service — run the CRM, store your data, and make it accessible to you
- Send transactional communications — account confirmations, password resets, invoices, and service notifications (via Resend for email, Twilio for SMS)
- Prevent fraud and abuse — detect suspicious activity, enforce rate limits, and protect user accounts
- Improve the product — analyze aggregate usage patterns to understand which features are used and where users run into problems
- Comply with legal obligations — respond to lawful requests from government authorities, retain records as required by law
We do NOT sell your personal information to anyone, for any purpose.
We do NOT use your data or your customers' data to train AI models.
4. Who We Share Your Information With
We share information only with the vendors needed to operate the service. We have data processing agreements in place with each vendor. We do not sell data to third parties.
| Vendor | What they receive | Their privacy policy |
|---|---|---|
| Stripe | Payment processing; subscription billing; Stripe Connect for merchant payouts | stripe.com/privacy |
| Twilio | SMS sending and receipt (opt-in confirmations, job notifications, STOP/HELP handling) | twilio.com/legal/privacy |
| Resend | Transactional email delivery (account emails, invoices) | resend.com/legal/privacy-policy |
| Supabase | PostgreSQL database hosting; data is encrypted at rest | supabase.com/privacy |
| Vercel | Application hosting and serverless function execution | vercel.com/legal/privacy-policy |
| Google Cloud Storage | Storage of job photos and uploaded files | cloud.google.com/terms/cloud-privacy-notice |
| Sentry | Error monitoring and crash reporting; may include stack traces and session data | sentry.io/privacy/ |
| Upstash | Redis-based rate limiting; ephemeral request metadata only | upstash.com/privacy |
| Google Maps Platform | Address autocomplete, geocoding, and maps (address text only — no names or phone numbers) | policies.google.com/privacy |
| Retell | AI phone answering for businesses that enable it; call audio, recordings, and transcripts | retellai.com/privacy |
Optional integrations you connect yourself. If you connect your own QuickBooks Online or Shopify account to Underway, data flows between Underway and that account under your own agreement with Intuit or Shopify. We access only what's needed to run the integration you turned on, and disconnecting it stops the flow.
We may also disclose information:
- To comply with law — in response to a court order, subpoena, or other lawful request
- To protect safety — if we believe disclosure is necessary to prevent harm to you or others
- In a business transfer — if Golden West Games is acquired or merges, your information may transfer to the new owner, who will be bound by this policy
5. Data Retention
We keep your data only as long as necessary. Here's how long we retain different types of data:
| Data Type | Retention Period |
|---|---|
| Account data (name, email, settings) | While your account is active + 30 days after deletion request, then permanently deleted |
| Customer and job records you entered | Same as account data — deleted with your account |
| Payment records and invoices | 7 years from transaction date (IRS record-keeping requirement) |
| Error logs (Sentry) | 90 days |
| Application logs (server logs) | 90 days |
| Database backups | 30 days, then automatically purged |
Account deletion: You can delete your account at any time from Settings → Account. This starts a 30-day grace period during which you can cancel the deletion. After 30 days, your account and all associated data are permanently and irreversibly deleted, except for payment records retained for legal compliance.
6. Your Privacy Rights
6a. Rights for All Users
Regardless of where you live, you have the right to:
- Access — request a copy of the personal information we hold about you
- Correction — ask us to fix inaccurate or incomplete information
- Deletion — request that we delete your account and data (see Section 5 for retention exceptions)
To exercise these rights, go to Settings → Account inside the app, or email info@itsunderway.com.
6b. California Residents — CCPA/CPRA Rights
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
- Right to Know — the categories and specific pieces of personal information we've collected about you in the past 12 months, including the sources, business purpose, and third parties with whom it was shared
- Right to Delete — request deletion of your personal information, subject to certain exceptions (legal retention requirements, active transactions, etc.)
- Right to Correct — request that we correct inaccurate personal information
- Right to Opt Out of Sale or Sharing — we do not sell or share your personal information for cross-context behavioral advertising, but you may still submit a request via our Do Not Sell or Share My Personal Information page or by emailing info@itsunderway.com
- Right to Limit Use of Sensitive Personal Information — we do not use sensitive personal information (as defined under CPRA) for purposes beyond delivering the service
- Right to Non-Discrimination — we will not discriminate against you for exercising any of these rights
How to exercise your California rights:
- Email info@itsunderway.com with "California Privacy Request" in the subject line
- Visit our Do Not Sell or Share My Personal Information page
We will respond to verified requests within 45 days. We may extend this by an additional 45 days when necessary, with notice.
6c. SMS Communications
Whether you're a subscriber getting account texts from Underway or a shop's customer getting texts from your local shop through Underway:
- Reply STOP at any time to stop all SMS messages to your number. This works immediately and applies across every business that texts you through the platform.
- Reply HELP for help or contact information.
- Reply START to opt back in.
- Message and data rates may apply. Message frequency varies with your service activity (typically a few messages per appointment or job).
Opting out of SMS will not affect your ability to use the service or to do business with your shop. Full details are in our SMS & Messaging Policy.
6d. Email Communications
- Transactional emails (account confirmations, password resets, invoices) are required for the service to function. You cannot opt out of these while your account is active.
- Non-essential emails (product announcements, tips) include an unsubscribe link. Click it at any time to stop receiving them.
7. CCPA Categories of Personal Information — 12-Month Disclosure
The following table discloses, for the 12-month period preceding the effective date of this policy, the categories of personal information we collected, the sources, our business purpose for collecting it, and the third parties with whom it was shared.
| CCPA Category | Examples Collected | Source | Business Purpose | Shared With |
|---|---|---|---|---|
| Identifiers | Name, email, IP address, user ID | Directly from you; automatically | Service delivery, authentication, fraud prevention | Supabase, Vercel, Sentry, Resend |
| Customer records (Cal. Civ. Code § 1798.80) | Business name, phone, address | Directly from you | Service delivery | Supabase, Vercel |
| Commercial information | Subscription plan, billing history | Directly from you; Stripe | Billing, legal compliance | Stripe |
| Internet/electronic activity | Pages visited, features used, error events | Automatically | Product improvement, debugging | Sentry, Vercel |
| Geolocation data | Approximate location via IP address; precise GPS location of technician time-clock punches (only at clock-in/out, only where the device allows it — see Section 2b-1) | Automatically; from the technician's device at punch time | Fraud prevention, rate limiting; timekeeping records for the employer | Upstash, Vercel; Supabase (punch locations) |
| Audio/visual information | Job photos you upload; AI phone agent call recordings and transcripts (where enabled) | Directly from you; from callers | Service delivery | Google Cloud Storage; Retell |
| Professional/employment info | Business name, role | Directly from you | Service delivery | Supabase |
| Inferences | Usage patterns | Derived internally | Product improvement | None |
Categories NOT collected: Social Security numbers, driver's license numbers, financial account numbers, biometric data, health or medical information, racial or ethnic origin, religious beliefs, union membership, genetic data. We do not track anyone's location continuously — the only precise location we ever record is the single GPS point attached to a time-clock punch, as described above.
We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
8. Children's Privacy
Underway is not directed at children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you are under 13, please do not use this service or provide any information to us.
If we learn that we have collected personal information from a child under 13, we will delete that information promptly. If you believe we may have information from or about a child under 13, please contact us at info@itsunderway.com.
9. Security
We take reasonable measures to protect your information, including:
- Encryption in transit — all data transmitted between your browser and our servers uses TLS (HTTPS)
- Encryption at rest — your data stored in Supabase (PostgreSQL) and Google Cloud Storage is encrypted at rest using industry-standard AES-256 encryption managed by those providers
- Payment security — Stripe handles all card data. We operate under PCI DSS SAQ-A scope, meaning card data never touches our servers
- Access controls — role-based access control (RBAC) limits who in your organization can see what data
- Rate limiting — Upstash-backed rate limiting protects against brute-force and credential-stuffing attacks
- Error monitoring — Sentry monitors for anomalies and errors that could indicate security issues
Important limitation: No security measure is perfect or impenetrable. We cannot guarantee that our security measures will prevent every possible breach. If a breach occurs that affects your rights or freedoms, we will notify you as required by applicable law.
10. International Users
Underway is currently operated from the United States and is intended for US-based businesses. Our servers and service providers are located in the United States. If you are accessing the service from outside the United States, your information will be transferred to and processed in the United States.
We are not currently subject to GDPR because we do not actively target users in the European Economic Area. If we expand internationally, we will update this policy and obtain the appropriate legal basis for data processing under GDPR before doing so.
If you are an EU/EEA resident who has nonetheless signed up for the service, we will honor your access, correction, and deletion rights on a best-effort basis and encourage you to contact us at info@itsunderway.com.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Send an email notice to the address on your account at least 14 days before the change takes effect
- Display a prominent notice inside the Underway app
If you continue to use Underway after the updated policy takes effect, you accept the updated terms. If you don't agree with the changes, you may delete your account before the effective date.
The "Last Updated" date at the top of this page always reflects the most recent revision.
12. Contact Us
If you have questions, concerns, or requests related to this Privacy Policy or how we handle your data, please contact us:
Golden West Games 3916 100th St SW, Lakewood, WA 98499 Email: info@itsunderway.com
For California residents: you may also submit requests via the Do Not Sell or Share My Personal Information page.
This document is a draft prepared for attorney review. It does not constitute legal advice and should not be relied upon as such until reviewed and approved by a licensed attorney.