Privacy Policy

Cascade Ski Club — Government Camp, Oregon

DRAFT — This document has not yet been adopted by the club board and is provided for review purposes only.

1. Who We Are

Cascade Ski Club ("the Club", "we", "us") is a member-run club operating a lodge in Government Camp, Oregon. This policy describes what personal information we collect through our website and booking system, how we use it, and the choices you have.

2. Information We Collect

Account information — name, email address, phone number, date of birth, and password (stored only in hashed form).
Family member profiles — names, dates of birth, and phone numbers of family members, including children, entered by the primary account holder.
Guest information — names and ages of guests you register on a booking.
Membership and booking records — membership type and status, bookings, room assignments, and stay dates.
Payment records — invoices, payment amounts and dates, refund history, and your member wallet balance. We do not store your card number — card payments are processed by Stripe (see Section 4).
Profile photo — optional, if you choose to upload one.
Messages — anything you send through the contact form or maintenance report form.
Technical data — session cookies and standard web server logs (including IP address) kept for security and troubleshooting.

3. How We Use Your Information

To manage memberships, subscriptions, and invoicing.
To take, manage, and confirm lodge bookings, including knowing who is staying at the lodge on a given night (a safety requirement).
To process payments and refunds and maintain the financial records the Club is required to keep.
To send you service emails and in-app notifications about your bookings, invoices, membership status, and Club news. These are operational messages, not marketing.
To respond to your inquiries and maintenance reports.
To keep the website secure and diagnose problems.

We do not sell personal information or use it for third-party advertising.

4. Payment Processing (Stripe)

Card payments are handled by Stripe. Your card details are sent directly to Stripe and never touch the Club's servers; we receive only a payment confirmation and a reference identifier. Stripe's own privacy policy applies to the information it processes.

5. Children's Information

Profiles for children are created and managed by a parent or guardian, not by the child. We use children's information (name, date of birth) only for membership records, appropriate pricing, and knowing who is staying at the lodge. Children's profiles cannot log in and have no direct access to the system.

6. Sharing

We share personal information only with:

Service providers that operate the system on our behalf — Stripe for payments and our email provider for sending notifications.
Club administrators with role-limited access who manage bookings, memberships, and finances.
Authorities, when required by law.

7. Cookies

We use only essential cookies: a session cookie to keep you logged in and a CSRF cookie to protect forms. We do not use advertising or cross-site tracking cookies, so no cookie consent banner is required.

8. Retention

We keep account and profile information while your membership is active. Financial records (invoices, payments, refunds) are retained as required for the Club's accounting and audit obligations, even after a membership ends. Web server logs are rotated on a fixed schedule.

9. Security

The site is served over HTTPS. Passwords are stored hashed, administrative access is role-restricted, and payment card data is handled entirely by Stripe. No system is perfectly secure, but we take reasonable measures appropriate to a member organization of our size.

10. Your Choices

You can view and update your own and your family members' profile information from your dashboard.
You may ask us to correct or delete personal information by contacting us. Deletion is subject to the financial record-keeping obligations in Section 8.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be posted on this page and, where appropriate, announced to members.

12. Contact

Questions or requests about your information? Reach us through the Contact Us page.

Effective date: to be set upon board adoption.