Privacy policy

Draft. This text is a working draft pending review by counsel. It has not been approved by an attorney.

Eight Flags Surf Supply is a surf shop on Amelia Island, Florida, run by 8 Flags Surf Supply LLC (7901 4th St N, Ste 300, St. Petersburg, FL 33702), which is responsible for what this page describes. This page explains what we collect, why, and what we do with it. We are a small shop, not an advertising business: we collect what we need to hand you a board and get it back, and nothing we can sell.

What we collect

When you reserve a board we collect your name, phone number and, if you give one, your email address, along with the board, dates and pickup point you chose. We use the phone number to reach you about that booking, including by text — see text messages below.

When you pay online the payment is taken by Stripe on its own checkout page. We never see or store your full card number. When a rental keeps the card on file, Stripe holds the card and we keep only a reference to it, which we use only as the terms describe, for loss of or damage to the board.

When you sign a rental waiver we additionally record the name you signed, your signature (drawn, or your typed name), the date and time, the version of the waiver you agreed to, the IP address the signature was sent from, and your browser’s user-agent string. Those last two exist so the shop can show later that a particular signature was really made at a particular time. If you sign as the parent or guardian of a rider under 18, we record that, and the rider’s name.

When you ask for a repair quote or ask us to hold a board we collect your contact details, what you told us about the board, and any photograph you upload or text us. A photo you upload is shrunk and re-saved on your own device before it is sent, which also removes the hidden details a phone camera writes into a picture, such as where it was taken.

When you join the mailing list we keep your email address and, as the record that you asked to join, when you signed up, the page you signed up on and the IP address the request came from. We do not track whether you open our emails or click their links. If an address bounces, or its owner marks one of our emails as spam, Amazon tells us and we stop writing to it.

When you simply browse our servers write short-lived technical logs: the pages requested, timings, error details and a request identifier. We do not run analytics or advertising trackers, and we do not sell or share anything with data brokers. Browsing the site sends nothing to any other company: our fonts are served from our own site, and the map on the visit page loads from Google only if you press “Show map”.

Text messages

We text you only about something you asked us for: a link to sign your rental waiver, confirmation and reminders for a booking, and a message when a repaired board is ready. A number given for a booking or a repair is never sent marketing. Shop-news texts(opening day, new boards, good swell; a few a month at most) go only to a number whose owner ticked the separate box asking for themand then replied NEWS to the one text we send to confirm. We record when the box was ticked, from which page and IP address, the exact wording shown, and when the confirmation came back. We never sell, rent or share a phone number with anyone for their own marketing.

Texts are sent through Amazon Web Services, which passes them to your mobile carrier to deliver. Delivering a message necessarily means the number and the message reach those companies. If you reply STOP, that opt-out is recorded both by us and at AWS, so it survives even if somebody later re-enters your number by hand — which means we keep a record of the number in order to keep not texting it.

The mailing list for shop news is a separate thing entirely: it is email, you sign up for it yourself (with or without the shop-news texts), and nobody is added to it because they rented a board. Every one of those messages carries an unsubscribe link, and unsubscribing from it has no effect on the booking and repair texts described above, or the other way round.

Phone alerts

If you turn on alerts at /alerts, we keep your name, the mobile number or email you give us, and an address your phone’s browser creates so we can reach it (issued by Apple, Google or Mozilla, depending on your phone). We use these only to send you the alerts you asked for and to know who they are going to. We never text that number, and turning on alerts does not add you to the email list. If you ask us to tell you when something is back, we also keep which item you asked about, and delete that once we’ve told you.

Alerts are delivered through your phone’s push service, which sees only an encrypted message. Turn them off on the same page, or ask us, and we delete the record. We also delete it ourselves when your phone tells us alerts are no longer allowed.

Photographs and automated processing

Photographs of boards taken by shop staff are processed automatically to make them usable on the site. A photograph may be sent to Google (Gemini) to remove its background, and to Anthropic (Claude) to read the brand and model off the board. These services process the image to return a result to us. This applies to pictures of surfboards, not to pictures of people; do not send us a photograph of a person for a repair quote.

Photographs you upload for a repair quote are not sent to either service. They are stored with our website’s images at an address nobody can guess, and are shown to shop staff with your ticket.

Automated suggestions are always reviewed by a person before they appear on a listing, and nothing about you is decided by a machine.

How long we keep it

• Signed waivers are kept for as long as a claim could be brought, and at minimum for four years after the rental. This is the one record we deliberately do not delete quickly.
• Bookings and repair tickets are kept while the shop needs them for tax, accounting and warranty purposes.
• Repair photos you upload are kept for as long as the repair ticket they belong to. Ask us and we will delete them sooner. The link that lets you add them stops working after 48 hours.
• Technical and diagnostic logs are deleted automatically after 90 days.
• Your mailing list address is kept while you are subscribed. Unsubscribing stops the emails at once.
• A number signed up for shop-news texts, and the record of that consent, is kept while you are signed up. Replying STOP stops the texts at once.
• A record that you opted out of texts or unsubscribed from the mailing list is kept indefinitely, because it is the only thing that stops you being contacted again by mistake.

Who else sees it

The site runs on Amazon Web Services and its database is hosted by Supabase, both in the United States. Board photographs are processed by Google and Anthropic as described above. Online payments, and a card kept on file for a rental, are handled by Stripe. If you choose to load the map on the visit page, Google receives your IP address and may set its own cookies, under Google’s privacy policy. Email reaches us through Google Workspace, and the shop news mailing list and our text messages are both sent through Amazon Web Services; a text is then handed to your mobile carrier to deliver. Each of those companies processes data on our instructions in order to run the service. Beyond that we disclose information only when the law requires it, or when it is necessary to establish or defend a legal claim, which is what a waiver is for.

Cookies

This section is our whole cookie policy, because there is very little to say. Browsing the public site sets no cookies at all— no analytics, no advertising, no tracking — and stores nothing in your browser. That is why there is no cookie banner: there is nothing to ask you to accept.

• Staff sign-in. Shop staff signing in to the admin console get a session cookie, which is strictly necessary for signing in and is never set for customers.
• The map, if you load it. The map on the visit page is Google’s. It loads only when you press “Show map”, and from then on Google may set its own cookies under its own policy. If you would rather it did not, use the address or the “Open in Google Maps” link instead.
• Paying. Stripe’s checkout page, which you reach only when you choose to pay, sets the cookies Stripe needs to process the payment and prevent fraud.

If we ever add anything that is not strictly necessary, we will ask first and update this section before it goes live.

Your choices

Ask us and we will tell you what we hold about you, correct it, or delete it. We cannot delete a signed waiver that still covers a rental within the period a claim could be brought, because that document is the reason it exists. Depending on where you live you may have further rights, including under the Florida Digital Bill of Rights; ask and we will honour whatever applies.

Children

The site is not aimed at children, and we do not knowingly collect information from anyone under 13. A rider under 18 rents on a waiver signed by their parent or guardian.

Changes

If this policy changes we will update the date at the top. A change to the waiver itself gets a new version number, and the version you signed is recorded against your signature.

Contact

Email waves@8flagssurfsupply.com or call (910) 650-3041. Our rental and shop terms are on the terms page.