Legal
Privacy Policy
UPA Hillsborough ("we," "us," "our") is an independently owned and operated League Operator licensed by the United States Professional Poolplayers Association ("UPA National"). This policy explains what personal information we collect through upahillsborough.com, how we use it, and your choices. Questions: upa_hills@yahoo.com.
1. Information we collect
Information you give us (through the membership application, and through the registration form on an event page):
- Identity & contact: name, email address, mobile phone number, home ZIP code and city, and a mailing address. For an applicant under 18, that mailing address is the parent or legal guardian's, not the child's — see Youth players below.
- Age: date of birth (players of all ages are welcome; some host venues have 18+ or 21+ limits).
- Parent or guardian details, when the applicant is under 18: the parent or legal guardian's name, email address and mailing address, and their consent — see Youth players below.
- Play details: self-rated skill/Speed, a rating from another pool league or system if you have one (and how many years you've played), preferred games, preferred competition types, preferred venues and days to play, team status.
- Preferences & consent: your email and text-message (SMS) opt-in choices, and how you heard about us.
- Anything else you send us (e.g., messages or support requests).
Payment information: membership dues are currently collected in person (Venmo, Zelle or Cash) at league venues. We record the amount, date, and method of your payment. We do not collect card numbers or bank details through this website. If you pay via Venmo or Zelle, those services handle that transaction under their own terms and privacy policies.
Consent records: when you submit the application, we record your consent choices along with the date, time, IP address, and the version of this policy and our Terms in effect at that moment (shown at the top of each page), so we can honor your preferences, show what you actually agreed to, and comply with email/SMS laws.
Information collected automatically: IP address, browser and device information (your browser's user-agent string), the page that referred you, and referral/campaign information — including UTM tags from links or QR-code flyers. See Cookies below.
Printed-flyer QR codes: our printed flyers carry a short link. Scanning one records that scan — the flyer's campaign tags, the referring page, and your browser's user-agent string — before sending you on to the page the flyer advertises, so we can tell which flyers are working. Those scan records carry no name, email, or other detail that identifies you.
Bot protection: the membership application, the registration form on an event page, and the admin password-reset form are protected by Cloudflare Turnstile. When you submit any of them, your IP address and a one-time challenge token are sent to Cloudflare so it can confirm the submission came from a person and not an automated script. See How we share your information below.
2. How we use your information
- Process and manage your membership and application.
- Mail you a membership card or other league correspondence, using the mailing address you gave us. Your ZIP code is what we use to match you to a nearby venue — the mailing address is not needed for that, only for mail.
- Operate the league — scheduling, events, divisions, standings, and communications.
- Send transactional messages (application confirmations, receipts, membership/renewal notices).
- Send league news or marketing only if you opted in.
- Record payments and prevent fraud.
- Confirm that a form submission came from a person rather than an automated script.
- Understand which flyers, links, and campaigns bring players to the site.
- Maintain, secure, and improve the website.
- Comply with legal obligations and enforce our terms.
3. How we share your information
We do not sell your personal information, and we do not share it for third-party advertising. We share it only as follows:
- Service providers who help us run the site and league: Supabase (secure database/hosting), Resend (email delivery, including the delivery reporting described below), Netlify (website hosting), and Cloudflare (Turnstile bot protection — your IP address and a challenge token are sent to Cloudflare when you submit the membership application, an event registration, or the admin password-reset form).
- UPA National: we share membership and play information for league sanctioning, national rankings/records, and the national player dashboard.
- Legal & safety: when required by law, or to protect the rights, property, or safety of the league, our members, or others.
- Business transfer: if the league is transferred to a new operator, member information may transfer with it, subject to this policy.
4. Marketing & communications
- Transactional messages (receipts, confirmations, important membership notices) are part of your membership and are always sent.
- Marketing emails are sent only with your consent; every one includes a one-click unsubscribe link, which we honor promptly.
- Text messages (SMS): sent only if you opt in; standard message/data rates may apply, and you can reply STOP at any time. Consent to texts is never required to join.
- Delivery reporting on marketing email: for each marketing message we record the delivery events our email provider (Resend) reports back to us — whether it was sent, delivered, opened, bounced, or reported as spam — against your address. Open reporting relies on a small image loaded when the message is displayed, so blocking remote images in your mail client prevents it. We use this to keep the list accurate and to stop mailing addresses that bounce or complain; a complaint is treated as an immediate opt-out. Transactional messages are not tracked this way.
5. Data retention & deleting your information
How long we keep it: until it is asked for back. We keep your information until you ask us to remove it, or until the league removes it itself (for example, clearing out an obvious spam application). There is no automatic expiry — no scheduled purge, and no point at which a member or applicant record deletes itself. We would rather tell you that plainly than name a number we do not actually enforce.
How to ask. Email upa_hills@yahoo.com and say you want your information deleted. Include the email address or phone number you applied with, so we can find the right record. You do not have to give a reason.
What we remove. Your name, email address, phone number, date of birth, ZIP code, city and mailing address, any rating or years-playing detail from another league you gave us, the parent or guardian name, email address and mailing address if we hold them, and the IP address, browser user-agent, and consent snapshot recorded when you applied. That covers your membership application, your details on any event registration, and the delivery record kept against any marketing email we sent you (the send and bounce dates stay, without your address). If you are on a team roster, we take you off it. Asking us to delete your information ends your league membership, and we cannot undo it afterwards.
What survives, and why. If you ever paid dues, that payment stays in the league's books as an amount, a date, and how it was paid — with your name and contact details no longer attached to it. It is an accounting and tax record of money the league took in, not a record about you, and the empty membership row it hangs from is kept purely so the books still add up. We also keep a dated administrative note that a deletion was carried out; it records what was removed but names nobody, and our internal log clears it after 24 months.
Older entries in that same log are a separate matter, and we would rather be exact about them than let the paragraph above imply more than it should. We keep an internal record of actions our staff took — placing someone on a team, editing a record, importing a roster — and some of those entries include your name. That log is append-only: entries cannot be edited or removed by anyone, including us, which is what makes it a trustworthy account of who did what and when. Those entries are not rewritten when we carry out a deletion; they clear on the same 24-month schedule as everything else in the log.
Two smaller things also stay. The IP address and browser details recorded against an event registration belong to that registration, which may cover several people, so they are not removed with one person’s details — this is distinct from the application-time record described above, which is. And a second application filed under the same email address but never linked to your member record is not found by the deletion; ask us for it separately. Printed-flyer QR scans (section 1) are never tied to a person in the first place, so there is nothing in them to remove.
6. Your rights & choices
You may request a copy of the personal information we hold about you, ask us to correct or update it, ask us to delete it (section 5 sets out exactly what that removes, and what it does not), and opt out of marketing email (unsubscribe link) or SMS (reply STOP) at any time. To make a request, email upa_hills@yahoo.com. We will respond within a reasonable time and as required by applicable law.
7. Security
We use reasonable safeguards to protect your information, including encryption in transit, access controls, and database-level security rules. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.
8. Youth players & children's privacy
UPA Hillsborough welcomes players of all ages and does not set a minimum age. Some host venues have their own age limits (e.g., 18+ or 21+ bars), and we'll match a player to a venue that fits.
When the date of birth on a membership application shows the applicant is under 18, the form will not accept that application without a parent or legal guardian's name and email address and a ticked box confirming that person consents to the minor's participation. We want to be plain about what that does and does not do: those details are typed in by whoever is filling out the form, and we do not separately verify them or write to the guardian's address to confirm before the application is processed. It is a recorded consent, not a verified one.
The mailing address on a minor's application is the parent or legal guardian's, not the child's. The form has no minimum age, so we ask for the mailing address of the adult who is already giving consent and contact information on the same submission, rather than a home address for the minor themselves.
Apart from those guardian details, a minor's application is collected, used, shared, and kept exactly as described in the rest of this policy — including how long we keep it, which is until somebody asks us to remove it (section 5). If you are a parent or legal guardian and a child's information was submitted to us without your consent — or you simply want it removed — email upa_hills@yahoo.com and we will delete it, exactly as section 5 describes. You do not need to be the person who filled the form in.
9. Cookies & tracking
We use essential cookies needed for the site and admin login to function, including any cookie Cloudflare's Turnstile check sets while confirming a form submission came from a person. If your membership application or event registration is rejected for a validation error, we also set one short-lived cookie holding what you typed, so the form can refill itself instead of making you start over; it is deleted as soon as the page reads it, and expires on its own within two minutes either way. We do not run third-party analytics, advertising, or cross-site tracking cookies on this site. You can control cookies through your browser settings; disabling essential cookies may affect site functionality. Open and delivery reporting on marketing email is described in section 4 — that happens in the message, not through a cookie.
10. Third-party links
Our site links to third-party sites (e.g., the UPA national dashboard at upatour.me, and social media). Their privacy practices are governed by their own policies, not this one.
11. Changes to this policy
We may update this policy from time to time. We will post the new version here with a new effective date at the top — that date is the version identifier, and it is what we record against a consent — so you can always tell which text was in force when you applied. Material changes may be communicated by email.
12. Contact us
UPA Hillsborough · Hillsborough County, Florida · upa_hills@yahoo.com