Privacy Policy

Last updated 15 August 2026

Who we are

Surf Shack at Polaris Pointe operates the indoor FlowRider, volleyball courts, spa and food and drink service at 13208 Touchstone View, Colorado Springs, CO 80921, and this website. In this policy “we” and “us” mean Surf Shack, and “you” means anyone who visits the site, books with us, or comes to the venue.

If you would rather talk to a person about any of this, info@surfshackcos.com reaches us directly.

What we collect

We only collect what the thing you are doing actually requires. In practice that is:

• Account details — name, email address, phone number, and a password you set. If you add riders to a family account, their names and dates of birth as well, because sessions are age-restricted.
• Booking details — which sessions you reserved, when, for how many riders, and whether you turned up.
• Purchases — what you bought online or at the counter, passes issued to you, sessions drawn down against them, and reward points earned and redeemed.
• Waivers — the signed liability waiver for each rider, including the signature and the date, and for a minor the name of the parent or guardian who signed it.
• Job applications — anything you send us when you apply for a role, including a résumé if you attach one.
• Technical information — the pages you visit here, your approximate location from your IP address, and your browser and device type.

We do not store your card number. See payments below.

Where it comes from

Most of it comes directly from you. Some of it is generated as you use the site or the venue — a check-in recorded by a member of staff on the front-desk tablet, a session deducted from a pass, points added to a reward balance. Some comes from our payment processor, which tells us that a payment succeeded and the last four digits of the card, so we can match a purchase to your account.

How we use it

• To take and hold your booking, and to know who is riding in each session.
• To sell you a pass, a session, a class or a meal, and to keep an accurate balance of what you have left.
• To run the rewards programme, including pooling points across the riders on one family account — points on a family account are shared and cannot be separated by rider.
• To meet our safety obligations, which is why a waiver has to exist for every rider before they get on the wave.
• To send you things you asked for: confirmations, receipts, reminders and changes to your booking.
• To send you marketing, but only if you opted in, and only until you opt out.
• To understand how the site is used so we can fix what is broken.

Payments

Card payments are handled by our payment processors — Clover for in-person sales, and our online checkout provider for anything bought through this site. Your card details go to them, not to us. We never see or store a full card number, and we could not retrieve one if you asked us to.

Who we share it with

We do not sell your personal information, and we do not share it for anyone else’s advertising. We do pass it to a small number of companies that run parts of the service for us, and only the part each one needs:

• Our payment processors, to take payment.
• Our electronic-signature provider, to collect and store waivers.
• Our email and text-message providers, to deliver confirmations and reminders.
• Our website host and analytics provider.

We will also disclose information where the law requires it, or where we need to in order to establish or defend a legal claim — for example, an injury claim arising from a session.

Marketing and messages

Transactional messages — a booking confirmation, a receipt, a notice that a session has been cancelled — are part of the service, and you cannot opt out of those while you have an active booking.

Marketing email and texts are separate and are opt-in. Every marketing email has an unsubscribe link; replying STOP to a marketing text stops the texts. Neither affects your bookings.

Cookies and analytics

This site uses cookies to keep you signed in, to remember what is in your cart, and to measure how the site is used. You can block or delete cookies in your browser settings, but the booking flow and your account will not work properly without the ones that keep you signed in.

How long we keep it

• Account and booking records — while your account is open, and for a reasonable period afterwards so we can answer questions about past visits.
• Waivers — longer, because they are the record that protects both of us if an injury claim is made later. For a waiver signed on behalf of a minor, that period runs from when they turn eighteen.
• Purchase and tax records — for as long as tax and accounting law requires.
• Job applications — for the hiring round you applied in, unless you ask us to keep you on file.

Your rights

Under the Colorado Privacy Act, if you are a Colorado resident you can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct anything that is wrong;
• delete it, subject to the retention periods above — we cannot delete a waiver or a tax record on request;
• give you your data in a portable format;
• opt out of targeted advertising, the sale of personal data, and profiling. We do none of these, so there is nothing to opt out of, but the right exists and you can exercise it.

Email info@surfshackcos.com and we will respond within the time the law allows. We may need to confirm who you are first — not to make it difficult, but because handing an account’s history to the wrong person is the worse failure. If we turn a request down you can ask us to reconsider.

Children

Children ride here, and we welcome that. Accounts, though, are for adults: an account must be created by a parent or guardian, who adds each child as a rider and signs their waiver. We do not knowingly let anyone under 13 create their own account or give us their information directly. If you believe a child has given us information without a parent’s involvement, contact us and we will remove it.

Security

The site runs over HTTPS, staff access is limited to the people whose job needs it, and card details never reach our systems. No system is perfect, and we would rather say that plainly than promise otherwise. If something does go wrong and it affects you, we will tell you.

Changes to this policy

If we change how we handle your information we will update this page and change the date at the top. If the change is significant, we will tell you directly rather than rely on you noticing.