Legal
What a district is asked to sign, and what Altus Sport commits to in return.
Draft for review by counsel. Not executed until signed by both parties.
Version 1.0 · 1 September 2026
This Agreement is between Sharp Ventures, LLC, of Edmond, Oklahoma, United States ("Provider"), which operates the Altus Sport application ("the Service"), and the school, district or educational institution identified in the signature block below ("School").
It governs Student Data that reaches the Service because the School uses it for its golf programme. Where this Agreement and Provider's general Privacy Policy or Terms of Service disagree about Student Data, this Agreement controls.
The School uses Altus Sport to run a golf programme: rosters, schedules, scoring, statistics, and communication between coaches, players and their parents or guardians. To do that, information about students reaches Provider's systems.
Provider acts on the School's behalf with respect to that information. Provider does not acquire rights to it by processing it.
Student Data — information relating to an identifiable student that reaches the Service through the School's use of it. Includes education records under FERPA where FERPA applies.
Student Generated Content — material a student creates in the Service: scores, shot records, messages, and a profile photograph.
Provider Data — aggregated or de-identified information that cannot reasonably be used to identify a student, and Provider's own operational logs which contain no Student Data.
Sub-processor — a third party Provider uses to deliver the Service, listed in Exhibit B.
Student Data belongs to the School, the student, or the parent or guardian, as applicable law provides. It does not belong to Provider. Provider receives only the rights necessary to provide, secure, support and troubleshoot the Service, and acquires no ownership of Student Data by processing it.
Provider retains all rights in its own software, source code, platform architecture, documentation, trademarks, interfaces, algorithms, statistical methodology and know-how ("Provider IP"). Nothing in this Agreement transfers Provider IP to the School. This is stated because the distinction is easy to lose: the School owns the data, Provider owns the tool that processes it.
Provider will use Student Data only to provide and support the Service for the School, and for no other purpose. Specifically, Provider will not:
Provider may use Provider Data to operate, secure and improve the Service.
Exhibit A is the data element schedule. Two characteristics are worth stating in the body of this Agreement because they are unusual and material:
Precise location is collected only during an active round, only on the device recording it, never in the background, and the coordinates are deleted automatically 30 days after the round is completed by a scheduled job. Statistics derived from them — distances, strokes gained — are retained, because they are no longer location data.
A student's profile photograph is not visible to anyone until that student's parent or guardian approves it. Photographs are held in private storage, served only through short-lived expiring links, and stripped of embedded location metadata before upload. Replacing a photograph re-enters review.
The Service is not directed to children under 13 and Provider does not knowingly create accounts for them. Eligibility is derived from graduation year; no date of birth is collected, and a refused sign-up is not recorded.
If the School intends to enrol students under 13, it must tell Provider before doing so. That changes Provider's obligations under COPPA and this Agreement would need to be amended first.
Requests to access, correct or delete Student Data may be made to the School, which may direct them to Provider, or directly to Provider at the address in Section 14.
Most of these are exercisable in the application without contacting anyone: a user may view and correct their own profile, delete their account and its associated data, and withdraw access previously granted to an outside adult. A parent or guardian may exercise all of these for their child, and may approve, refuse or delete their child's profile photograph without going through them.
Data portability. A coach may export the team's season — rounds, hole-by-hole scores, and roster — as spreadsheet files from within the application, at any time and without contacting Provider.
Provider will respond to a request it receives directly within 30 days.
Provider maintains the following, which are properties of the system rather than statements of intent:
Provider has not undergone a third-party security audit or penetration test. This is stated plainly rather than omitted. Provider will notify the School if that changes.
Provider will notify the School of any unauthorised access to, or disclosure of, Student Data without unreasonable delay and no later than 72 hours after Provider confirms it has occurred.
The notice will describe what happened, which categories of Student Data and approximately how many students were involved, what Provider has done, and what Provider recommends the School do. Provider will cooperate with the School's own notification obligations and will not require the School to bear Provider's costs of investigation.
Provider will not make a public statement identifying the School without the School's agreement, unless law requires it.
Provider uses the Sub-processors in Exhibit B. Each is bound to protections no less protective than this Agreement.
Provider will give the School 30 days' notice before adding or replacing a Sub-processor that will process Student Data. If the School objects on reasonable data-protection grounds and Provider cannot accommodate it, the School may terminate under Section 11 with no penalty.
All Student Data is stored in the United States.
Provider retains Student Data while the School's use of the Service continues, subject to the automatic deletion in Section 4.
On termination, or on the School's written request at any time, Provider will return Student Data in a usable electronic format, and then delete it, within 60 days. Provider will confirm the deletion in writing.
Student Data may persist in Provider's hosting Sub-processor's encrypted backups until those backups expire on their ordinary cycle. It is not restored to production and is not accessible through the Service. Provider states this rather than implying that deletion is instantaneous everywhere.
Deletion of an individual account by its holder is immediate and is not conditioned on this Section.
This Agreement begins on the date of the last signature and continues while the School uses the Service.
Either party may terminate on 30 days' written notice. Either party may terminate immediately if the other materially breaches this Agreement and does not cure the breach within 30 days of notice.
Sections 3, 8, 10 and 13 survive termination.
To the extent Student Data constitutes an education record under FERPA (20 U.S.C. § 1232g; 34 CFR Part 99), Provider will perform the institutional service the School would otherwise use its own employees to perform, will remain under the School's direct control with respect to the use and maintenance of that data, will use it only for the purposes this Agreement authorises, will comply with FERPA's redisclosure restrictions, and will meet the School's own criteria for school officials with a legitimate educational interest.
A contractual designation does not by itself establish FERPA status. The School remains responsible for determining whether the school-official exception and its own policies are satisfied. Provider states this rather than asserting a status it is not in a position to confer on itself.
Provider will comply with applicable federal and Oklahoma student privacy law. Where the School is subject to a state student data privacy statute or a district policy imposing additional obligations, the School shall identify it and the parties will amend this Agreement as required.
Altus Sport is not a supervision, safeguarding, emergency or child-protection system, and must not be relied on as one. It does not monitor conversations for harmful content, verify identity, or report a student's whereabouts. Responsibility for supervising students remains with the School, its staff, and parents and guardians.
Yardages and statistics produced by the Service are advisory and are not official scoring or handicapping records.
Except for Provider's obligations under Sections 3, 7 and 8, each party's liability is as set out in the Terms of Service.
Notices to Provider:
> Sharp Ventures, LLC > Edmond, Oklahoma, United States > tjsharp4@gmail.com
Notices to the School: the address in the signature block.
Assignment. Provider may assign this Agreement to an affiliate or successor entity that continues to operate Altus Sport, on written notice to the School. The assignee is bound by every obligation in this Agreement. *(Provider intends to move the Altus Sport business into a separate limited liability company; this clause is what makes that transfer possible without renegotiating with every School.)*
Amendment. Only in writing, signed by both parties.
Entire agreement. This Agreement, together with the Privacy Policy and Terms of Service, is the entire agreement between the parties about Student Data, and supersedes any prior understanding on that subject.
Governing law. Oklahoma, without regard to its conflict-of-law rules.
Sharp Ventures, LLC
Signature: ______________________ Name: ______________________
Title: ______________________ Date: ______________
School / District
Entity name: ______________________________________________
Address: __________________________________________________
Signature: ______________________ Name: ______________________
Title: ______________________ Date: ______________
| Element | Collected | Required | Notes |
|---|---|---|---|
| Name | Yes | Yes | Displayed to the student's team |
| Email address | Yes | Yes | Visible only to the account holder |
| Password | Yes | Yes | Held by the authentication Sub-processor, not by Provider in readable form |
| Role | Yes | Yes | Identity label; permissions come from team membership |
| Graduation year | Yes | For students | Also used for the age check in Section 5 |
| Phone number | Optional | No | Visible only to the account holder |
| Gender | Optional | No | |
| Handicap, clubs in bag | Optional | No | |
| Biography, hometown, home course, dominant hand | Optional | No | Visible to the student's team |
| Commitment status | Optional | No | Recruiting context |
| Social media handles | Optional | No | Visible only to the student, their guardian, and coaches of their own team |
| Profile photograph | Optional | No | Requires guardian approval before any visibility. EXIF stripped |
| Round scores, per hole | Yes, when used | No | Course, tees, date, strokes, putts, penalties, fairways, greens |
| Shot records | Optional | No | Club, lie, distance, derived strokes gained |
| Precise GPS coordinates | During an active round only | No | Deleted automatically after 30 days. Never readable by another user |
| Messages | Yes, when used | No | Team chat, parents channel, direct messages |
| Help requests | Optional | No | Message text and time |
| Push notification token | Yes | No | Never readable by another user |
| Date of birth | No | — | Deliberately not collected |
| Government identifiers, address, health, discipline, grades, test scores | No | — | Not collected in any form |
| Sub-processor | Purpose | Student Data processed | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All of Exhibit A | United States (AWS us-west-2, Oregon) |
| Expo | Application builds, push notification delivery | Push token and notification text | United States |
| Google Maps | Map imagery during a live round, on Android devices | None transmitted by Provider | United States |
| Apple Maps | Map imagery during a live round, on Apple devices | None transmitted by Provider | United States |
| golfapi.io | Golf course reference data | None. Course lookups are made by Provider's server and carry no information about who asked | United States |
No analytics, advertising, crash-reporting or tracking service is used by the Service.