Privacy Policy

Whose data it is

This policy explains what Hollis LLC ("Hollis", "we") collects when you use hollisapp.com, the Hollis application, its API or its MCP server, why, and what choices you have.

Hollis holds two kinds of data. Your account data (your sign-in email, password, name and personal details) is ours to protect, and this policy governs it. The data an organization puts into Hollis about its programs and the people in them belongs to that organization. For that data Hollis is a service provider acting on the organization's instructions, and the organization decides how it is used; ask the organization about its own practices.

What we collect

What you give us:

• your name, email address and password when you create an account;
• your date of birth and mobile number, which organizations use to confirm age and to reach you about games, and which Hollis keeps on your account and never shows to other players;
• the details an organization asks for when you register, such as emergency contacts, jersey size or a position, and the waivers you accept;
• what you and your organization enter while using Hollis: rosters, schedules, scores, messages, announcements and settings;
• what you write to us by email.

What we record as you use the Service:

• sign-ins, including the time, IP address and browser, and failed attempts;
• the actions taken on records, with who took them and when, so an organization can see its own history and undo a change;
• whether an email we sent was delivered, bounced or marked as spam;
• the same actions when taken through an API token or a connected assistant.

What Stripe gives us: the status of a payment, the last four digits and brand of a card, and a payout record. Card numbers go to Stripe and never reach Hollis's servers.

How we use it

To run the Service: create and secure your account, let organizations register you, take payments, build rosters and schedules, send the email that goes with them, and show organizations the history of what they did.

To keep the Service safe: detect abuse, limit sign-in attempts, investigate problems, and enforce the Terms of Service.

To support you and to tell you about changes to the Service or to these documents.

We do not sell personal data, we do not share it for advertising, and we do not use it to train artificial intelligence models.

Who we share it with

The organizations you join, which see what their role allows: your name and contact details, your registrations, payments, waivers and attendance for their programs.

Other members of those organizations, to the extent their role allows, such as a captain seeing the roster of their own team. Your date of birth and mobile number are not shown to other players.

The services Hollis runs on, each under a contract that limits them to working for us:

• Stripe, Inc., for payments and payouts;
• Postmark (ActiveCampaign, LLC), for sending email and reporting delivery;
• DigitalOcean, LLC, which hosts Hollis's servers and database in New York;
• Google LLC, whose Gemini model reads the photo or PDF of a permit an organizer uploads, to fill in the permit for them to check, writes the short topic of each conversation in Messages from its first message, and answers the questions asked of the demo's assistant.

Authorities, when the law requires it or to protect the rights, safety or property of Hollis, our users or others.

A successor, if Hollis is sold or merged, under this policy.

An assistant or application you connect yourself, which receives what you allowed it to read.

Payments

Payments are made through Stripe on the organization's own Stripe account. Stripe collects the card details and your billing information directly and uses them under its own privacy policy, available at stripe.com/privacy. Hollis receives the result and a card's last four digits so you and the organization can recognise it.

Cookies and analytics

Hollis sets cookies that the Service needs to work: one that keeps you signed in, one that protects forms from forgery, and one if you ask to stay signed in. They are first-party cookies and hold no advertising identifiers.

Hollis runs no third-party analytics or advertising trackers on the Service. Stripe's checkout page may set its own cookies for fraud prevention.

Email

Hollis sends email on behalf of your organization: receipts, confirmations, schedule changes, reminders and the announcements the organization writes. Each announcement carries a link to stop receiving announcements from that organization, and we honour that choice at once; mail about your own registrations and account continues as part of the Service.

We record whether a message was delivered, bounced or was marked as spam so the organization knows whether it reached you. We do not track whether you opened a message.

Assistants and connected apps

If you connect an assistant or application through an API token or the Hollis MCP server, it can read what you can read in the organization you chose, or less if you chose read only, and it can act as you within that access. Where it sends that data is governed by its maker's policy. You can see and revoke every connection from your account.

Hollis does not send your data to any artificial intelligence model provider today. Before any Hollis feature does, this policy will name the provider and what is sent.

Retention

Payment, refund and invoice records are kept for seven years after the payment, for tax, accounting and chargeback purposes.

Registrations, rosters, schedules, waivers and messages are kept as long as the organization that owns them needs its history. When an organization owner asks us to close the organization, we delete its data within 30 days of closing, except what the law or the payment-record rule above requires us to keep.

When you delete your account, you can no longer sign in and your sign-in email is released. The records that name you stay with the organizations they belong to, so their rosters, payments and history still read correctly. You can ask us at [email protected] to replace your name and contact details in those records with a placeholder, and we will do so unless a legal, payment or dispute reason requires keeping them.

Session records, which hold the IP address and browser of each sign-in, are removed when the session ends or expires.

Security

Hollis keeps reasonable administrative, technical and physical safeguards for personal data, as New York's SHIELD Act requires. Passwords are stored hashed, never in clear text. Connections use TLS. Sign-in attempts are rate-limited. Access to production data is limited to the people who need it to run the Service. Card data is handled only by Stripe, which is certified to PCI DSS Level 1.

If a breach of security affects your private information, we will notify you and the New York Attorney General as New York General Business Law § 899-aa requires, without unreasonable delay.

No system is perfectly secure. Use a strong, unique password and tell us at once if you suspect your account has been misused.

Your rights

Whoever you are, you can:

• see and correct your account details from Your account;
• change your sign-in email or delete your account from Your account;
• stop receiving an organization's announcements from any announcement;
• revoke any assistant or application you connected;
• ask us at [email protected] for a copy of the personal data we hold about you, for a correction, or for deletion or anonymisation as the Retention section describes.

We answer within 30 days. For data an organization holds about you in its own programs, we will pass the request to the organization or point you to it. We do not discriminate against anyone for exercising these rights.

Hollis does not respond to browser "Do Not Track" signals, since it does no cross-site tracking that such a signal would change.

Children

The Service is for adults. Nobody under 18 may hold an account or register for a program, and we do not knowingly collect personal data from anyone under 18, or from any child under 13 within the meaning of COPPA. If you believe someone under 18 has given us personal data, write to [email protected] and we will delete it.

International transfers

Hollis is operated from New York, and its servers are in the United States. If you use the Service from outside the United States, your data is transferred to and stored in the United States, where privacy laws may differ from those of your country.

Changes to this policy

We may change this policy. For a material change we will email account holders at least 30 days before it applies, and the effective date at the top of this page will change.

Contact

Hollis LLC, 4543 40th St, Sunnyside, NY 11104. Email: [email protected].