Lucky GolfPrivacy Policy
In effect 3 October 2026. Written to be read. If any of it is unclear, ask us before you agree to it.
What we know about you, how we came to know it, and what we do with it. Written specifically for this program rather than adapted from a template, so everything below describes something the app actually does.
01Who this is about
This explains what Lucky Wedges, LLC, doing business as Lucky Golf does with information about you when you apply to, or take part in, the Lucky Golf ambassador program at creators.luckygolf.com.
It covers ambassadors and applicants. If you are a customer of our shop, the privacy policy on our storefront covers you instead.
02What you give us
When you apply, and while you take part:
- Your name and email address.
- Your social handles (Instagram, TikTok, YouTube) and your Discord name if you give it.
- What you wrote on the application form about how you play, and any links you shared.
- Links to posts you log, and any video files you upload to us.
- Your password, stored only as an irreversible cryptographic hash. We cannot see it and neither can anyone else.
- If you earn $600 or more in a year, the tax details on a Form W-9, which US law requires us to collect before paying you.
03What we collect about your posts, and how
We read publicly available information about your Instagram account: your follower count, the text of your bio and the website link on it, and the view, like and comment counts on your recent posts. We do this through Meta's business discovery tool, from our own Instagram business account. We read your bio to check that @luckygolfofficial is in it.
We use those numbers, together with what you upload and the sales you drive, to calculate the ambassador score shown in your account. You see the same score and the same breakdown that we do.
This is worth being precise about, because it is the part people most reasonably want to understand. We are reading numbers that any member of the public could see by visiting your profile. Unless you choose to connect an account (next section), you do not log into anything of ours for it to work, we hold no token or credential belonging to you, and we cannot see anything private. Not your messages, not your followers list, not who you follow, not your drafts. It works only because your account is a public professional account. If you make it private, it stops working.
For posts on TikTok, YouTube and Facebook we read the public view, like and comment counts the same way.
If you grant us partnership ads permission, we can also see how advertising we are paying for is performing. That is our own advertising data, not your account data.
04If you connect your Instagram or TikTok
Connecting is optional. If you tap Log in with Instagram or Connect TikTok, you sign in on Instagram's or TikTok's own screen, which shows exactly what you are agreeing to share. We never see your password.
From Instagram we then receive your username, account type, follower count, your list of posts, and the insights on your posts: views, reach, likes, comments, shares and saves. From TikTok we receive your username and display name, your follower and video counts, and the view, like, comment and share counts of your own videos.
We use this only for what the rest of this policy describes: showing you and our team how the posts you make for us perform, working out your ambassador score, and choosing which videos to run as ads. We keep the access token that Instagram or TikTok gives us on our server, where no browser can read it, and we use it only to read those numbers. We never post, edit, delete or message anything on your account.
To disconnect, open Help & Account, then Connections, and tap Disconnect. That deletes the token straight away, and we stop reading anything through it. You can also remove Lucky Golf from your connected apps inside Instagram (Settings, Apps and websites) or TikTok (Settings, Security, Manage app permissions). To have the numbers we already collected deleted too, email the address at the end of this policy and we will do it within thirty days.
05What we collect from selling
When someone buys using your code or link, our shop tells us the order value and that it was attributed to you. We use that to work out what you have earned.
We do not receive the customer's name, address, or payment details from that attribution.
06What the app records on its own
Basic technical information needed to run a website: a sign-in session cookie so you stay logged in, and standard server logs. We do not use advertising trackers or third-party analytics on the ambassador app.
07What we use it for
Only these things:
- Deciding whether to accept your application.
- Running the program: showing you your dashboard, reviewing what you post, deciding what to promote and who to send product to.
- Working out and paying what you have earned.
- Running advertising from posts you have logged, where you have given permission.
- Contacting you about the program.
- Meeting our legal obligations, including tax reporting.
08What we never do
We do not sell your personal information, and we do not share it with anyone for their own advertising. We have never done this and this policy commits us not to start.
We do not post as you, message anyone as you, or take any action inside your social accounts.
09Who else sees it
Only the companies that make the app work, and only what they need:
- Supabase stores the database and handles sign-in.
- Vercel runs the website.
- Resend sends the emails we send you.
- Meta is where the advertising runs and where public post numbers come from.
- Shopify is the shop, and where sales are attributed.
- Klaviyo sends program announcements and updates, if you are receiving them.
- Our payment provider, when we pay you.
10Other ambassadors can see some of this
The program has open leaderboards. Other ambassadors can see your name, your level, your logged posts and their public view counts, and how advertising from your posts has performed.
They cannot see your email address, your earnings, your payment details, or your application.
11How long we keep it
While you are in the program, and afterwards only as long as we need to: earnings and tax records for seven years because tax law requires it, and everything else deleted or anonymised within twelve months of you leaving.
Applications we decline are deleted after twelve months.
12Your rights over it
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to us and we will do it within thirty days, free of charge.
If you are in California, the CCPA gives you these rights specifically, along with the right not to be treated differently for exercising them. We will not treat you differently.
Deleting everything means leaving the program, since we cannot run it without knowing who you are. We will say so before we act on such a request rather than after.
You can withdraw Instagram ads permission yourself at any time, in your own Instagram settings, without asking us.
13Security, honestly stated
Information is encrypted in transit and at rest, access is limited to the people who run the program, and passwords are stored as hashes we cannot reverse.
No system is perfectly secure and we will not pretend otherwise. If a breach affects your information, we will tell you.
14Under 18
The program is for people 18 and over. We do not knowingly collect information about children. If you tell us you are under 18, or we find out, we will delete your information and close your account.
15Changes, and how to reach us
If we change this policy in a way that materially affects you, we will tell you and ask you to accept the new version when you next sign in.
Questions, or to exercise any of the rights above: support@luckygolf.com. Lucky Wedges, LLC, 6475 E. Pacific Coast Hwy #182, Long Beach, CA 90803.