Constitution
This is the supreme law of Surf Booking. Everything that happens here — every school, every surfer, every partner, and the very system that runs the platform — operates within these principles. They are not a notice or a checklist: they are the foundation everything else is built on. Nothing overrides them. And they don't live on paper alone — a Constitutional Core, which not even the system itself can relax, enforces them at every decision.
Why we exist. The ocean is dynamic; the software was static.
The operations copilot. It proposes — never executes.
How we score the wave you will actually catch — at the peak, not offshore.
How it is built. With proof, not promises.
The nine principles that govern it all. You are reading it.
Partners plug into the intelligence — by the rules, never around them.
Native regulatory compliance
Every lesson respects the operating ratios defined by the regulation governing surf schools. The platform enforces them. Schools don't tick a box — the system refuses configurations that breach them. No exceptions, no clicks.
Liability is signed, not assumed
Each student signs a digital waiver before their first lesson. Minors require their guardian's signature. Schools cannot check a student in if the signature is missing or expired. The pen is the gate.
Credentials are shown, not vouched for
Instructors publish their own credentials (FPS / ISA / Grau I-III) with a visible copy of the licence. Surf Booking hosts the catalogue — never certifies, never endorses. Schools and surfers see the document and decide for themselves. The platform is neutral; trust is between the parties.
The school's money is always the school's
By default, payments flow through Stripe Connect direct to the school's own connected account — the balance never passes through our books. If the school isn't Stripe-verified yet, it can still sell: the payment runs through Surf Booking's own Stripe account, which holds only the school's net until verification completes — and releases it in full at that moment. Either way, we only ever keep the transparent fee disclosed up front — never a cent more. The school's revenue is the school's revenue from second one.
Privacy by architecture
Data protection is not a banner — it is a schema decision. Sensitive identifiers are encrypted at rest. Account deletion is real: personal data is anonymised or removed; only the strictly necessary for tax and accounting obligations is retained, as required by law. Your data does not feed rankings, ads, or other schools.
The platform is the bridge — always
Communication between surfer and school happens inside the system — and the school sees and serves every student who books with it, keeps a permanent booking record, and builds its own loyalty right here. What the platform does not allow is the mass export of Surf Booking users' personal data: no bulk contact-list dump, no hidden channel to lift the shared customer base off-platform. The surfer's data stays protected and is never harvested — and the marketplace stays fair for every school.
Total auditability
Every administrative action — schedule change, suspension, role escalation, GDPR purge — is recorded in an append-only log. Refund and payout reconciliation goes further: a server-side hash chain makes cash-flow tampering instantly detectable on replay. When questioned, we can answer with a timestamp. Trust requires receipts.
Agent proposes, user confirms
The agent is an assistant, never an autopilot. Any action with real-world consequence — schedule, money, or anyone's name — is prepared by the agent and committed by the user. There is no silent execution. The human stays in the loop, by design.
The agent proposes. You approve. The rules don't change.
Surf Booking's operations copilot does not run in the dark. Every reply passes through a deterministic gate that blocks unsafe categories before reaching the user. Every night an adversarial test suite probes the agent and records every result to an audit-bound log. When a failure pattern recurs, the system records it and flags it for human review. The agent never rewrites itself: any change is written by a person, approved by a person, and version-tracked. A constitutional core sits beneath every configuration, and the system cannot relax it. Underneath all of it sits a single sovereignty switch: one operator action reverts the agent to its base configuration. This is not autonomous intelligence. It is observed intelligence — on a cadence you control. The guardrails of Principle 08 stay in place.
Nine principles are public. They are not all of it.
Beneath them runs a deeper doctrine — how each school is isolated so it can never see another's data, how every agent is bound to a Constitutional Core it cannot rewrite, how money operations are code and never conversation. That layer is not published — not because it is hidden, but because it is the part that cannot be copied. The public law is what we promise. The private articles are how we keep it.
The Constitution has layers.
These nine principles are the foundation. Above them, each layer of the platform — the Agent, the school context, the public charter, the adaptive intelligence — carries its own pillars. Each layer is auditable, versioned and accountable. Each layer can change. The Constitution does not.
