Privacy Policy

GolfSpec acts in two capacities:

• Data controller (part A) for the data of customer shops and their staff: account creation and management, subscription billing, support, security, backups and monitoring of the Service.
• Data processor (part B) for the data of end customers (golfers) entered by each shop: GolfSpec processes them only on the shop's instructions; the shop is the controller and the point of contact for its customers' rights. GolfSpec's commitments to the shop are set out in the DPA.

Esteban Carrion, sole trader (entrepreneur individuel, EI) trading as GolfSpec, BAT H2 APPT 104, 1 allée Élise Deroche, 31400 Toulouse, France, SIREN 898 406 988. Contact for personal-data matters: esteban@golfspecpro.app. Data Protection Officer: [TO CONFIRM: whether a DPO is appointed].

Data we process on our own behalf:

• Staff accounts: email, name, password (hashed), role (administrator, manager, fitter), language, assigned site, date notifications were last viewed.
• Shop account: company name, contact details, VAT number, branding (logo, colour, texts), currency, time zone; Stripe customer and subscription identifiers (never a card number), subscription status, date and version of acceptance of the Terms, deletion request.
• Subscription billing: handled by Stripe (card, invoices); we keep only identifiers and statuses.
• Support, contact and demos: name, email, phone (optional), shop name and message sent through the in-app support form, the website contact and demo request forms or by email; for a demo, the launch monitor used and the preferred time slot.
• Security: IP address used as a rate-limiting key (login, sign-up, forgotten password, magic link, booking), kept for at most 15 minutes; technical logs; error reports (Sentry).
• Notifications: push-notification subscription (browser or iOS) if the User enables it.
• Service usage: date each account was last seen (updated at most once an hour) and feedback given on the Service (a 1 to 5 score, optional comment), to follow how each shop gets started and to improve the Service.

Purposes and legal bases:

• Providing the Service, managing accounts and authentication, billing the subscription — performance of the contract (Art. 6(1)(b) GDPR).
• Ensuring security (rate limiting, brute-force protection, error monitoring), backing up and restoring the database, improving the Service — legitimate interest (Art. 6(1)(f)).
• Keeping billing documents — legal obligation (Art. 6(1)(c)) [TO CONFIRM: accounting retention period].
• Sending Service-related emails (confirmation, password reset, alerts, invoices) — performance of the contract. No marketing-campaign feature is in service to date.
• Answering support, contact and demo requests — performance of the contract for customers, pre-contractual steps taken at your request for prospects (Art. 6(1)(b)). These requests are not used for unsolicited marketing.

The shop decides which data it enters. Depending on the features used, the Service may host, on its behalf:

• Identity and golf profile: surname, first name, email, phone, the shop's CRM identifiers, home club, handicap index, handedness, playing frequency, fitter's free-text notes.
• Fitting: body measurements (height, wrist-to-floor, arm length), swing speeds, level, goals, fitting interview (current bag, feel, priorities and, where relevant, physical constraints declared by the customer), recommendations, quotes, discounts, order status, customer's handwritten signature.
• Ball-striking data: launch-monitor data per club (speeds, angles, spin, distances, dispersion, up to 100 shots), entered manually or imported from a CSV file and, if the shop enables the TrackMan import, taken from a TrackMan report imported by link.
• Workshop and after-sales: repair tickets (registered or walk-in customer), description, before/after and step photos, customer signature, event log; after-sales claims to suppliers (product, proof of purchase, photos, correspondence); supplier sales contacts.
• Messaging and portal: customer–fitter conversations, attachments, AI drafts, portal access tokens, portal push subscription.
• Appointments: online bookings (surname, first name, email, phone), appointments, no-shows, cancellation token.
• Invoices and credit notes, if the shop issues them from the Service: billing identity (name, company, address, VAT number), items and amounts. The Service neither records nor collects any payment from the shop's customers; the shop collects payments with its own cash register.
• Satisfaction: rating, free-text comments, click-through to the Google review.
• Emails sent to customers: recipient, subject, delivery status.

These data are processed solely to perform the features chosen by the shop (fittings, quotes and invoices, portal, messaging, appointments, workshop and after-sales, reminders configured by the shop, AI analyses). The shop determines the legal basis towards its customers; GolfSpec does not use these data for its own purposes or for advertising.

The Service uses Google's Gemini Flash models for four features, triggered by the shop:

• structured analysis of a fitting (suggested recommendations);
• session assistant (answer to a free-text question from the fitter during the fitting);
• drafting of a fitting summary for the customer;
• draft replies in the messaging module (feature the shop can enable or disable).

Data sent to the model — analysis, assistant and summary: handicap index, speeds, height, wrist-to-floor, arm length, handedness, level, playing frequency, goals, interview answers (including any physical constraints and free-text comments), per-club measurements (with their source and the measuring device declared by the shop), quote items, fitter's notes, home club, the shop's name and instructions, catalogue and product sheets; messaging drafts: the last eight messages of the conversation, and the fitting's notes, statuses and items.

The customer's surname, first name, email and phone are not included in the prompts; they may however appear in free-text fields (notes, comments, messages), which are sent as they are. The exact content sent is kept with the result in the fitting record, for traceability [TO BE SET: retention period].

The output is a decision-support tool: it is reviewed and validated by the fitter before any use. Use is capped (analyses per day per shop, per-minute limits). [TO CONFIRM: applicable Google terms — processing region, prompt retention, no use for model training]

We use the following providers:

• Vercel Inc. — application hosting, server functions and scheduled jobs, executed in the London region (lhr1, United Kingdom); Vercel Blob — files (workshop photos, attachments, after-sales receipts, PDF cache) [TO CONFIRM: file-storage region].
• Neon Inc. — PostgreSQL database, AWS region eu-west-2 (London, United Kingdom).
• Upstash — rate-limiting Redis (temporary keys: IP address or email, expiring within 15 minutes); United States.
• Resend Inc. — transactional email delivery and delivery-status feedback [TO CONFIRM: region].
• Stripe — payment and invoicing of the shop's GolfSpec subscription; no data about the shop's customers [TO CONFIRM: Stripe entity and region].
• Google (Gemini) — artificial-intelligence features (section 3) [TO CONFIRM: region].
• Apple (APNs) and Web Push services (Google, Mozilla, Apple) — delivery of push notifications (subscription tokens only).
• Sentry — collection of technical errors (server and browser) [TO CONFIRM: region and personal-data scrubbing].
• GitHub (Microsoft) — daily encrypted (AES-256) database backups, kept for 30 days (90 days for the monthly backup), and continuous integration; United States.
• cron-job.org — uptime monitoring; Better Stack — heartbeat monitoring [TO CONFIRM: activation]. No personal data in either case.
• Shopify or another CRM — synchronisation of customer records if the shop enables the integration; encrypted credentials (AES-256-GCM).

Third-party data source, which is not a processor: if the shop enables the TrackMan import (launch-monitor data import by report link, an optional feature), the Service reads, from TrackMan's servers, the report whose link the shop provides; this report contains the player's name. Only the report identifier is sent to TrackMan.

Production data (application, database, files) are hosted in the United Kingdom, a country covered by an adequacy decision of the European Commission. Providers established in the United States (Upstash, GitHub and, depending on their processing region, Resend, Stripe, Google, Sentry) operate under the EU–US Data Privacy Framework or standard contractual clauses [TO CONFIRM: transfer mechanism verified for each provider]. We never sell or rent any data.

The Service uses only cookies and storage strictly necessary for its operation, exempt from consent (Article 82 of the French Data Protection Act); no banner is therefore displayed:

• Session cookie (professional area): authentication, encrypted, HttpOnly, 7 rolling days.
• portal_session (customer portal): customer session after a magic link, 24 hours.
• activeSiteId: site selected in the multi-site interface, 1 year.
• Local storage: golfspec-theme (theme), push-dismissed (notification banner), golfspec-offline-queue-v1 (queue of actions entered while offline).

No audience-measurement, advertising or behavioural-tracking tool is used; no third-party script is loaded in the pages and fonts are self-hosted.

Emails sent (confirmations, portal access links, quotes, reminders, alerts) contain neither an open-tracking pixel nor click-tracking links; we receive only the delivery statuses (sent, delivered, bounced, complained, failed) to diagnose failures.

• Shop account and entered data: for the duration of the subscription or trial, then 30 days after the deletion request (cancellable), before permanent deletion from production [TO BE SET: fate of inactive accounts with no deletion request].
• Encrypted backups: 30 days (90 days for the backup taken on the 1st of the month); point-in-time database restore: 6 hours.
• Subscription billing documents: kept by Stripe [TO CONFIRM: 10-year accounting retention and interplay with account deletion].
• Rate-limiting keys (IP, email): at most 15 minutes.
• Tokens: portal magic link 15 min; portal link at most 90 days, revocable by the shop and deleted 30 days after expiry or revocation; password reset 15 min, single use; professional session 7 rolling days, closed when the password or email changes and when the account is deleted; booking cancellation link erased the day after the appointment.
• Technical logs: retention period of the hosting platform [TO BE SET]; Sentry error reports [TO BE SET].
• Email log (recipient, subject, status): 12 months, then automatic deletion.
• Support, contact and demo requests, and feedback on the Service: 3 years from the request or feedback, then automatic deletion; what is sent from the app is deleted with the shop account.
• Deleted chat messages: permanently erased 30 days after deletion, attachments included; cached PDF copies: 30 days.
• Files (workshop photos, attachments): deleted with the data they belong to, at the latest when the account is purged.
• Log of the shop's sensitive actions (invoices, credit notes, deletions, erasure of a customer, team accounts): kept with the account.
• Content sent to the AI model, workshop event log and archived tickets: kept with the account [TO BE SET: specific periods].

The shop sets the retention period for its customers' data (inactive customers, old fittings); it has the full account export, the export and erasure of a customer's data from the customer record (issued invoices are kept for ten years with the billing name and address, everything else is deleted) and the assistance provided for in the DPA.

• Encryption of communications (HTTPS/TLS) and of the database connection (SSL).
• Hashed passwords (bcrypt) of at least 12 characters mixing several character types; passwords known to be compromised are refused (anonymised check: only the first 5 characters of the SHA-1 hash are sent to the Have I Been Pwned service); brute-force protection per IP address and per account; non-enumeration of accounts.
• Sessions closed when the password or email changes and when the account is deleted; single-use reset links; revocable portal links; access tokens masked in error reports.
• Rate limiting on sensitive endpoints (login, sign-up, exports, sending, AI).
• Per-shop data isolation enforced at database level (composite keys) and tested; role- and site-based access control.
• Third-party integration credentials encrypted (AES-256-GCM); no card data stored.
• Daily encrypted backups and quarterly restoration test; error monitoring and alerts.
• Signed, replay-protected webhooks; controlled uploads (allowed types, 10 MB maximum).
• Files stored on Vercel Blob and reachable through unguessable URLs [TO CONFIRM: file-access policy — security decision pending].

Shop staff and managers (part A): you have the rights of access, rectification, erasure, portability, objection and restriction, and the right to set post-mortem directives. In practice, the administrator can export the account's data (compressed JSON archive), correct the shop's and users' information and request deletion of the account (effective after 30 days). For any other request: esteban@golfspecpro.app. We reply within one month.

Shops' end customers (part B): send your request to the shop that carried out your fitting, which is the controller and which GolfSpec assists under the DPA. If you contact us directly, we forward your request to the shop concerned.

You may lodge a complaint with the French supervisory authority, the CNIL: www.cnil.fr.

This policy may evolve with the Service. Shops are informed by email of any substantial change at least 15 days before it takes effect; the update date appears at the top of the document.