Privacy Policy

1. Who is responsible for your data?

GolfGraffix is the data controller for personal information processed through CourseMaster, except where your golf club processes certain employee or member data in its own capacity as a separate controller.

For privacy questions, data subject requests, or security concerns, contact us at: privacy@golfgraffix.com

2. Information we collect

We collect information in the following categories, depending on how you use the Service.

2.1 Account and profile information

• Name and email address
• Username and club or organisation identifier
• Role, access level, and permission settings assigned by your club administrator
• Display preferences such as measurement units and default start page
• Authentication credentials (passwords are stored using one-way hashing and salting; we do not store plain-text passwords)

2.2 Course and operational data you create

When you use CourseMaster to manage your golf course, we store data you or your team enter, including:

• Course map features, shapes, layers, and measurements
• Snags (maintenance issues), including title, description, priority, status, assignments, and notes
• Snag locations on the course map (map coordinates relative to your course layout)
• Photos attached to snags or related records
• Pin position plans, schedules, confirmations, and published daily pin sheets
• Historical snag reports and analytics derived from your club’s data

2.3 Photos and files

You may take photos with your device camera or upload images from your photo library when logging snags or attaching evidence to course records. Images are transmitted to our servers and stored securely as part of your club’s CourseMaster data.

Photos may contain incidental metadata (such as date or device information embedded in the image file). We do not use photos for advertising or unrelated purposes.

2.4 Technical and usage information

• IP address, browser or app version, operating system, and device type
• Session identifiers, authentication tokens, and security tokens (including CSRF protection tokens on the web)
• Date and time of access, pages or screens viewed, and API requests needed to operate the Service
• Error, diagnostic, and security logs

We use this information to provide, secure, and maintain the Service. We do not use third-party advertising trackers in CourseMaster.

2.5 Information we do not intentionally collect

• Precise device GPS location is not required for core CourseMaster features. Snag and map positions are stored as locations on your club’s course map, not as continuous GPS tracking of your device.
• We do not knowingly collect information from children under 16.

3. How we use your information

We use personal and operational data to:

• Provide, operate, and maintain the Service
• Authenticate users and enforce role-based permissions
• Store and display course maps, snags, features, measurements, and pin positions
• Enable team collaboration between greenkeepers, managers, and administrators
• Generate snag history and reporting for your club
• Publish pin sheets where your club chooses to make them publicly available
• Protect against fraud, abuse, and unauthorised access
• Respond to support requests and communicate about the Service
• Comply with legal obligations
• Improve reliability, performance, and security

4. Legal bases for processing (EEA, UK, and similar jurisdictions)

Where applicable data protection law requires a legal basis, we rely on:

• Contract — to provide the Service your club has subscribed to and to manage your user account
• Legitimate interests — to secure the Service, prevent misuse, and improve functionality, balanced against your rights
• Legal obligation — where we must retain or disclose information by law
• Consent — where required for optional device permissions (such as camera or photo library access on mobile)

5. Mobile app permissions (iOS and Android)

The CourseMaster mobile apps may request device permissions so you can use features on the course. You can deny permissions, but some features may not work fully.

• Camera — to take photos when logging snags or attaching images to course records.
• Photo library / media — to upload existing images from your device.
• Network access — to sync data with your club’s CourseMaster account.
• Notifications (if enabled by your club or in a future release) — to alert you about assigned snags or important course updates.

Permission prompts are controlled by your device operating system. You can change permissions at any time in your iOS or Android settings.

6. Cookies and similar technologies (web)

The CourseMaster website uses cookies and similar technologies that are necessary to:

• Keep you signed in during a session
• Protect against cross-site request forgery and other security threats
• Remember essential preferences where applicable

These are strictly necessary for the Service to function. We do not use cookies for third-party advertising. You can control cookies through your browser settings, but disabling essential cookies may prevent you from signing in.

7. How we share information

We do not sell your personal information. We may share information only in these circumstances:

• Within your club — with other authorised CourseMaster users at your organisation, according to the permissions set by your administrator.
• Service providers — with hosting, infrastructure, email, or support vendors who process data on our behalf under contractual confidentiality and security obligations.
• Public pin sheets — when your club publishes a daily pin sheet, limited course information (such as hole numbers and pin positions) may be visible to anyone with the public link or app view. This does not include your personal account details.
• Legal requirements — if required by law, regulation, court order, or to protect rights, safety, and security.
• Business transfers — in connection with a merger, acquisition, or sale of assets, subject to continued protection of your information.

8. Data retention

We retain personal and course data for as long as your club maintains an active CourseMaster account or as needed to provide the Service. Operational records (such as snags, maps, and pin history) are kept according to your club’s business needs and our agreement with the club.

When an account is closed or access is removed, we delete or anonymise personal information within a reasonable period, except where we must retain data for legal, security, or backup purposes. Server logs are typically retained for a limited period and then rotated or deleted.

9. Security

We implement technical and organisational measures designed to protect your information, including access controls, encrypted connections (HTTPS/TLS), hashed credentials, permission-based access within clubs, and monitoring for unauthorised activity.

No method of transmission or storage is completely secure. Please use a strong password, keep your device secure, and report suspected unauthorised access to privacy@golfgraffix.com.

10. International data transfers

CourseMaster may be hosted on servers located outside your country. Where personal data is transferred internationally, we take steps to ensure appropriate safeguards are in place consistent with applicable law, such as standard contractual clauses or equivalent protections.

11. Your rights and choices

Depending on your location, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your personal information
• Object to or restrict certain processing
• Request portability of information you provided
• Withdraw consent where processing is based on consent
• Lodge a complaint with your local data protection authority

To exercise these rights, contact privacy@golfgraffix.com. We may need to verify your identity. Some requests relating to course operational data may need to be coordinated through your club administrator, who controls the organisation’s CourseMaster account.

Account deletion: If you wish to delete your CourseMaster user account, contact your club administrator or email us at privacy@golfgraffix.com. Deleting a user account does not automatically delete historical course records created by that user, which may be retained as part of your club’s operational history.

12. Children’s privacy

CourseMaster is a business tool intended for golf club staff and authorised personnel. It is not directed at children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

13. Third-party services and links

The Service may display content loaded from trusted infrastructure providers (for example, font or icon delivery networks) necessary to render the application. Those providers may receive standard technical information such as your IP address when your device requests resources.

CourseMaster may link to external websites (for example, your club’s own site). We are not responsible for the privacy practices of third-party sites.

14. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify administrators or display a notice within the Service. Continued use of CourseMaster after changes take effect constitutes acceptance of the updated policy.