This policy explains what personal data Flagstick handles, why, who it is shared with, and the rights you have. It is written for everyone who touches Flagstick: society organisers who sign up, members their society adds, guests who are scored in a round, and visitors to this website.
1. Who we are
Flagstick is operated by Passadas Aleatórias Unipessoal Lda, Calçada da Tapada 85, Portugal, NIPC 519305515 (“Flagstick”, “we”, “us”). For anything in this policy, write to mark@flagstick.live.
We have not appointed a Data Protection Officer; we are not required to at our size. The contact above reaches the person responsible for data protection.
2. Two roles: when we decide, and when your society decides
Data protection law distinguishes the controller (who decides why and how data is used) from the processor (who handles data on the controller’s behalf).
- We are the controller for the accounts of the people who sign up to run a society, for billing, for the emails we send on our own account (sign-in links, trial and payment notices), for this website, and for keeping the service secure.
- Your society is the controller for its members’ data: the member list, handicaps, scores, results, standings, groups and tee times. The society’s organiser decides who is added, what is recorded and when it is deleted. We process that data on the society’s instructions, under the data processing terms in section 12 of our Terms of Service.
If you are a member and want to see, correct or delete what your society holds about you, ask your society’s organiser first. You can also write to us and we will pass the request on and help them answer it.
3. What we collect
Account and membership. Name, email address, country, handicap index, and optionally a mobile number. Your role in the society (member or admin). When an organiser adds you, they provide these details, not you. That is why you are reading this rather than having ticked a box.
Golf data. Rounds you are entered in, RSVPs, playing groups and tee times, hole-by-hole strokes, Stableford points and gross totals, match results, and the rankings calculated from them. We record who entered each score and when.
Guests. A player can add a guest to a round by name and handicap. Whoever adds a guest should only do so with the guest’s knowledge.
Society signup. Society name, your name, email, country, handicap index and your browser’s time zone.
Requests to join a society. If you use a society’s join form, the details on it: name, email, phone, handicap, location, how you heard about the society, and your message.
Billing. Payments are taken by Stripe. We never see or store your full card number. We keep your Stripe customer reference, your subscription status and dates, and invoice records.
Feedback and demo requests. If you send feedback from the app: your message, your name, email and society, the page you were on, and your browser type. If you ask for a demo: your club, name, email, number of players and message.
Emails. Delivery records for the emails we send (sent, delivered or bounced).
Technical data. IP address, browser type and request logs, kept by our hosting provider for security and troubleshooting. Aggregated page-view statistics from Vercel Web Analytics, which uses no cookies and does not identify you across sites. Page-speed measurements from Vercel Speed Insights.
We do not collect special categories of data (health, beliefs and so on), and we ask you not to put any in free-text fields.
4. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Running the service: sign-in, scoring, leaderboards, standings, notices about rounds | Performance of a contract (6.1.b); for society members, the society’s legitimate interest in running its competitions (6.1.f) |
| Creating a society, free trial and subscription billing | Performance of a contract (6.1.b) |
| Keeping invoices and accounting records | Legal obligation (6.1.c) |
| Security, abuse prevention, debugging | Legitimate interest in a safe, working service (6.1.f) |
| Aggregated, cookieless usage statistics | Legitimate interest in improving the service (6.1.f) |
| Answering your messages and requests | Legitimate interest (6.1.f), or a contract where you are a customer |
We do not send marketing email. If we ever want to, we will ask first. We do not sell personal data, use it for advertising, or make decisions about you by automated means that have legal or similarly significant effects. Form rankings and the Order of Merit are sporting tables, nothing more.
5. Who can see what
- Inside your society, members can see each other’s names, countries, handicaps, scores and positions. Only admins can see members’ email addresses and phone numbers.
- Live leaderboards and results can be opened by anyone with the link, without signing in. That is how they work on the clubhouse TV or in a group chat. They show names, scores and positions. A society can choose not to share a link.
- Group scoring links let anyone holding the link enter scores for that group, for that round only.
6. Who we share it with
We use a small number of providers to run Flagstick. Each acts on our instructions under a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Supabase, Inc. | Database and sign-in | EU (Stockholm, Sweden) |
| Vercel, Inc. | Hosting, serverless functions, web analytics | EU (Stockholm) for application servers; global edge network for delivery |
| ActiveCampaign, LLC (Postmark) | Sending sign-in links, invitations and notices | United States |
| Telegram (Telegram FZ-LLC) | Delivering feedback and demo requests to us | United Arab Emirates, with servers worldwide |
Stripe Payments Europe, Ltd. (Ireland) processes your payments as an independent controller under its own privacy policy, because payment law requires it to make its own decisions about fraud and compliance.
We may also disclose data where the law requires it, to protect our rights, or to a buyer if the business is ever sold, in which case this policy continues to apply.
7. Transfers outside the EU
Where a provider is in the United States or may access data from there, the transfer relies on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
Feedback and demo requests are delivered to us through Telegram, which is based outside the EU in a country without an EU adequacy decision. We use it only for messages you choose to send us. We delete them from Telegram once they have been dealt with. If you would rather not use it, email us instead.
8. How long we keep it
- Society data (members, rounds, scores, results) is kept for as long as the society uses Flagstick, so seasons and history stay intact. An organiser can remove a member or an event at any time. Removing a member deletes their scores too.
- After a subscription ends, a society’s data stays readable for its members. We do not delete it just because a payment stopped. If the organiser asks, we delete it. In any case we delete it 24 months after the subscription ends, unless the society comes back first.
- Unconfirmed signups: the confirmation link expires after 48 hours, and we periodically delete signups that were never confirmed.
- Join requests are kept until the society handles them, then for as long as the society keeps them.
- Invoices and accounting records are kept for the period Portuguese tax law requires (currently ten years).
- Server logs are kept for a short rolling period set by our hosting provider, typically days to weeks.
9. Your rights
You have the right to access your data, correct it, have it erased, restrict or object to its use, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time. You can update your own name, country, handicap and phone number on your Profile page.
Write to mark@flagstick.live. We will answer within one month, and tell you if we need longer for a complex request. For data your society controls (section 2), we will work with the organiser to answer you.
You also have the right to complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, or to the authority where you live. We would appreciate the chance to fix the problem first.
10. Cookies and similar technology
We use only what the service needs to work:
| Name | What it does | How long |
|---|---|---|
| Supabase session cookies (sb-…) | Keep you signed in | Until you sign out, or the session expires |
| locale | Remembers English or Portuguese | 1 year |
| pgs_redirect | Sends you back to the page you were on after you sign in | 15 minutes |
| Group choice (browser storage, on the scorer) | Remembers which group you are scoring on that phone | Until you clear it |
These are strictly necessary, so they do not need your consent. We do not use advertising, social or cross-site tracking cookies. Vercel Web Analytics is cookieless. If we ever add analytics that store anything on your device, we will ask first.
11. Children
Flagstick is not aimed at children. Golf societies sometimes include junior players. Where a society adds a member under 13, the society is responsible for obtaining a parent’s or guardian’s consent (Portuguese Law 58/2019, art. 16).
12. Security
Data is encrypted in transit and at rest with our providers. Database access is limited by row-level security, so each society can only reach its own data. Administrative access is limited to the people who run Flagstick. No system is perfectly secure. If a breach puts your rights at risk, we will tell the CNPD within 72 hours and tell you without undue delay.
13. Changes
We will update this page when our practices change, and change the date at the top. If a change is significant, we will tell society organisers by email before it takes effect.