1. Who We Are

SQR1 Golf is operated by Flinc Ltd, a company registered in England and Wales (company number 17448021), with its registered office at 66 Paul Street, London, EC2A 4NA. We are the data controller for the personal information you provide when using the SQR1 Golf platform (the "Service").

We are registered with the Information Commissioner's Office (ICO) under registration number ZC243032, as required under UK data protection law. Our registration details are available on the ICO public register at ico.org.uk.

2. What We Collect

We collect the following categories of personal data:

• Account data -- name, email address, username, phone number, and postal address provided at registration
• Profile data -- profile picture, handicap index, home golf club, preferred hand, and any other profile information you choose to add
• Golf performance data -- round scores, hole-by-hole statistics, club distances, course notes, approach tracking, scrambling records, and any other data you voluntarily record through the Service
• Coaching relationship data -- if you use the coaching features, we store records of coach and client connections, requests, and any performance notes shared within those relationships
• Training data -- if you use the Training features: drills a coach creates (title, instructions, equipment, goals, any photos they upload, any YouTube or Vimeo link they add, and whether the drill is published), drills a coach assigns to you together with any note and "try by" date they add, published drills you choose to save, star ratings (1 to 5) you give to drills, and, if you report a drill, your report together with a copy of the drill as it was when you reported it
• Payment data -- transaction records are processed by Stripe. We do not store full card numbers; we hold only a tokenised Stripe customer reference and a history of transactions made through the Service
• Points and transaction history -- records of points earned, spent, purchased, and adjusted within the app
• Giveaway and competition data -- if you enter a giveaway: your email address, plan, number of entries, your answer to the skill question and when you gave it, and whether your entry is confirmed. If you win, we also collect your delivery address and contact number, and may ask for proof of age, identity and residence
• How you found us -- if you arrive through a link carrying campaign tags (for example from one of our adverts), we note which source, campaign and advert it was. If there are no tags, we note the website that sent you, by name only (for example google.com or instagram.com, never the page or search you came from). We also note the first page you opened and the page you signed up from. We save this with your account when you sign up, along with whether your free trial later became a paid subscription. We use this only to see which of our marketing works. It comes from the link and your browser, not from cookies, is never shared, and is deleted with your account
• Discount codes and ambassador referrals -- the discount code you used when you subscribed. If your subscription came through one of our ambassadors, we link it to them and record the payments made on it, so we can pay them commission (see Section 5d)
• Marketing preferences -- your choice at registration and any subsequent changes regarding whether you wish to receive marketing communications from us
• Technical data -- IP address, browser type, device information, and usage logs collected automatically when you use the Service
• Communications -- messages sent via the in-app messaging system, support requests, and any other correspondence with us

We do not ask for sensitive personal data such as health information, racial or ethnic origin, or political opinions. Fitness drills are general exercises, not health records: please do not include details of injuries or medical conditions in drills or drill notes. If such information is included anyway, it is treated as confidential, used only to provide the Service, and you can ask us to remove it at any time.

3. How We Use Your Data

We use your personal data to:

• Create and manage your account and provide access to the Service
• Process payments and manage your points balance and subscription
• Calculate, display, and benchmark your golf performance statistics against scratch and target handicap standards
• Generate personalised yardage book PDFs using your club distance data and course information
• Enable coaching relationships -- sharing relevant performance data between coaches and their clients where a relationship has been established
• Provide the Training features -- letting coaches create drills, assign them to their clients with notes and dates, and publish them; letting members find, save and rate published drills (showing a drill's average rating once it has 3 or more ratings, and using ratings to order "Top rated" drills); reviewing drills that are reported to us and unpublishing or removing them where needed; and emailing you when your coach assigns you a drill (you can switch these emails off with the "Coach & Client Requests" setting in your account)
• Send transactional emails such as account confirmations, payment receipts, and password resets
• Send marketing communications where you have given consent, and provide a straightforward way to withdraw that consent at any time
• Show you offers within the Service based on your plan and account history — for example, a discount on a paid plan after your free trial ends. These appear only while you are logged in; we only email offers if you have agreed to marketing communications
• Pay our ambassadors the commission they earn on subscriptions that came through them, and check that each referral qualifies (see Section 5d)
• Run giveaways and competitions -- checking eligibility, recording entries and answers, carrying out the draw, contacting the winner, delivering prizes, and publishing the result (see Section 5c)
• Respond to support requests and improve the Service based on usage patterns
• Comply with our legal obligations and prevent fraud or misuse

We do not use your golf performance data for any purpose other than providing the Service to you. We do not sell your data to third parties or use it for advertising.

4. Legal Basis for Processing

Under UK GDPR we rely on the following legal bases:

• Contract -- processing necessary to provide the Service you have signed up for, including account management, statistics calculation, PDF generation, and payment processing
• Legitimate interests -- technical logging for security and performance monitoring, fraud prevention, retaining points transaction history for 90 days after account deletion to resolve billing disputes where an account had no history of reports or restrictions, and, where an account was reported by another user or suspended/banned, retaining points history, reports, blocks, and message threads for 90 days from the most recent relevant event (which may extend beyond 90 days if further reports or actions occur) to investigate conduct concerns and protect other users, where our interests do not override your rights
• Legal obligation -- retaining financial records as required by HMRC and applicable law
• Consent -- where we ask for your explicit agreement, such as optional marketing communications (which you can withdraw at any time from your account settings page) and analytics and advertising cookies (which you can withdraw at any time from our Cookie Policy page)
• Giveaways -- the legal bases for giveaway entries and publishing winners are set out in Section 5c
• Ambassador referrals -- linking a subscription to the ambassador who brought it in, and keeping the commission records, is in our legitimate interests (paying the people who recommend us accurately and checking referrals are genuine); see Section 5d
• Legal claims -- retaining limited data after account deletion, alongside the legitimate-interest basis above, to allow us to defend against payment disputes, chargebacks, and legal claims (Article 17(3)(e) UK GDPR). This includes our records of which versions of our Terms of Service and this Privacy Policy you agreed to (see Section 6)

5. Sharing Your Data

We do not sell your personal data. We share data only with the following categories of third parties, and only to the extent necessary:

• Stripe -- payment processing. Subject to Stripe's own privacy policy and PCI DSS Level 1 compliance
• Railway -- server infrastructure for running the Service. Railway's infrastructure runs on Amazon Web Services (AWS) data centres located in the United States. This constitutes a transfer of personal data outside the UK; see Section 5b (International Data Transfers) below for the legal basis for this transfer
• Cloudflare R2 -- cloud object storage used to store user-uploaded profile pictures, drill photos and our ambassadors' photos. Files are stored on Cloudflare's infrastructure and served via Cloudflare's global network. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy
• SendGrid -- email delivery: account and service emails (such as account confirmations, password resets and receipts), and marketing emails if you have agreed to receive them. SendGrid receives your name, email address and the content of the email
• Sentry (Functional Software, Inc.) -- error monitoring. When something goes wrong on our servers (for example, a page fails to load or a form fails to save), an error report is sent to Sentry so we can find and fix the problem. A report contains the page address, the time, the error and the technical details around it, and your browser and device type. It can also include information you had just entered on that page, such as the scores in a round you were saving. Passwords and payment details are removed before anything is sent, and we have set Sentry up not to receive your name, email address, IP address or cookies. We also send Sentry a small sample of anonymous page-speed measurements (which pages were visited and how long they took to load). We use this on the legitimate-interest basis of keeping the Service secure and working properly
• hCaptcha -- we use hCaptcha on our registration form to protect against automated abuse and bot sign-ups. hCaptcha is operated by Intuition Machines Inc. When you complete the verification, hCaptcha may collect your IP address, browser information, and behavioural signals as part of its bot detection process. This processing is based on our legitimate interest in protecting the Service from abuse. hCaptcha's privacy policy is available at hcaptcha.com/privacy
• Google Fonts -- if you consent to optional resources, font requests are made to Google's servers. No personal account data is transmitted; Google may log your IP address as part of standard server logging
• Cloudflare CDN -- if you consent to optional resources, Leaflet.js and Chart.js are fetched from Cloudflare's content delivery network. Cloudflare does not set tracking cookies and no personal data is transmitted
• Google Analytics (Google LLC / Google Ireland Ltd) -- only if you choose "Accept all" on our cookie banner. Google receives information about the pages you visit, how you arrived (for example, which advert you clicked), your device and browser, your IP address, and whether you created an account, chose a paid plan or started a trial or subscription (with the plan type and price only). We use this to understand how the Service is used and to measure our marketing. We do not send Google your name, email address or golf data
• Meta Pixel (Meta Platforms Ireland Ltd) -- only if you choose "Accept all" on our cookie banner. Meta receives the same kind of information as Google Analytics above, which lets us measure which Facebook and Instagram adverts lead to sign-ups and helps Meta show our adverts to people likely to be interested. Meta may link this to your Facebook or Instagram account if you have one, under Meta's Privacy Policy. We do not send Meta your name, email address or golf data
• HeyCatch (HeyCatch, Inc., USA) -- product analytics, only if you choose "Accept all" on our cookie banner. HeyCatch receives the pages you visit, which buttons and links you click (but not the text on them), how you arrived (for example, which advert or link you followed), your device and browser, and your IP address. If you are signed in, it also receives your SQR1 Golf user ID (a number, not your name or email), your plan and account type, and the date you signed up, plus when you create an account or start a trial or subscription. We use this to understand how the Service is used, find where people get stuck, and measure our marketing. HeyCatch acts as our processor under its data processing agreement. It stores this data with its sub-processor PostHog in the United States and, for some analysis features, may pass it through OpenRouter to AI model providers, which are not allowed to use it to train their models. We do not send HeyCatch your name, email address or golf data, and we do not record your screen. HeyCatch's privacy policy is at heycatch.ai/privacy
• Mapping tile providers -- anonymised tile requests are made to generate satellite imagery for the course planner. No personal data is transmitted
• Prize fulfilment -- if you win a giveaway, your name, delivery address and contact number are shared with the courier or supplier delivering your prize, only for that purpose
• Your coach -- if you establish a coaching relationship through the Service, your coach will have access to your golf performance data as displayed within the coaching dashboard. You control this relationship and may end it at any time
• Ambassadors -- if your subscription came through one of our ambassadors, they see only totals, such as how many people subscribed in a month, the revenue and their commission. We never give them your name, email address, username or anything else about you
• Other members (drills) -- if you are a coach and publish a drill, the drill (including its photos and video link) and your name are visible to logged-in coaches and members on a paid plan, who can save it. Unpublished drills are visible only to the clients you assign them to, and the note and date you add when assigning a drill are visible only to that client. Drills are never shown to people who are not logged in. Ratings are anonymous: coaches and other members only see a drill's average rating and number of ratings, never who gave them, and a coach's profile may show the average rating across their published drills. If you report a drill, the coach is not told who reported it
• YouTube (Google) and Vimeo -- some drills include a video hosted on YouTube or Vimeo. Nothing is loaded from either service until you press play on a video. When you do, your browser connects to that service directly: the video plays in YouTube's privacy-enhanced (no-cookie) player or in Vimeo's player with "do not track" switched on, and the service receives your IP address and device and browser information. YouTube (Google) and Vimeo decide how they use that information as independent controllers under their own privacy policies (policies.google.com/privacy, vimeo.com/privacy). We do not send them any of your account information. If you'd rather they didn't receive this, don't press play on drill videos

We may disclose your data if required to do so by law, or in response to a valid legal request from a regulatory authority or law enforcement agency.

5a. hCaptcha

We use the hCaptcha security service (operated by Intuition Machines Inc., Delaware, USA) on our registration page to protect against automated sign-ups and abuse. hCaptcha's use of your data is governed by their Privacy Policy and Terms of Service.

When you complete the hCaptcha verification, the following data may be collected and processed by Intuition Machines Inc.:

• IP address
• Browser type and version
• Mouse movements and interaction patterns (used for bot detection)
• Time spent on the verification task

This processing is necessary for our legitimate interest in protecting the Service from automated abuse. hCaptcha does not use this data for advertising purposes. For more information visit hcaptcha.com/privacy.

5b. International Data Transfers

SQR1 Golf is operated from the United Kingdom. However, some of our third-party service providers process your personal data on servers located in the United States and other countries outside the UK. Under UK GDPR, transferring personal data to a country without an adequacy decision requires an appropriate legal safeguard.

We rely on the following mechanisms to ensure your data receives adequate protection when transferred outside the UK:

• UK-US Data Bridge -- the UK Government has recognised the UK Extension to the EU-US Data Privacy Framework (known as the UK-US Data Bridge) as providing adequate protection for personal data transferred from the UK to certified US organisations. Our key providers -- including Amazon Web Services (Railway's infrastructure) and Stripe -- are certified under this framework
• UK International Data Transfer Agreements (IDTAs) / Standard Contractual Clauses -- where a provider is not covered by an adequacy decision or the UK-US Data Bridge, we rely on contractual protections in the form of IDTAs or equivalent Standard Contractual Clauses incorporated into our Data Processing Agreements with those providers

The following providers process data outside the UK:

• Railway / Amazon Web Services -- United States. Transfer basis: UK-US Data Bridge (AWS certification) and AWS Data Processing Addendum
• Stripe -- United States. Transfer basis: UK-US Data Bridge (Stripe certification) and Stripe Data Processing Agreement
• SendGrid (Twilio) -- United States. Transfer basis: Standard Contractual Clauses / IDTA incorporated in Twilio's Data Processing Addendum
• Sentry (Functional Software, Inc.) -- error reports are stored in the European Union (Germany), which the UK recognises as providing adequate protection for personal data. Sentry is a US company, so its staff may access this data from the United States to provide support; that access is covered by Standard Contractual Clauses with the UK Addendum, incorporated in Sentry's Data Processing Addendum
• hCaptcha (Intuition Machines Inc.) -- United States. Transfer basis: Standard Contractual Clauses incorporated in hCaptcha's terms
• Cloudflare -- global infrastructure. Transfer basis: Cloudflare's Data Processing Addendum incorporating Standard Contractual Clauses
• Google (Google Analytics) -- United States, only if you choose "Accept all". Transfer basis: UK-US Data Bridge (Google certification) and Google's data processing terms
• Meta Platforms -- United States, only if you choose "Accept all". Transfer basis: UK-US Data Bridge (Meta certification) and Meta's data transfer terms
• HeyCatch, Inc. (and its sub-processors, including PostHog and, for AI analysis features, OpenRouter and the model providers it uses) -- United States, only if you choose "Accept all". Transfer basis: Standard Contractual Clauses (EU 2021/914) with the UK International Data Transfer Addendum, incorporated in HeyCatch's Data Processing Agreement
• Drill videos (YouTube and Vimeo) -- if you press play on a drill video, your browser connects directly to YouTube (Google) or Vimeo, which may process your information in the United States or other countries. This is not a transfer made by us: each service is responsible for protecting your information under its own privacy policy (see section 5 above)

We take reasonable steps to satisfy ourselves that our service providers implement appropriate technical and organisational measures to protect your personal data in line with UK GDPR standards. You may request further information about the specific safeguards we have in place by contacting us at privacy@sqr1golf.com.

5c. Giveaways & Competitions

From time to time we run giveaways open to new accounts. Each has its own terms and conditions, linked from the giveaway page. Entering is optional and does not sign you up to marketing emails.

• What we record -- your email address, plan, number of entries, your answer to the skill question and when you gave it, and whether your entry is confirmed
• Why -- to run the giveaway you entered under its terms (contract), and to prevent duplicate or fraudulent entries (legitimate interests). Only one entry is allowed per email address, so if you delete your account during a giveaway we keep your entry record, marked as void, so the same email address cannot enter that giveaway again
• The draw -- winners are selected at random by computer from eligible entries. Being selected or not selected has no other effect on your account
• Winners -- we use the winner's contact details to arrange the prize, and may ask for proof of age, identity and residence. We publish the winner's first name, surname initial and county, and make their surname and county available on request, as required by the UK Code of Non-broadcast Advertising (CAP Code). Winners can object to publication when accepting the prize; we may still have to share these details with the Advertising Standards Authority if asked
• How long we keep it -- entry records are deleted 6 months after the draw, or once any dispute about that giveaway is resolved if later. Winners' delivery details are deleted once the prize has been delivered and the claim period has ended

5d. Ambassadors

Our ambassadors are golf professionals and coaches who recommend SQR1 Golf. Each has their own discount codes, and we pay them a share of the subscription money from the customers they bring in.

• If you subscribed through an ambassador -- when you subscribe with an ambassador's code, we record the code and link your subscription to that ambassador. We may also link it by hand if the ambassador introduced you to SQR1 Golf but you used a different code. We then record each payment on that subscription (the amount, Stripe's fee and any refund) for the period the ambassador earns commission on it, usually 12 months from your first payment
• Checks -- to make sure a referral qualifies, we check whether your account has had a paid subscription or free trial before, whether you were referred before, and that you aren't the ambassador themselves
• What the ambassador sees -- only totals: the number of new and active subscribers, revenue and commission. Never your name, email address, username, golf data or anything that identifies you. Only our staff can see which accounts are linked to which ambassador
• Why -- this is in our legitimate interests: paying the people who recommend us accurately and preventing fraudulent referrals. It doesn't change what you pay or how the Service works for you. You can object (Section 7); if you do, we stop linking your subscription to the ambassador, though records of commission already paid are kept as financial records
• How long we keep it -- see Section 6 (ambassador referral records)
• If you are an ambassador -- we hold the details in your ambassador agreement (name, address, email, bank details, invoices and commission statements) and use them to run the agreement, pay you and keep the records the law requires. Your bank details are used only to pay you
• Our Ambassadors page -- with your agreement, we publish your name, role, photo and approved biography, and any Instagram handle, website and discount code you give us, on our Our Ambassadors page. Your photo is stored on Cloudflare R2, like profile pictures. Your profile comes off the page automatically on the day your agreement ends, and you can ask us to change it, or to delete your photo and biography, at any time
• How long we keep ambassador records -- your agreement, invoices, commission statements and payment records are kept for 7 years after the agreement ends, for tax and legal reasons. Your ambassador agreement explains this in full

6. How Long We Keep Your Data

We retain your data for as long as your account is active. When you delete your account, most of your data is deleted immediately and permanently -- there is no recovery window, and deleting your account cannot be undone. A small number of specific data categories are retained for a further limited period afterwards, for the particular reasons set out below -- never as a blanket default.

• Golf performance data (rounds, stats, club distances, yardage books, mapped courses, simulator and launch-monitor data) -- retained for the lifetime of your account, then permanently deleted immediately on account deletion. No retention window applies to this data
• Account and profile data (name, location, home club, preferences) -- retained for the lifetime of your account, then permanently deleted immediately on account deletion
• Coaching relationship data -- retained while the relationship is active; deleted when the relationship is ended or either party's account is closed
• Training data -- a drill (including its photos) is kept until the coach deletes it or closes their account. A drill assigned to you, with its note and date, is removed when you or your coach removes it, when the coaching relationship ends, or when either account is closed. A saved drill is removed when you remove it, or when the coach unpublishes or deletes it. A rating is kept until you remove it, the drill is deleted, or your account is closed. A report about a drill counts as a report about the coach: it, and the copy of the drill saved with it, are kept under the rules for user reports below, even if the drill is later changed or deleted
• Terms and Privacy acceptance records -- each time you agree to our Terms of Service or this Privacy Policy we record which version you agreed to, the date and time, your IP address and your browser. We keep these records for the lifetime of your account and for 6 years after it is deleted, so that we can show what was agreed if there is ever a dispute (Article 17(3)(e) UK GDPR). They are then deleted automatically
• Coach reviews and bug reports -- the content of reviews you have written and bugs you have reported is retained indefinitely so coaches keep an accurate review history and we retain a record of reported issues, but if you delete your account your identity is immediately removed from these records -- they remain, anonymised
• Points transaction history -- where your account had no history of reports, suspension, or bans, this is copied into a standalone billing record (not part of your account, which is itself immediately deleted) and retained for 90 days solely to allow us to resolve billing disputes, then deleted automatically. Where your account was reported, suspended, or banned at any point, your points history instead stays attached to your account record for as long as that record is retained (see below) -- it is not copied anywhere separate, and is deleted along with your account once its retention period ends
• User reports, blocks, and message threads -- deleted immediately along with everything else unless your account was reported by another user, or suspended or banned, at any point. Where that applies, these records are retained for 90 days from whichever is most recent of: the report being filed, the suspension/ban, or the deletion itself -- so this window can extend if further reports or actions occur. If your account was never reported or suspended, none of this data is retained beyond immediate deletion
• Financial transaction records (invoices, tax-relevant records) -- retained for 7 years as required by HMRC rules, even after account deletion. This is separate from the points transaction history above
• Ambassador referral records (the code used, your Stripe customer and subscription references, and the payments, fees and commission recorded) -- kept while the referral earns commission and then for 7 years as financial records, as HMRC requires. If you delete your account, the link between these records and your account is removed straight away
• Giveaway entry records -- deleted 6 months after the relevant draw (or once any dispute is resolved, if later), including where you deleted your account during the giveaway; see Section 5c
• Incomplete paid sign-ups -- if you register for a paid plan but don't complete payment, the unfinished account (name, email, username and location) is automatically deleted after 7 days. Before deleting it, we check with Stripe, our payment provider, that no payment record exists for that email address
• Technical logs (including error reports held by Sentry) -- retained for a maximum of 90 days
• Product analytics held by HeyCatch -- kept by HeyCatch while we use its service and for up to 2 months after, then deleted or irreversibly anonymised. When you delete your account, we ask HeyCatch to delete the analytics linked to your user ID
• Marketing preference records -- retained for the lifetime of your account so we can honour your choices
• Administrative audit logs -- retained for 24 months from the date of each action to enable us to defend against payment disputes and demonstrate regulatory accountability. These logs may contain your user ID and Stripe customer reference but do not include your golf performance data. This retention is permitted under Article 17(3)(e) of UK GDPR for legal claims defence

When you delete your account, what happens depends on whether it has ever been reported by another user, or suspended or banned, at any point. If it hasn't, your account record is deleted outright, immediately, in the same action -- there is nothing left "deactivated" or held in reserve. Your points transaction history is separately copied into a standalone billing record, unconnected to your account, retained for 90 days purely to allow us to resolve billing disputes, on the legitimate-interest and Article 17(3)(e) legal-claims bases described in Section 4, then automatically deleted. If your account has at any point been reported or suspended/banned, it is instead deactivated rather than deleted outright: your golf performance data and account profile are still deleted straight away and cannot be recovered by re-registering, but the account record itself, along with your points transaction history, reports concerning you, blocks involving you, and your message threads, is additionally retained for 90 days from whichever is most recent of the report, the suspension/ban, or the deletion itself, on the legitimate-interest basis of investigating conduct concerns and protecting other users of the Service. During this window, the email address and username associated with the account cannot be used to create a new account; this is separate from, and in addition to, the inability to recover any of your deleted data by re-registering. During any such window your data is not used for any other purpose, such as marketing, and is not accessible to other users, including any coach you were previously connected to.

Once every applicable window above has elapsed, the remaining record of your account is automatically and permanently deleted from our systems, aside from administrative audit logs and financial records required by law, which are retained on the separate timelines described above.

7. Your Rights

Under UK GDPR you have the following rights:

• Right of access (Subject Access Request) -- you can request a copy of the personal data we hold about you. You can download much of your data immediately using the "Download My Data" feature in your account settings, which provides a machine-readable export. For a full Subject Access Request, contact us at the address below and we will respond within 30 days
• Right to rectification -- you can correct inaccurate personal data via your account settings at any time, or contact us if you need assistance
• Right to erasure -- you can delete your account at any time from the account settings page. This is immediate and irreversible for your golf performance and account data -- there is no recovery window, and re-registering does not restore it. If your account was ever reported or suspended/banned, the associated email address and username also cannot be reused for a new registration until the retention period below has ended. Points transaction history is retained for a further 90 days (as a standalone record for a clean account, or attached to your account record if it was ever reported or suspended/banned) purely to resolve billing disputes; if your account was ever reported or suspended/banned, reports/blocks/messages are also retained on the same basis, for 90 days from the most recent relevant event. All of this is then permanently and automatically deleted. If you would like any such residual data erased sooner, contact us at the address below and we will assess your request against our legitimate interests and legal obligations. Financial records required by law are exempt from erasure regardless of timing
• Right to restrict processing -- you can ask us to limit how we use your data in certain circumstances, for example while a rectification request is being resolved
• Right to data portability -- you can export your golf performance data in JSON format at any time from your account settings using the "Download My Data" feature
• Right to object -- you can object to processing based on legitimate interests. We will cease that processing unless we have compelling legitimate grounds that override your interests
• Right to withdraw consent -- where processing is based on consent (such as marketing emails), you can withdraw consent at any time from your account settings. This does not affect the lawfulness of processing before withdrawal
• Rights related to automated decision-making -- we do not make automated decisions with legal or significant effects about you

To exercise any of these rights, email us at privacy@sqr1golf.com. We will acknowledge your request within 5 working days and respond in full within one calendar month. You also have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

8. Cookies & Third-Party Resources

SQR1 Golf uses a small number of cookies and gives you control over optional third-party resources through a consent banner shown on your first visit.

Strictly necessary cookies -- we set two cookies that are essential for the Service to function: a session cookie (sessionid) that keeps you logged in, and a CSRF security token (csrftoken) that protects form submissions. These cannot be disabled.

Your consent choices -- on your first visit, a banner gives you three options:

• Essential only -- only the strictly necessary cookies above are active. The Service works fully. No connections are made to Google's font servers, any third-party CDN, Google Analytics, Meta or HeyCatch
• Fonts & maps only -- in addition to essential cookies, we load Google Fonts for typography, Leaflet.js for the course planner maps, and Chart.js for performance charts. These are fetched from Google's servers and Cloudflare's CDN respectively
• Accept all -- everything above, plus Google Analytics, the Meta Pixel and HeyCatch, which set analytics and advertising cookies (see Section 5 above and our Cookie Policy)

Drill videos -- videos in drills work separately from the choices above: a video is only loaded from YouTube or Vimeo when you press play on it. Once it plays, YouTube's privacy-enhanced player or Vimeo's player may store data in your browser under that provider's own policy.

Your consent preference is stored in your browser's localStorage (not as a cookie) and respected on all future visits. You can change it at any time from the "Change cookie settings" button on our Cookie Policy page.

Our registration page uses hCaptcha, which may set cookies or use browser storage as part of its human verification process. These are used solely for security purposes to distinguish humans from automated bots. hCaptcha's cookie usage is governed by Intuition Machines Inc's privacy policy at hcaptcha.com/privacy.

Apart from Google Analytics, the Meta Pixel and HeyCatch, which load only if you choose "Accept all", and any drill video you choose to play, we do not use advertising cookies, analytics cookies, or any third-party tracking scripts. For full details see our Cookie Policy.

9. Security

We take reasonable technical and organisational measures to protect your personal data, including:

• Passwords are hashed using Django's default PBKDF2 algorithm -- we cannot see your password in plain text
• All data is transmitted over HTTPS with TLS encryption
• Access to production systems and data is restricted to authorised personnel only
• Payment card data is handled entirely by Stripe and never touches our servers
• Regular backups are maintained to ensure data integrity and availability

No method of transmission over the internet is 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a prominent notice within the Service before the change takes effect. The date at the top of this page shows when the policy was last updated.

Continued use of the Service after changes are posted constitutes acceptance of the updated policy. If you do not agree with any changes, you may close your account at any time from the account settings page.