Privacy Policy
Last updated: October 2026 · pursuant to the GDPR
1. Controller
The controller within the meaning of the GDPR is:
Louis Konopatzki
Avenida Padua 3
1800-294 Lisbon
Portugal
Email: [email protected]
2. Data We Collect and Why
2.1 Reports (lost or found clubs)
When you submit a report, we store:
- Club type, brand/model, golf course, date
- Optional description and up to three photos
- Your email address (not publicly visible)
- Interface language and timestamp
- Serial number, if you provide one. It is never shown publicly and is used only for comparison.
- The page or campaign link that brought you to us. This shows us which routes lead golfers to us.
Legal basis: Art. 6(1)(b) GDPR.
Retention: After 360 days we close a report automatically. Before that you will receive an email and can extend it by another 360 days with a single click (legal basis for the extension: your active consent, Art. 6(1)(a) GDPR). That does not mean a closed report has been deleted. Your details, photos and email address stay stored until you request deletion (section 5a).
2.2 Photos
Uploaded photos are stored on our server and used solely to identify the club. They are kept for as long as the report is kept. If the report is deleted, we remove the photos from the server by the following night at the latest.
2.3 Email Notifications
Your email address is used only for confirmations, match notifications, and chat alerts. It is never shared with other users.
2.3a Inquiry to the golf club
If you lost a club at a particular course, we ask the office of that golf club whether it was handed in. For this, the golf club receives the type, brand and description and, for partner golf clubs, the first photo as well. It does not receive your email address.
Legal basis: Art. 6(1)(b) GDPR.
2.3b After a match
If a lost-club report and a found-club report fit together, you write to each other through our chat. The other side cannot see your email address. We store the messages, your description as proof of ownership and a photo if you send one along. The finder gets to see the description so that they can decide whether the club is yours. After the return, you can leave a review with stars, text and, if you wish, your first name. It is published only with your consent.
2.3c Notifications on your phone
If you turn on notifications, your browser or the app assigns its own receiving address for them. We store it together with your email address and your language. The notification travels encrypted through the push service of the browser vendor, which for Chrome and in the Android app is Google. It contains no details about your report. If you turn notifications off in your settings, the receiving address becomes invalid and we delete it at the next attempt.
Legal basis: Art. 6(1)(a) GDPR.
2.3d Golf clubs as partners
If a golf club registers as a partner, we store the name and email address of the person registering it, plus the golf club's name, website and language. The club office receives a personal link to the golf club portal. Found-club reports from the portal carry the golf club's email address. We show an uploaded logo on our public pages. When entering a find, the staff member may optionally add their first name. We store it with the find report and show it only in the club’s portal, so the office can see who entered which find. It never appears publicly.
Legal basis: Art. 6(1)(b) GDPR.
2.3e Reporting a found club by email
A partner golf club can also report a found club by sending us a photo by email. We then read the sender address and the attached photos. We use the sender address to assign the email to the golf club. The photos become a found-club report, just as through the golf club portal; for this they are transmitted to Anthropic as described in section 3. We do not copy the text of the email into the report. The golf club receives a confirmation by email. If an email cannot be assigned to a partner golf club, no report is created. We delete the email itself after one year. A found report by email is also created when a club we contacted about a loss on its course replies to that email with a photo; we then assign the email via the address we wrote to.
Legal basis: Art. 6(1)(b) GDPR; for a club we contacted, Art. 6(1)(f) GDPR (legitimate interest in returning the club to its owner).
2.4 Server Log Files
Our host (Hostinger, Lõõtsa 5, Tallinn 11415, Estonia) automatically stores access data: IP address, date and time, URL, and HTTP status code. This data is deleted after 7 days.
Legal basis: Art. 6(1)(f) GDPR.
2.5 Cookies
| Cookie | Purpose | Duration |
|---|---|---|
PHPSESSID | Session (CSRF protection) | Browser session |
lang | Language preference | 30 days |
No tracking, analytics, or advertising cookies are set.
We count page views and individual clicks as a daily total per page and language. To filter out bots, we also count which browser identifiers occurred on a given day. None of these figures can be linked to a person, a device or an IP address.
2.6 QR Protection Tags
If you create personal QR tags (the "QR protection tags" feature), we store your email address, an optional first name, and a random tag code so we can notify you instantly when someone scans a found club. Your email is never shown to the finder.
Legal basis: Art. 6(1)(b) GDPR. Deletion: at any time upon request to [email protected].
2.7 Success Stories
If you voluntarily submit a story after a successful return, we store your text and optionally your first name. Stories approved by our team appear publicly on the homepage (first name only).
Legal basis: Art. 6(1)(a) GDPR (consent, revocable at any time).
2.8 Help Chatbot
Questions to our AI chatbot are transmitted to Anthropic (Claude AI, see section 3) to generate an answer and are logged by us to improve the service. Please do not enter sensitive personal data into the chat.
Legal basis: Art. 6(1)(f) GDPR.
If you write to us through the help form, your message and your email address reach us as an email. We use them only to reply.
2.9 Abuse Protection (Rate Limiting)
To prevent spam and automated scraping, we briefly store a hashed (anonymized) form of your IP address to limit the number of requests per connection.
Legal basis: Art. 6(1)(f) GDPR. Deletion: automatically after no more than 2 days.
3. Third-Party Services
Claude AI (Anthropic)
For intelligent matching of reports (comparing descriptions) and for the help chatbot we use Claude AI by Anthropic PBC, USA. The relevant description or chat text is transmitted. Legal basis: Art. 6(1)(f) GDPR. Anthropic Privacy Policy
In addition to text, any photos uploaded with a report are also transmitted to Anthropic — both while you fill out the form (automatic detection of type, brand, and model) and when a found-club report is compared with a lost-club report. If you use the translation feature in the contact chat, the content of your message is transmitted as well. Please do not upload photos showing people, license plates, or personal details.
Cloudflare
To protect against attacks and for faster, global delivery, our traffic runs through Cloudflare, Inc. (USA), which processes your IP address. Legal basis: Art. 6(1)(f) GDPR. Cloudflare Privacy Policy
Fonts
The fonts we use are hosted on our own server. Loading a page therefore establishes no connection to Google, and your IP address is not transmitted there.
Unsplash
Background images are loaded from Unsplash (Canada). Unsplash Privacy Policy
4. Data Sharing
Your data is not sold. It is shared only with the following processors (Art. 28 GDPR): Hostinger (hosting/SMTP), Brevo (email delivery, France), Cloudflare (security/CDN), and Anthropic (AI matching and chatbot) — and where required by law.
For notifications you have turned on, we pass the encrypted message on to your browser's push service (section 2.3c). What a golf club receives when we inquire is described in section 2.3a.
5. Your Rights (Art. 15–22 GDPR)
You have the right of access, rectification, erasure, restriction of processing, and objection, as well as the right to lodge a complaint with a supervisory authority.
Requests: [email protected]
5a. Having your data deleted
You can ask us to delete your data at any time. To do so, send an email to [email protected], ideally from the address in your report. We will do this within one month at the latest and confirm it to you by email.
For golfers, we delete all reports linked to this address, including photos, matches, chat messages and reviews, as well as QR tags and any notifications that are turned on.
For golf clubs, we delete the contact person's name and email address, the access to the golf club portal, the logo and the golf club's found-club reports. The golf club's directory entry comes from public information on the golf club's website. On request, we take the golf club's page offline completely.
We put a golf club's address on our block list so that it no longer receives mail from us. It stays there for as long as the objection applies. Our host's log files expire by themselves after 7 days (section 2.4).
6. Data Security
Data is transmitted via HTTPS/TLS. Photos are stored with random filenames. PHP execution in the upload directory is disabled.
7. Changes
We reserve the right to update this policy when the service changes.