Privacy Policy
Last updated: October 2026 · pursuant to the GDPR
1. Controller
The controller within the meaning of the GDPR is:
Louis Konopatzki
Avenida Padua 3
1800-294 Lisbon
Portugal
Email: [email protected]
2. Data We Collect and Why
2.1 Reports (lost or found clubs)
When you submit a report, we store:
- Club type, brand/model, golf course, date
- Optional description and up to three photos
- Your email address (not publicly visible)
- Interface language and timestamp
- Serial number, if you provide one. It is never shown publicly and is used only for comparison.
- The page or campaign link that brought you to us. This shows us which routes lead golfers to us.
Legal basis: Art. 6(1)(b) GDPR.
Retention: After 360 days we close a report automatically. Before that you will receive an email and can extend it by another 360 days with a single click (legal basis for the extension: your active consent, Art. 6(1)(a) GDPR). That does not mean a closed report has been deleted. Your details, photos and email address stay stored until you request deletion (section 5a).
2.2 Photos
Uploaded photos are stored on our server and used solely to identify the club. They are kept for as long as the report is kept. If the report is deleted, we remove the photos from the server by the following night at the latest.
2.3 Email Notifications
Your email address is used only for confirmations, match notifications, and chat alerts. It is never shared with other users.
2.3a Inquiry to the golf club
If you lost a club at a particular course, we ask the office of that golf club whether it was handed in. For this, the golf club receives the type, brand and description and, for partner golf clubs, the first photo as well. It does not receive your email address.
Legal basis: Art. 6(1)(b) GDPR.
2.3b After a match
If a lost-club report and a found-club report fit together, you write to each other through our chat. The other side cannot see your email address. We store the messages, your description as proof of ownership and a photo if you send one along. The finder gets to see the description so that they can decide whether the club is yours. After the return, you can leave a review with stars, text and, if you wish, your first name. It is published only with your consent.
2.3c Notifications on your phone
If you turn on notifications, your browser or the app assigns its own receiving address for them. We store it together with your email address and your language. The notification travels encrypted through the push service of the browser vendor, which for Chrome and in the Android app is Google. It contains no details about your report. If you turn notifications off in your settings, the receiving address becomes invalid and we delete it at the next attempt.
Legal basis: Art. 6(1)(a) GDPR.
2.3d Golf clubs as partners
If a golf club registers as a partner, we store the name and email address of the person registering it, plus the golf club's name, website and language. The club office receives a personal link to the golf club portal. Found-club reports from the portal carry the golf club's email address. We show an uploaded logo on our public pages. When entering a find, the staff member may optionally add their first name. We store it with the find report and show it only in the club’s portal, so the office can see who entered which find. It never appears publicly.
Legal basis: Art. 6(1)(b) GDPR.
2.3e Reporting a found club by email
A partner golf club can also report a found club by sending us a photo by email. We then read the sender address and the attached photos. We use the sender address to assign the email to the golf club. The photos become a found-club report, just as through the golf club portal; for this they are transmitted to Anthropic as described in section 3. We do not copy the text of the email into the report. The golf club receives a confirmation by email. If an email cannot be assigned to a partner golf club, no report is created. We delete the email itself after one year. A found report by email is also created when a club we contacted about a loss on its course replies to that email with a photo; we then assign the email via the address we wrote to.
Legal basis: Art. 6(1)(b) GDPR; for a club we contacted, Art. 6(1)(f) GDPR (legitimate interest in returning the club to its owner).
2.3f Notes in the club portal
When a club office marks a find as returned, closed or edited in the club portal, we store the time, the type of change and – optionally – the first name of the staff member and a short note from the office. No data about the person collecting the club is recorded. These notes are deleted together with the report.
Legal basis: Art. 6(1)(b) GDPR.
2.3g Maps (OpenStreetMap)
On the world map, the club pages and in the club portal we show a map. Your browser loads the map tiles directly from the servers of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom). In doing so, the OpenStreetMap Foundation receives your IP address and the map section displayed. We do not transmit any further data. The EU Commission has issued an adequacy decision for the United Kingdom. More in the OpenStreetMap Foundation privacy policy.
Legal basis: Art. 6(1)(f) GDPR (clear presentation of golf courses).
2.3h Feedback in the club portal
At the end of the list of finds in the club portal, the club office can optionally say whether the portal was helpful that day and note in a short field (up to 120 characters) what is missing. We store the club, the date, the answer, the text and the portal language, but no names. We use this only to improve the portal; it never appears publicly. We accept one response per club and day. Please do not enter names or phone numbers in the field.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving the portal for golf clubs).
2.3i Suggesting your club ("My club should join")
On the page for members who want to suggest their club, we store the club name, the town, which templates you opened, the page language and a pseudonymised (hashed) form of your IP address to prevent abuse. No account and no name are needed. You can optionally enter an e-mail address so that we can write to you when your club joins. We use it for that purpose only and never pass it on to the club.
Legal basis: Art. 6(1)(a) GDPR (consent) for the e-mail address, Art. 6(1)(f) GDPR for the other details. Deletion: We remove the e-mail address whenever you ask (section 5a) or once your club has joined.
2.3j Club register (“My Bag”)
At /my-bag you can register your golf clubs in advance, voluntarily. We store your email address, and for each club its type, brand, model, serial number, distinguishing features and a photo, optionally a name for the set and your home club, plus timestamps. Access is a personal link sent by email (no account, no password); the link is remembered on your device as a cookie. From an entry you can file a lost report under 2.1 with one click. If someone files a found report with a serial number that matches one of your registered clubs, we email you about it. Serial numbers and entries are never shown publicly. Deletion: at any time via “Delete my whole set” on the page or under section 5a; entries without a single club are deleted automatically after 30 days.
Legal basis: Art. 6(1)(b) GDPR.
2.4 Server Log Files
Our host (Hostinger, Lõõtsa 5, Tallinn 11415, Estonia) automatically stores access data: IP address, date and time, URL, and HTTP status code. This data is deleted after 7 days.
Legal basis: Art. 6(1)(f) GDPR.
2.5 Cookies
| Cookie | Purpose | Duration |
|---|---|---|
PHPSESSID | Session (CSRF protection) | Browser session |
lang | Language preference | 30 days |
No tracking, analytics, or advertising cookies are set.
We count page views and individual clicks as a daily total per page and language. To filter out bots, we also count which browser identifiers occurred on a given day. None of these figures can be linked to a person, a device or an IP address.
2.6 QR Protection Tags
If you create personal QR tags (the "QR protection tags" feature), we store your email address, an optional first name, and a random tag code so we can notify you instantly when someone scans a found club. Your email is never shown to the finder.
Legal basis: Art. 6(1)(b) GDPR. Deletion: at any time upon request to [email protected].
2.7 Success Stories
If you voluntarily submit a story after a successful return, we store your text and optionally your first name. Stories approved by our team appear publicly on the homepage (first name only).
Legal basis: Art. 6(1)(a) GDPR (consent, revocable at any time).
2.8 Help Chatbot
Questions to our AI chatbot are transmitted to Anthropic (Claude AI, see section 3) to generate an answer and are logged by us to improve the service. Please do not enter sensitive personal data into the chat.
Legal basis: Art. 6(1)(f) GDPR.
If you write to us through the help form, your message and your email address reach us as an email. We use them only to reply.
2.9 Abuse Protection (Rate Limiting)
To prevent spam and automated scraping, we briefly store a hashed (anonymized) form of your IP address to limit the number of requests per connection.
Legal basis: Art. 6(1)(f) GDPR. Deletion: automatically after no more than 2 days.
2.10 Letters to club officials
Occasionally we introduce our free lost-and-found service to golf clubs by letter. For this we use the name and role of the person who represents the club publicly (such as the president, chair or general manager), as published in the club's legal notice or on the board page of its website, together with the club's postal address.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to inform a club about a service for its members. We do not keep the names in our database; we hold them only for that mailing and delete them no later than three months afterwards. Printing and posting is done by the service provider LetterXpress as a processor. You can object at any time (Art. 21 GDPR): an e-mail to [email protected] is enough, and we will not write to you or the club again. Your other rights are set out in section 5.
3. Third-Party Services
Claude AI (Anthropic)
For intelligent matching of reports (comparing descriptions) and for the help chatbot we use Claude AI by Anthropic PBC, USA. The relevant description or chat text is transmitted. Legal basis: Art. 6(1)(f) GDPR. Anthropic Privacy Policy
In addition to text, any photos uploaded with a report are also transmitted to Anthropic — both while you fill out the form (automatic detection of type, brand, and model) and when a found-club report is compared with a lost-club report. If you use the translation feature in the contact chat, the content of your message is transmitted as well. Please do not upload photos showing people, license plates, or personal details.
OpenAI (voice features of the chat)
The help chat can read answers aloud and take questions through the microphone. Both are optional and only active when you switch them on. If you turn on "read answers aloud", we transmit the text of the respective answer to OpenAI, L.L.C. (USA) to generate speech from it. If you use the microphone in a browser without its own speech recognition (for example Firefox), we record your question and transmit the recording to OpenAI, which converts it into text. We do not store the recording; it is discarded after conversion. In Chrome, Edge and Safari the browser recognises your speech itself – then no recording leaves your device. Legal basis: Art. 6(1)(a) GDPR (consent by switching on, can be switched off at any time). OpenAI privacy policy
Cloudflare
To protect against attacks and for faster, global delivery, our traffic runs through Cloudflare, Inc. (USA), which processes your IP address. Legal basis: Art. 6(1)(f) GDPR. Cloudflare Privacy Policy
Fonts
The fonts we use are hosted on our own server. Loading a page therefore establishes no connection to Google, and your IP address is not transmitted there.
Unsplash
Background images are loaded from Unsplash (Canada). Unsplash Privacy Policy
4. Data Sharing
Your data is not sold. It is shared only with the following processors (Art. 28 GDPR): Hostinger (hosting/SMTP), Brevo (email delivery, France), Cloudflare (security/CDN), and Anthropic (AI matching and chatbot), OpenAI (read-aloud and speech recognition in the chat) — and where required by law.
For notifications you have turned on, we pass the encrypted message on to your browser's push service (section 2.3c). What a golf club receives when we inquire is described in section 2.3a.
5. Your Rights (Art. 15–22 GDPR)
You have the right of access, rectification, erasure, restriction of processing, and objection, as well as the right to lodge a complaint with a supervisory authority.
Requests: [email protected]
5a. Having your data deleted
You can ask us to delete your data at any time. To do so, send an email to [email protected], ideally from the address in your report. We will do this within one month at the latest and confirm it to you by email.
For golfers, we delete all reports linked to this address, including photos, matches, chat messages and reviews, as well as QR tags and any notifications that are turned on.
For the club register (“My Bag”), we delete the whole set with all clubs, serial numbers and photos.
For golf clubs, we delete the contact person's name and email address, the access to the golf club portal, the logo and the golf club's found-club reports. The golf club's directory entry comes from public information on the golf club's website. On request, we take the golf club's page offline completely.
We put a golf club's address on our block list so that it no longer receives mail from us. It stays there for as long as the objection applies. Our host's log files expire by themselves after 7 days (section 2.4).
6. Data Security
Data is transmitted via HTTPS/TLS. Photos are stored with random filenames. PHP execution in the upload directory is disabled.
7. Changes
We reserve the right to update this policy when the service changes.