1. Our Commitment to GDPR
SmartCaddie.ai is committed to protecting the privacy and personal data of all users, including those in the
European Union (EU) and European Economic Area (EEA). We comply with the General Data Protection Regulation
(GDPR) and ensure your data rights are respected.
This page outlines how we meet GDPR requirements and explains your data protection rights under EU law.
For complete details about our data practices, please also review our Privacy Policy.
2. Data Controller Information
SmartCaddie.ai acts as the data controller for personal data collected through our service. This means we
determine how and why your personal data is processed.
Contact Information:
Website: smartcaddie.ai
Data Protection Inquiries: Available through account profile
3. Legal Basis for Processing
We process your personal data based on the following legal grounds under GDPR:
3.1 Contract Performance (Article 6(1)(b))
Processing necessary to provide our service to you:
- Creating and managing your account
- Recording your subscription status (the payment itself is processed by Apple or Google)
- Providing AI caddie recommendations and golf advice
- Tracking your rounds and performance data
- Delivering customer support
3.2 Legitimate Interests (Article 6(1)(f))
Processing necessary for our legitimate business interests:
- Improving our service and developing new features
- Analyzing usage patterns and service performance
- Preventing fraud and ensuring security
- Sending service announcements and important updates
3.3 Consent (Article 6(1)(a))
Processing based on your explicit consent:
- Marketing emails and promotional communications
- Location tracking for course detection (optional)
- Non-essential cookies and analytics
- Sharing success stories and testimonials
3.4 Legal Obligation (Article 6(1)(c))
Processing required to comply with legal obligations:
- Tax and accounting records
- Responding to legal requests and court orders
- Complying with financial regulations
4. Your GDPR Rights
Under GDPR, you have the following data protection rights:
Right to Access (Article 15)
You can request a copy of all personal data we hold about you, including your profile, round history, and usage data.
Right to Rectification (Article 16)
You can update or correct inaccurate personal data through your account settings or by contacting us.
Right to Erasure / "Right to be Forgotten" (Article 17)
You can request deletion of your personal data when it's no longer necessary or if you withdraw consent.
Note: Some data may be retained for legal or legitimate business purposes.
Right to Restrict Processing (Article 18)
You can request that we limit how we use your data in certain circumstances (e.g., while disputing accuracy).
Right to Data Portability (Article 20)
You can request your data in a machine-readable format (JSON) to transfer to another service.
Right to Object (Article 21)
You can object to processing based on legitimate interests or for direct marketing purposes.
Rights Related to Automated Decision-Making (Article 22)
Our AI provides recommendations, but does not make automated decisions with legal or significant effects.
You always maintain control over your golf strategy decisions.
Right to Withdraw Consent (Article 7(3))
You can withdraw consent at any time (e.g., unsubscribe from marketing emails, disable location tracking).
This does not affect the lawfulness of processing before withdrawal.
5. How to Exercise Your Rights
Self-Service Options
You can exercise many rights directly through your SmartCaddie.ai account:
- Profile Settings: Update your personal information and preferences
- Privacy Settings: Control location tracking and data sharing
- Data Export: Download your complete data in JSON format
- Account Deletion: Permanently delete your account and data
- Email Preferences: Manage marketing and notification settings
Contact Us for Assistance
For assistance with data protection rights, submit a support ticket through your profile:
- Go to Profile → Support
- Select "Data Protection / Privacy Request"
- We will respond within 30 days as required by GDPR
6. Data Retention
We retain personal data only as long as necessary for the purposes stated in our Privacy Policy:
- Active accounts: Data retained while your account is active
- Inactive accounts: We do not currently delete accounts for inactivity. Your
data stays until you ask us to remove it.
- Deleted accounts: When you delete your account we remove your user record and
the data attached to it (profile, clubs, rounds, shots, conversations) from our live database
immediately. Encrypted backups are rotated and any residual copies age out within 90 days.
- Financial records: We do not hold them. Apple and Google are the merchant of
record and keep the payment records under their own policies. We hold only a transaction
identifier and your subscription status.
- Support tickets: Retained for 2 years for quality assurance
7. International Data Transfers
SmartCaddie.ai may transfer your personal data outside the EU/EEA to provide our services. When we do:
- SmartCaddie.ai is based in New Jersey, United States, and our service runs there. Using
SmartCaddie necessarily means transferring your data to the US.
- We rely on your explicit consent and on the necessity of the transfer to perform our contract
with you — GDPR Article 49(1)(a) and (b) — as the basis for that transfer. This matches the
International Data Transfers section of our Privacy Policy.
- Where one of our infrastructure providers offers Standard Contractual Clauses as part of its
data processing agreement, those apply to that provider in addition.
- We implement safeguards including encryption in transit and at rest, and access controls.
- Apple and Google are not our processors. When you buy a subscription you
transact with them directly and they act as independent controllers of your payment data
under their own privacy policies. We are not the transferor of that data and never receive it.
Our primary service providers include:
- Cloud hosting providers with EU data centers
- Apple and Google (subscription purchase and billing, as merchant of record —
they receive your payment details directly; we do not)
- CDN providers for content delivery
8. Data Security Measures
We implement appropriate technical and organizational measures to protect your data:
- Encryption: TLS/SSL for data in transit, AES-256 for data at rest
- Access controls: Role-based access and multi-factor authentication
- Regular audits: Security reviews and penetration testing
- Incident response: 72-hour breach notification as required by GDPR
- Staff training: Regular data protection training for all team members
- Data minimization: We only collect data necessary for our service
9. Data Breach Notification
In the unlikely event of a data breach that poses a risk to your rights and freedoms:
- We will notify the relevant supervisory authority within 72 hours
- We will notify affected users without undue delay
- We will provide information about the breach, its impact, and remediation steps
- We will take immediate action to contain and remedy the breach
10. Right to Lodge a Complaint
If you believe we have not handled your personal data properly, you have the right to lodge a complaint with
your local data protection authority (supervisory authority) in the EU/EEA.
However, we encourage you to contact us first so we can address your concerns directly.
Find your local supervisory authority: European Data Protection Board
11. Children's Privacy
SmartCaddie.ai does not knowingly collect data from children under 16 years of age (or the applicable age
in your jurisdiction). If we become aware that we have collected data from a child without proper consent,
we will delete it promptly. Parents or guardians can contact us if they believe a child has provided
personal data without consent.
12. Updates to GDPR Compliance
We regularly review and update our GDPR compliance practices. Material changes will be communicated through
email and prominently displayed on our website. Continued use of our service after changes indicates
acceptance of updated practices.
13. Contact Us
For questions about GDPR compliance or to exercise your data protection rights:
This GDPR Compliance page should be read in conjunction with our
Privacy Policy,
Terms of Service, and
Cookie Policy.