Privacy Policy
This policy explains what personal data Caddro ("we", "us") collects when you use the Caddro app and website (caddro.app, app.caddro.app, and the iOS/Android apps), why, and your rights under the UK GDPR and the Data Protection Act 2018.
1Who we are
Caddro is a golf performance app: it records your rounds, scores and handicap, tracks your equipment and goals, and offers AI-assisted insight. Myatt Management Services Limited is the data controller for the personal data described here.
2The data we collect
- Account data: email address and authentication details (sign-in is handled by our backend provider, Supabase).
- Golf data you create: rounds, hole-by-hole scores, putts, penalties, fairways/greens, handicap inputs, equipment ("The Locker"), season and lifetime goals, competition/society results, courses played.
- Wellness / health data (special category — see section 4): if you connect WHOOP or enter wellness details, we process readiness, sleep, recovery and related metrics.
- Images you upload: scorecard photos, Arccos screenshots, and swing videos/frames, used to extract data.
- Location data: approximate/precise device location only when you actively use GPS features (e.g. marking a tee/green or capturing weather). Not tracked in the background.
- Payment data: if you buy a Caddro plan or event credit, payments are processed by Stripe; we do not store your card details. We receive subscription/purchase status and limited billing metadata.
- Society payment data: if your golf society collects fees online, you pay the society (not Caddro) and Stripe processes the card payment into the society's own account (see section 5). We do not store your card details. We record, in the society's account, the payment's amount, the event or subscription it relates to, the date and status, and a Stripe checkout/payment reference so the society can reconcile who has paid. This information is visible to your society's organisers (see section 5a). If you set up online collection as an organiser, your business/identity verification is provided by you directly to Stripe; we do not see it. (Society online payments are not currently enabled.)
- Technical/usage data: device/browser information, and error and analytics data (see section 7) to keep the app working and improve it.
- Ask Caddro conversation history: the messages you exchange with the in-app Ask Caddro assistant. Stored per-user — on your device and, when you are signed in, in your account so the conversation continues across your devices — so the assistant can follow the thread instead of starting cold. It may reference wellness topics if you raise them (see section 4). It is never shared with other users and is not used to train AI models. Only the most recent part of the thread is sent to the AI provider (section 5); see section 9 for retention and how to clear it.
3Why we use it and our lawful basis (UK GDPR Art. 6)
| Purpose | Lawful basis |
|---|---|
| Provide the core app (store your rounds, compute handicap, sync across devices) | Contract (Art. 6(1)(b)) |
| Process payments and manage plans/purchases | Contract |
| Facilitate society online payments and record payment status for the society | Legitimate interests (Art. 6(1)(f)) — enabling societies to collect and reconcile member fees; the payment itself is a contract between you and your society |
| AI features (caddie insight, image extraction, coaching) | Contract, and consent where it involves health data (section 4) |
| Keep the service secure, prevent abuse, fix errors | Legitimate interests (Art. 6(1)(f)) |
| Product analytics and improvement | Consent (analytics/non-essential) — see section 7 |
| Legal/accounting/tax obligations | Legal obligation (Art. 6(1)(c)) |
4Special-category (health) data — important
WHOOP/wellness metrics (readiness, sleep, recovery) are health data and count as special-category data under UK GDPR Art. 9.
We process them only where you have given explicit consent by connecting the integration or entering the data, for the purpose of showing you wellness-related golf insight. You can withdraw consent at any time by disconnecting the integration and deleting the data (section 8). If you discuss wellness/recovery in the Ask Caddro assistant, that conversation may contain health-adjacent content; it is processed on the same explicit-consent basis, only the most recent part of the thread is sent to the AI provider for continuity, and you can erase it at any time (section 9).
5Who we share it with (processors / sub-processors)
We use trusted third parties to run the service. Each processes data on our instructions:
- Supabase — database, authentication, storage (your account and golf data).
- Vercel — web app hosting (
app.caddro.app). - Cloudflare — website hosting (
caddro.app), content delivery and network security. - OpenAI and Anthropic — AI features. When you use the AI caddie, coaching, or image extraction, the relevant text/images and golf context are sent to our AI providers (OpenAI, and Anthropic for some image-extraction features) to generate a response. This involves a transfer outside the UK (see section 6).
- Stripe — payment processing. For Caddro plans and purchases, Stripe acts as our processor. For society online payments (Stripe Connect), the payment is between you and your society, and Stripe and the society each act as independent controllers of that payment; Caddro processes only the limited payment metadata above to show status and help the society reconcile its records.
- WHOOP / Arccos — only if you connect them, to import your data.
- GolfCourseAPI / UK Golf Course Data API — to look up course/scorecard data.
- Resend — transactional email (e.g. society invitations and notifications).
- IONOS — delivery of account and security emails (e.g. your sign-in confirmation email).
- Google Maps / Esri — map display (only on map views), and YouTube for in-app video search.
We do not sell your personal data.
5a. Data shared within a society you join
If you are a member of a golf society on Caddro, some of your data is visible to that society's organisers and, where relevant, its members — for example your name and handicap, your event RSVPs and results, and your payment status (what you owe and whether you have paid) in the society's roster and ledger. Organisers use this to run the society. The society is responsible for how it uses your information within Caddro. If you have a concern about a society's use of your data, contact the society's organiser or us at support@caddro.co.uk.
6International transfers
Some providers (notably OpenAI and Anthropic, and potentially others) process data outside the UK, including in the United States. Where they do, transfers are protected by appropriate safeguards such as the UK International Data Transfer Agreement / Addendum to the EU SCCs or an adequacy decision.
7Cookies & analytics
The app uses storage necessary to function (e.g. keeping you signed in and caching your data offline). Any non-essential analytics or tracking is used only with your consent, which you can give or decline via the in-app consent control. Our website (caddro.app) uses Cloudflare Web Analytics, which is privacy-friendly and sets no tracking cookies and does no cross-site fingerprinting.
8Your rights
Under UK GDPR you can: access a copy of your data; correct it; delete it ("right to erasure"); export it (portability); restrict or object to processing; and withdraw consent. To exercise any right, use the in-app account controls or email support@caddro.co.uk. We aim to respond within one month. You can also complain to the Information Commissioner's Office (ICO) — ico.org.uk.
9Data retention
We keep your data while your account is active. If you delete your account, we delete or anonymise your personal data within 30 days, except where we must keep records for legal/accounting reasons (e.g. transaction records for 6 years). Society payment records (amount, event, date, status and Stripe reference) are held in the society's account for its own accounting and may be retained by the society and by Stripe under their own retention and legal obligations even after you leave the society or delete your Caddro account.
Ask Caddro conversation history is kept only to maintain continuity: it is capped to the most recent messages, auto-expires after 90 days of inactivity, and you can clear it instantly with "Clear conversation" in the assistant (removing it from your device and your account). It is deleted when you delete your account.
10Security
We use industry-standard measures (encryption in transit, access controls, our providers' security). No system is perfectly secure; you're responsible for keeping your login safe.
11Children
Caddro is not intended for children under 16. We do not knowingly collect data from children under that age.
12Changes
We may update this policy; we'll post the new version with a revised effective date and, for material changes, notify you in-app or by email.
13Contact
Myatt Management Services Limited, 19 Viceroy Close, Brockworth, Gloucester, England, GL3 4ZA · support@caddro.co.uk · ICO ref CSN6076276.