Privacy policy
Rate My Divots
Last updated: 12 October 2026
This policy explains what personal data Rate My Divots collects, why we collect it, and what your rights are. We've tried to write it in plain English.
1. Who we are
Rate My Divots ("we", "us", "our") operates the website and web application at RateMyDivots.com.
Data controller: Robert Hollinshead, operating as Rate My Divots (sole trader)
Contact for privacy queries: privacy@ratemydivots.com
We are the data controller for the personal data described in this policy.
2. What data we collect
2.1 Information you give us
When you sign up for beta access, we collect:
- Your name — so we can address you properly in communications
- Your email address — so we can contact you about beta access
- Your golf handicap — so we can understand who our early users are
You provide this voluntarily. You do not have to sign up to use the publicly available parts of the site.
2.2 Location information
The Divot Conditions tool needs to know which golf course you're asking about. Depending on how you use the site:
- You may select a course from a list, in which case we do not collect your device location at all; or
- You may allow your browser to share your approximate location so we can suggest nearby courses. Your browser will ask your permission first, and you can refuse or revoke this at any time in your browser settings.
Where location is used, it is used to generate your conditions rating in that moment. We do not build a location history against you.
2.3 Analytics data
We use Vercel Web Analytics to understand how the site is used — for example, which pages are visited and how the site performs.
Vercel Web Analytics is designed to be privacy-preserving: it does not set cookies, does not fingerprint your browser, and does not track you across other websites. The data we see is aggregated — page views, approximate country, device type, referrer — and does not identify you individually.
2.4 Technical data
Like any website, our hosting infrastructure processes technical information necessary to deliver the site to you, such as your IP address and browser type. This is a necessary part of how the internet works.
2.5 What we do NOT collect
- We do not collect payment or card details.
- We do not use advertising or cross-site tracking cookies.
- We do not buy personal data from third parties.
- We do not knowingly collect data from children (see section 9).
3. Why we use your data, and our legal basis
Under UK GDPR we must have a lawful basis for processing your personal data. Ours are:
| What we do | Why | Lawful basis |
|---|---|---|
| Store your beta sign-up details | To manage the beta waiting list and give you access | Consent — you chose to sign up |
| Email you about beta access and product updates | To tell you when the app is ready and how it's developing | Consent — you can withdraw this at any time |
| Aggregate handicap data | To understand our user base and shape the product | Legitimate interests — improving the product |
| Site analytics | To understand usage and fix problems | Legitimate interests — running and improving the site |
| Send account emails (invitations and password resets) | To let you join the beta and recover access to your account | Legitimate interests — providing the service you asked for |
| Serve the website | To deliver the pages and data you request | Legitimate interests — providing the service you asked for |
We do not sell your data, and we do not use it for automated decision-making or profiling.
4. Who we share your data with
We don't sell or rent your data. We do use a small number of service providers ("processors") who handle data on our behalf:
| Provider | What they do | Where data is held |
|---|---|---|
| Vercel | Website hosting and analytics | Global edge network; company US-based |
| Supabase | Database storing beta sign-up details | EU (London / eu-west region) |
| Resend | Delivers the account emails we send, such as beta invitations and password resets | EU (Ireland) sending region; company US-based. Receives your email address and the email content |
| Open-Meteo | Weather and soil data used to calculate divot conditions | Receives course coordinates only — no personal data |
Each of these providers is bound by contract to process data only on our instructions.
We may also disclose data where we are legally required to do so — for example, in response to a valid request from a law enforcement or regulatory body.
5. International transfers
Our database is hosted in the EU. Some of our providers are US-based or operate global infrastructure, which may mean your data is transferred outside the UK. Where that happens, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the UK Extension to the EU–US Data Privacy Framework, or an adequacy decision, as applicable to that provider.
6. How long we keep your data
- Beta sign-up details: for as long as you remain on the list, or until you ask us to remove you. If the beta programme ends and you have not become a user, we will delete your details within 12 months.
- Analytics data: retained in aggregate form by Vercel according to their retention policy. It does not identify you.
- Any emails we send you: for now, beta communications are sent manually rather than through a bulk mailing platform. Account emails (beta invitations and password resets) are sent automatically through Resend, which keeps a delivery record of those emails according to its own retention policy. You can ask to be removed from future contact at any time by emailing us.
If you ask us to delete your data, we'll do so promptly unless we have a legal reason to keep it.
7. Your rights
Under UK GDPR, you have the right to:
- Access — ask for a copy of the personal data we hold about you
- Rectification — ask us to correct anything inaccurate
- Erasure — ask us to delete your data ("the right to be forgotten")
- Restriction — ask us to limit how we use your data
- Portability — ask for your data in a machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — at any time, without affecting processing that happened before you withdrew it
To exercise any of these, email privacy@ratemydivots.com. We'll respond within one month.
You can withdraw consent to further contact at any time by emailing us. If we move to a bulk email platform in future, we'll include an unsubscribe link in every marketing email.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put it right first.
8. Cookies
Rate My Divots does not currently use cookies for analytics, advertising, or tracking.
Our hosting platform may set strictly necessary cookies required to deliver the site securely — these do not track you and, under the Privacy and Electronic Communications Regulations, do not require your consent.
If we introduce cookies that do require consent in future, we'll add a consent banner and update this policy before doing so.
9. Children
Rate My Divots is not directed at children. We do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, contact us at privacy@ratemydivots.com and we'll delete it.
10. Security
We take reasonable technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls on our database, and using reputable infrastructure providers. No online service can be completely secure, but we work to keep the risk low.
11. Changes to this policy
We may update this policy as the product develops — for example, when we add community features. We'll change the "last updated" date at the top, and if the changes are significant we'll email anyone on our list.
12. Contact
Questions about this policy or your data: