Privacy Policy

What we process, why, who receives it, and what you can do about it.

Effective: September 7, 2026 · Last updated: October 25, 2026

This page in: Deutsch · Français · Italiano · Español · Polski

1. Who is responsible

Sebastian Burges
Wettmarser Weg 14
59846 Sundern, Germany
Email: info@customgolflab.de

This address is the contact for every privacy matter. We are not required to appoint a data protection officer.

2. What we process and why

2.1 Account and sign-in

• Email address and sign-in — via password or one-time code. If you sign in with Apple or Google, we receive only an identifier and, if you share it, your email address.
• Record of your consents — when you tick a box (Terms of Service, a consent in the app, or the confirmation before a purchase) or decline, we store what it was, which version of the wording, a fingerprint (SHA-256) of the exact wording you saw, your decision, the time, language, platform and app version. This is our proof of what you agreed to (Art. 7(1) GDPR). We keep it for three years after you delete your account.
• Profile — display name, handicap, right- or left-handed, home club, profile picture, your bag, goals and training preferences. All optional, all editable.

Purpose: running your account and personalizing the app. Legal basis: Art. 6(1)(b) GDPR (contract).

2.2 Swing analysis (camera and video)

• Video — recorded with the camera or uploaded from your library. It is sent to one of our analysis servers at AWS and evaluated there — in the United States (Virginia) or in Frankfurt, depending on which one is available. The video is kept there only temporarily.
• Audio track — swings you film with TheLAB's own capture are recorded with sound; videos recorded with your phone's camera app or uploaded from your library keep their sound. We use the sound only to detect the moment of impact, on your phone and on the analysis server. We do not analyze it to recognize voices. The sound is stored as part of the video. If you do not give TheLAB access to the microphone, the app records video only.
• Body points — from the video we compute the positions of joints (including points on the head such as nose, eyes and ears) and of the club. We use them only to analyze your swing. We do not identify you with them, do not compare you with other people and never sell them. Some U.S. state laws treat such data as biometric information; how we handle it is set out in our Biometric Data Policy.
• Body points on your phone — for the skeleton in the player and the swing phases, your phone calculates body points itself: on iPhone with Apple Vision, on Android with Google ML Kit. Images and videos do not leave the device. On Android, ML Kit may send technical usage and performance data (such as device type, app version and processing time) to Google.
• AI evaluation — individual frames and measured values are sent to Google's Gemini models. For the quick analysis, models from OpenAI and Anthropic evaluate the same frames as well, which makes the result more stable.
• Results — score, phases, metrics, fault patterns and drill recommendations. Video and results are then stored in your account; you can delete any video at any time.
• Calibration and grip photos — images you take for camera calibration or the grip analysis. Grip photos are evaluated by Google Gemini.
• Range clips — at the range the app records short clips of your swings; they are evaluated and stored just like a single video.
• Who can see your videos — your videos are not published, not listed and not shown to other users. They are stored under a non-public address that contains a random account identifier; we are moving this storage to access-controlled, time-limited links. For troubleshooting and quality assurance, the owner of Custom Golf Lab may view individual videos. We do not use your videos for advertising. Please only film other people with their consent.

Video files on the analysis server are deleted after evaluation. Legal basis: Art. 6(1)(a) GDPR and, for body points, Art. 9(2)(a) GDPR (consent, requested in the app before your first video).

2.3 Playing a round (GPS caddie)

• Location — continuously during a round, including in the background, so that distances, shot positions and the current course are right. Outside a round only when you search for a course nearby.
• Shots, scores, notes — club, position, lie, putts, results per hole, your hole notes and hole plans.
• Course data — holes, greens and hazards are requested through our server from our course data provider (USA). For a search for courses near you, your position is sent rounded to about one kilometer; otherwise only the course identifier — no account data. Our request log does not store your position.
• Weather and wind — from Open-Meteo, rain radar from RainViewer. Open-Meteo receives only a position rounded to about one kilometer. Exception: for “Plays like” (Pro only, only during a round, never in a tournament) the app asks Open-Meteo for the elevation above sea level. For this, your precise position and the points you are playing to (green, target circle) go to Open-Meteo, without account data.
• Maps — map tiles and satellite imagery come from Mapbox, ArcGIS Online (Esri) and OpenStreetMap. These providers see the displayed map area and your IP address. Searching a course by name uses Nominatim (OpenStreetMap) with your search term.

Legal basis: Art. 6(1)(a) GDPR (consent, requested before your first round). The caddie does not work without location; you can revoke the permission at any time in your system settings.

2.4 Apple Watch and Wear OS

• Motion sensors — acceleration and rotation at the wrist to detect shots automatically. Evaluation happens on the watch; only the detected shot is sent to the phone.
• Microphone — the watch listens for the sound of the ball to confirm a shot. The audio is evaluated on the watch and is neither recorded nor transmitted.
• Location — for distances directly on the watch.
• Apple Health — the watch app starts a golf workout through HealthKit so it stays active during the round. That workout is stored in Apple Health on your devices. Whatever watchOS additionally records during a workout (such as heart rate) is governed by your Health permissions; we do not read those values and do not upload them to our servers.
• Wear OS — we do not read body sensors such as heart rate. For each round we store detection measurements (timing, strength of the movement, loudness of the impact sound, no audio recording) to improve shot detection.
• Health Connect (Android) — if you allow it, TheLAB logs a round played with a Wear OS watch as a golf workout in Health Connect on your phone: start and end time, calories, steps and distance. The watch measures these values during the round. They only go from the watch to your phone and are written to Health Connect there. TheLAB does not read any data from Health Connect, does not store these values on our servers and does not share them. You can withdraw the permission at any time in Health Connect under “App permissions” → “TheLAB”. The legal basis is your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).

The watch caches the state of the current round locally so nothing is lost if the connection drops. Legal basis: Art. 6(1)(a) GDPR (consent, requested before you first use the watch).

2.5 Hosel — coaching, chat and voice

• Chat — your messages and the data needed to answer them (swing results, round statistics, goals, your bag, mental self-assessment, monthly plan) are sent to Google Gemini. Videos are not transmitted.
• Memory — we keep the wording of a conversation for 24 hours. After that only a condensed summary remains, written by an OpenAI model, so Hosel remembers what matters for your golf, such as goals, your bag and training habits. Health information — physical complaints, injuries or other health details — is filtered out and not kept in this memory. The summary is kept until you delete your account; we delete individual entries on request.
• Hosel is an AI golf coach — not a person, and answers may contain mistakes. Hosel talks about golf, training and the mental side of the game, not about personal matters unrelated to golf, and does not give medical advice. If you express thoughts of suicide or self-harm, Hosel points you to crisis services such as the 988 Suicide and Crisis Lifeline; see our crisis protocol.
• Talking to Hosel — in voice mode your microphone audio goes directly to OpenAI (Realtime) and the answer comes back as speech. We do not store audio recordings. What is said appears as text in your chat history and, just like typed messages, is reduced to the summary after 24 hours; for the session itself we store duration and cost.
• Caddie voice on the course — speech recognition is done by your device (Apple or Google), the answer is generated by Google Gemini, and it is read aloud by ElevenLabs. ElevenLabs receives only the text to be spoken.
• Coaching and monthly plan — drills, progress and summaries are derived from your swing and round data; the accompanying texts are written by Google Gemini.

Legal basis: Art. 6(1)(a) GDPR (consent, requested before first use; separately for voice mode).

2.6 Fitting

For the club fitting you enter body measurements, your playing profile and your current clubs. These entries are sent to an Anthropic model (Claude), which produces the recommendation. We do not ask for or store physical complaints or other health information in the fitting. Legal basis: Art. 6(1)(a) GDPR (consent, requested before your first fitting).

2.7 Statistics and journey

From rounds, shots and analyses we compute your statistics, your history and your range progress. This happens on our side, without third parties. Legal basis: Art. 6(1)(b) GDPR.

2.8 Usage events

We log which features you open and which actions you trigger (event, screen, app version, platform) and the time of your last activity. This helps us improve the app and support you. There are no advertising profiles and no sharing. You can switch both off in your profile under "Privacy & consents". Legal basis: Art. 6(1)(f) GDPR (legitimate interest), with an opt-out switch.

2.9 Error reports

If the app crashes or an error occurs, a report goes to Sentry (data center in the EU): error message, app version, device type, operating system. We remove email and IP address beforehand, and paths to your videos are redacted. The app also writes technical diagnostic values to our database (for example the connection to the watch, camera, location) — with your user ID only if usage events (2.8) are switched on. Legal basis: Art. 6(1)(f) GDPR.

2.10 Purchases and subscriptions

Subscriptions are purchased in the App Store or on Google Play; payment is handled entirely by Apple or Google. We hold no payment data. RevenueCat manages the subscription status and reports it to us under a pseudonymous user identifier. Legal basis: Art. 6(1)(b) GDPR.

2.11 Offers and news (newsletter)

Only if you agree — in the app under "Offers and news" or via the form on our website — do we send you news and offers by email, at most once a month. Delivery runs through Resend (see service providers).

Website sign-up (double opt-in): After you submit the form, we send you an email with a confirmation link. You only receive the newsletter once you confirm through it. For this we store your email address, the language of the page, the consent wording you saw and its version, the times of sign-up, confirmation email, confirmation, welcome email and, if applicable, unsubscribing, your browser identifier (user agent) and the device type derived from it, and your IP address — not in plain text, only as a check value (hash). If you signed up via an earlier form, we also store your first name, last name, home club and device preference (iPhone/Android).

Open and click measurement: With your consent (the “Subscribe” form), we use Resend to measure whether a newsletter email is opened (via an invisible image in the email) and which links in it are clicked (the links briefly pass through Resend for this). This shows us which content is useful. Legal basis: Art. 6(1)(a) GDPR and Section 25(1) of the German TDDDG. Unsubscribing ends the measurement.

Legal bases: sending, Art. 6(1)(a) GDPR (your consent); the log of sign-up and confirmation as proof of consent, Art. 7(1) in conjunction with Art. 6(1)(c) and (f) GDPR; the IP check value to protect the form against abuse, Art. 6(1)(f) GDPR.

Retention: If you don't confirm, we automatically delete all data after 30 days. If you unsubscribe, we delete your name, home club and device preference immediately. We keep your email address and the log (times, IP check value, browser identifier, wording) for three years as proof (Art. 17(3)(e) GDPR) and then delete it.

You can unsubscribe at any time via the link in every email, the switch in the app, or a short email to info@customgolflab.de. Withdrawal applies to the future.

2.12 When you write to us

Emails to info@customgolflab.de are sorted automatically: sender, subject and text are sent to an Anthropic model that classifies the message and summarizes it in a few sentences. This lets us answer faster. The summary and any PDF attachments are stored in our mailbox archive at Supabase. Your message is not used for anything else. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in orderly handling). If you prefer otherwise, say so in your email and we will handle it manually.

The same applies to messages sent through the contact form on our Legal Notice page: your name (optional), email address and message are sent through our email service Resend as an email to our mailbox; we do not store them in a database. To prevent abuse, we keep a hash of your IP address for 24 hours (at most five messages per hour). Legal basis: Art. 6(1)(f) GDPR (answering your request), and Art. 6(1)(b) GDPR for questions about a contract with us.

2.13 Website and server logs

When you open the website or the app, our servers briefly store IP address, time, requested address, browser and operating system to keep the service secure. These logs are not linked to your account and are deleted after 14 days. Legal basis: Art. 6(1)(f) GDPR.

2.14 Improving the analysis (optional, off by default)

Only with your separate consent may we use video frames, body points and metrics of your swings — without any link to your name or account — to train our own analysis models. Audio, locations and account data are never included. Training runs on servers in Germany (Hetzner, Nuremberg; Amazon Web Services, Frankfurt), with no sharing with third parties. Legal basis: Art. 9(2)(a) GDPR (explicit consent, since body points may count as biometric data). You can withdraw in your profile at any time; from then on your data is no longer used for training.

2.15 Reports of illegal content

If you report content to us using the form at customgolflab.de/en/report, we store your information (the content concerned, your explanation, optionally your name and email address, and for copyright notices also the work, your postal address, phone number and signature) together with a hashed value of your IP address to prevent abuse. We use it only to review the report and reply to you. For copyright notices, the affected user may receive your information so they can respond. Legal basis: Art. 6(1)(c) GDPR together with Art. 16 of the Digital Services Act; for U.S. copyright notices, 17 U.S.C. § 512.

2.16 Using TheLAB without an account (as a guest)

You can try TheLAB without an account. The app then creates an anonymous session at Supabase with a random identifier, without an email address or password. Before you start, you enter a first name for Hosel to call you by and accept the Terms of Service. As a guest you can play one round, run five quick and two detailed analyses and ask Hosel five questions. Sections 2.2 to 2.5 apply, with the same consents as for an account.

Everything you create as a guest (name, rounds, analyses, conversations, consents) is stored under this identifier. If you create an account, this data is carried over into your account. Without an account, we delete it automatically 30 days after your last use. Before that you can delete it yourself at any time — in the app via “Delete account permanently” or by email to info@customgolflab.de. Until then it is treated like account data (sections 6 and 7). Legal basis: Art. 6(1)(b) GDPR (contract of use) and, for the individual features, the consents named in 2.2 to 2.5.

2.17 Where your installation came from (ads in the app stores)

We want to know whether our ads in the app stores reach people who then actually use TheLAB. For this, the app reports once, when you first open it (also without an account), where the installation came from:

• iPhone — the app obtains a code through Apple’s AdServices interface, valid for 24 hours, and sends it to our server. Our server uses it to ask Apple whether the installation came from an ad in the App Store (Apple Search Ads) and stores the answer: ad yes or no, identifiers of the campaign, ad group and search keyword, country, type of download (new or re-download) and time of the tap on the ad.
• Android — the app reads the install referrer from Google Play, such as the source and campaign of the link you came from (for Google ads also their click identifier), plus the times of the click and of the start of the installation, and sends it to our server.

We do not use your device’s advertising ID, do not ask for tracking permission, do not track you across other apps or websites and do not share this information. It is stored in our database at Supabase, visible only to us, and deleted together with your account. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring the effect of our advertising). You can object at any time (Art. 21 GDPR); an email to info@customgolflab.de is enough and we delete the information.

2.18 Sharing with your coach and other players

You can share individual items on purpose — a specific round, a swing, a weekly plan, your statistics or drills — with your coach or with other TheLAB users you have connected with. You connect by code, QR code or name search; others can only find you if you make yourself “discoverable” (off by default). A coach sees detailed values, another player only the summary; your email address is never shared. You decide how long a share lasts (until you withdraw it, once, or until a date) and can end any share or connection at any time. Connection codes expire after 30 days. Legal basis: Art. 6(1)(b) GDPR (the feature you asked for).

3. Cookies and storage on your device

We use no tracking cookies, no third-party analytics and no advertising cookies. On your device the app stores only what it needs to work:

• Sign-in session — so you stay logged in, also as a guest
• Settings — language, appearance, course and round settings, last selected clubs, calibration, free allowances
• Consents — which permissions you granted, and in which version
• Drafts — such as an unfinished fitting or the current round state on the watch

This data stays on your device until you sign out or delete the app.

4. Who receives your data

We work with the following service providers. Each receives only what it needs for its task and may not use the data for its own purposes.

4.1 Transfers to the United States

Several of these providers are based in the United States or process data there. We base these transfers on the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where the provider is certified. Under their API terms, the AI providers (Google, OpenAI, Anthropic) do not use our requests to train their models.

4.2 No other sharing

We do not sell your data and do not share it for advertising. We disclose data to authorities only when legally required.

5. Consents and withdrawal

Before first use we ask for your consent for: swing analysis (video), rounds (location), Hosel (coaching and voice mode), fitting, watch (motion sensors, microphone, Apple Health, Health Connect), offers and news, and improving the analysis. You can withdraw any consent at any time — in your profile under "Privacy & consents" or by email to info@customgolflab.de. The feature concerned is then no longer available; what was processed before remains lawful.

6. How long we keep data

7. Deleting your account and taking your data with you

Delete account: in the app under Profile → "Delete account" — or by email to info@customgolflab.de. We delete your account together with videos, analyses, rounds, chat and profile. Only the record of your consents is kept for three years as proof, then deleted. Backups are overwritten within 30 days at the latest.

Take your data: email us at info@customgolflab.de, ideally from the email address linked to your account. Within one month (45 days for U.S. requests) you receive a file with all records linked to your account and download links for your videos and images, valid for seven days.

Anonymous figures with no link to you (such as overall usage numbers) are kept.

8. Your rights

• Access (Art. 15 GDPR) — what data we hold about you
• Rectification (Art. 16) — correct inaccurate data
• Erasure (Art. 17) — have your data deleted
• Restriction (Art. 18) — have processing restricted
• Data portability (Art. 20) — receive your data in a common format
• Objection (Art. 21) — to processing based on legitimate interest
• Withdrawal — of any consent, at any time, without giving reasons

An email to info@customgolflab.de is enough. We respond within one month.

Right to complain: You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de. You may also contact the authority where you live.

8.1 If you live in California or another U.S. state with a privacy law

You have the right to know what personal information we collect and how we use it, to access and take a copy of it, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell your personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of. In the past 12 months we have not sold or shared personal information. We treat a Global Privacy Control signal as a request not to sell or share, which we already honor for everyone.

Categories we collect: identifiers (email, account ID), account and profile details, commercial information (subscription status), internet and app activity within TheLAB (including whether you installed the app through one of our ads in the app stores), precise geolocation during rounds, audio and video you record, biometric information (body points derived from your swing videos), and inferences derived from your swings and rounds. The sensitive personal information we process is precise geolocation during rounds, the video you record and the body points derived from it. We use it only to provide the features you use, not to infer characteristics about you and not for advertising. We disclose these categories only to the service providers listed in section 4, for the purposes stated there.

Health information: we do not store consumer health data on our servers. We do not read health data from Apple Health, Health Connect or your watch's body sensors; on Wear OS, the calories, steps and distance measured during a round only pass from your watch to your phone and into Health Connect, if you allow it, and we do not keep them; the fitting does not ask for physical complaints, and health details you mention in a conversation with Hosel are not kept in Hosel's memory; the wording of a conversation is deleted after 24 hours.

Do Not Track: TheLAB does not track you across other websites or apps and uses no advertising or third-party analytics trackers, so it works the same whether or not your browser sends a Do Not Track signal.

How to exercise your rights: delete your account in the app, or email info@customgolflab.de with the subject "Privacy Request" to access, copy, correct or delete your data. We may ask you to confirm the request from the email address linked to your account. You may use an authorized agent. We respond within 45 days. If we decline a request, you can appeal by replying to our answer; we respond to appeals within 45 days.

8.2 If you live in Canada

Person in charge of the protection of personal information: Sebastian Burges, founder, info@customgolflab.de (subject "Privacy Request").

Where your information is held: we store and process your personal information outside Canada and Québec — mainly in the European Union (Germany) and, for the service providers listed in section 4, in the United States. These providers are bound by contract to protect it and to use it only on our behalf. Before we communicate personal information outside Québec, we assess whether it will receive adequate protection there. Authorities in those countries may in some cases access it under local law.

Your rights: you can ask for access to your personal information, for its correction, and for a copy in a structured, commonly used technological format, and you can withdraw your consent, as described in section 8. We respond within 30 days.

Complaints: if you are not satisfied with our answer, you can contact the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) if you live in Québec, or the Office of the Privacy Commissioner of Canada (priv.gc.ca).

8.3 If you live in Australia or New Zealand

Where your information is held: we store and process your personal information outside Australia and New Zealand — mainly in the European Union (Germany) and, for the service providers listed in section 4, in the United States. These providers are bound by contract to protect it and to use it only on our behalf.

Australia: where the Privacy Act 1988 (Cth) applies to us, we handle your personal information in line with the Australian Privacy Principles. You can ask us for access to and correction of your personal information as described in section 8 (email info@customgolflab.de, subject "Privacy Request"). If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

New Zealand: the Privacy Act 2020 applies to how we handle your personal information. You can ask us for access to and correction of your personal information in the same way. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

9. Security

• All connections are encrypted (TLS).
• In the database every user sees only their own data (row-level access rules).
• Keys for AI and third-party services live only on our servers, never in the app.
• Passwords are stored only as hashes; one-time codes expire after a short time.

No security system is perfect, and we cannot guarantee that data will never be accessed without authorization. If a personal data breach is likely to affect you, we notify the competent supervisory authority within 72 hours where the law requires it and inform you without undue delay.

10. Minimum age

TheLAB is for people aged 16 and over. We do not ask for your age: by accepting the Terms of Service you confirm that you are at least 16 and that your information is accurate. We do not knowingly collect personal information from anyone under 16. If we learn of such an account, we delete it. Parents can contact us at info@customgolflab.de.

11. Our social media pages

We run our own pages on Instagram and Facebook (Meta Platforms Ireland Ltd.), YouTube (Google Ireland Ltd.) and TikTok (TikTok Technology Ltd., Ireland) to tell golfers about TheLAB and to stay in touch. When you visit our pages there, comment or message us, the platform processes your data under its own privacy policy. We only see what you share publicly or send us, plus aggregated statistics (such as reach) that do not identify individuals.

The legal basis is our legitimate interest in informing you about our product and communicating with you (Art. 6(1)(f) GDPR). For page statistics (“Insights”) on Facebook and Instagram we are joint controllers with Meta (Art. 26 GDPR); Meta takes primary responsibility, see the Page Insights Controller Addendum. You can exercise your rights most effectively directly with the platform, but you can always contact us as well.

We do not use tracking pixels or SDKs from these networks on our website or in the app. Privacy policies of the platforms: Instagram, Facebook, YouTube (Google), TikTok.

12. Changes

When the app or the law changes, we update this policy. The current version is always available here; we inform you of material changes in the app or by email.