Last updated: [DATE]
The data controller is Whizzly Ltd, trading as DESHANK Golfing Coach, a company registered in England and Wales (company number 17380895), registered office Starkie Chambers, Lancaster Road, Preston, Lancashire, PR1 1DA. Whizzly Ltd is registered with the Information Commissioner’s Office (ICO) under registration number ZC266511.
Contact for privacy questions: privacy@deshank.com. [We have not appointed a Data Protection Officer because we are not required to.]
The following is processed only on your device, by software running in your browser. It is not sent to us and we have no access to it:
| Data | What it is used for | Where it is kept |
|---|---|---|
| Camera video | Detecting your body position during a swing | Processed live in memory; not recorded or stored by us |
| Body landmarks (estimated positions of joints such as head, shoulders and hips) | Calculating tempo, head movement, hip sway, posture change, relative speed and turn estimates | In memory, and as summary results in your browser storage |
| Player profiles (e.g. a name or nickname you type) and swing history/scores | Showing your progress over time | Your browser's local storage on your device |
| Settings and preferences | Remembering your choices, such as voice | Your browser's local storage |
| App files (offline cache) | Letting the Service work offline after first load | Your browser's cache |
Because this information stays on your device, you control it. You can delete it using Delete player or Clear history in the Service, or by clearing site data for deshank.com in your browser settings.
We do not use the camera data to identify you, and we do not create any biometric template or facial recognition data.
Voice commands are handled differently – see section 3.5.
Voice commands (such as “record” and “stop listening”) are optional. To recognise them, DESHANK uses the speech recognition feature built into your web browser (the Web Speech API). We do not run this speech recognition ourselves, and it does not run on our servers.
Google and Apple determine their own lawful basis for their own processing. [SOLICITOR NOTE: confirm the independent-controller analysis and keep a written legitimate interests assessment. Because a session involves continuous audio processing by a third party, including bystanders’ voices, consider whether to treat the first-use notice as an explicit opt-in (consent) instead of, or as well as, legitimate interests.] – Under-18s: we recommend that under-18s only use voice sessions with the agreement of the parent or guardian whose subscription they use. Parents may prefer the on-screen buttons. [DECISION: consider defaulting junior profiles to buttons only.] – Prefer not to use it? Don’t tap the mic, and use the buttons. Nothing else changes. Voice commands may also need an internet connection.
In-app notice (shown before your first voice session, and available any time from the mic settings):
Before you start a voice session When you tap the mic, DESHANK listens for commands like “record” and “stop listening”. The mic stays on between shots until you say “stop listening”, tap the mic again, lock your screen or leave the page – or after about 5 minutes without a command. A listening indicator shows the whole time. While the session is on, your browser sends what the mic hears to its speech service to turn it into text: Google on Chrome and Android, Apple on iPhone and Safari. That can include conversations and other people’s voices nearby. DESHANK never receives your audio, and we don’t keep what’s said – only commands do anything. Under 18? Check with your parent or guardian first. Prefer not to? Use the on-screen buttons instead – everything works without the mic. [Start voice session] [Use buttons instead] [Privacy details]
| Data | Why we use it | Lawful basis (UK GDPR) | How long we keep it |
|---|---|---|---|
| Technical data when you visit the site – IP address, browser and device type, pages requested, date and time (collected in server/hosting logs by our hosting provider) | To deliver the website, keep it secure and fix problems | Legitimate interests (running a secure, working website) | [UP TO 30 DAYS – CONFIRM WITH HOST] |
| Account data – email address, [name – IF COLLECTED], login details (passwords stored only in hashed form) [DEVELOPER TO CONFIRM ACCOUNT DESIGN], account creation date, age confirmation (18+) | To create and run your account and let you manage your subscription | Contract | While your account is open, then [12 MONTHS] after it closes (except records we must keep for tax – see below) |
| Subscription and billing data (only once you subscribe – none during the free trial) – plan, trial start and end dates, billing dates, payment status, amounts paid, refunds, cancellation records, Stripe customer and transaction IDs, and limited card details from Stripe (e.g. card type, last four digits, expiry) | To provide your trial and subscription, take payments, handle cancellations and refunds, and keep accounting records | Contract; legal obligation (tax and accounting records) | Transaction and invoice records: 6 years after the end of the financial year they relate to. Other billing data: while your subscription is active plus [12 MONTHS] |
| Service emails – your email address and the details in the message (trial reminder and trial-ended emails, subscription confirmation, receipts, renewal reminders, price-change notices, cancellation confirmations) | To keep you informed about your subscription, as the law requires | Contract; legal obligation (consumer law information and reminder notices) | As for subscription data |
| Trial-eligibility and fraud-prevention data – email address, account identifiers, [device/IP signals – IF USED – DEVELOPER TO CONFIRM], and, once you subscribe, payment-method identifiers from Stripe for fraud prevention | To enforce one free trial per person and prevent payment fraud | Legitimate interests (preventing abuse and fraud) | [24 MONTHS] after the trial |
| Emails and messages you send us – your name, email address and anything you include (for example a swing report you choose to send) | To reply to you and deal with support, feedback or complaints | Legitimate interests (responding to enquiries) | [24 MONTHS] after our last contact, unless needed longer for a legal claim |
| Mailing list [ONLY IF INTRODUCED] – email address | To send updates you asked for | Consent (you can unsubscribe at any time) | Until you unsubscribe |
No payment data during the free trial: we do not ask for or collect payment details to start a trial. Payment card details: if you subscribe, you enter your card details directly into Stripe's secure payment form. We never see or store your full card number or security code.
We do not sell your personal data. We do not use it for advertising or profiling, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. (The swing scores the Service shows you are calculated on your device, for your own information only.)
If you choose to email a swing report, the Service opens your own email app with the report filled in. You decide who to send it to. The email is sent by your email provider, not by us, and we receive it only if you send it to us. If you send it to a coach or friend, they will handle it under their own privacy arrangements.
If you sign up on our website for updates about the DESHANK partner programme for coaches and golf pros:
If you later join the partner programme, we will give you separate information about how we use partner data (for example, to pay commission).
We use a small number of trusted service providers, who act on our instructions:
Google and Apple are not our service providers. Where your browser uses their speech services for voice commands, they act independently – see section 3.5.
The voice guidance consists of pre-recorded audio files created using ElevenLabs. They are served from our own domain, and no data about you is sent to ElevenLabs when you use the Service.
We may also disclose data if the law requires it, to protect our rights or the safety of others, or to a buyer if our business is sold (in which case this policy will continue to apply).
[If all providers store data in the UK: “We store personal data in the UK.”] Where any service provider processes personal data outside the UK, we make sure it is protected as UK data protection law requires. (For voice commands handled by Google or Apple, see section 3.5. Stripe may transfer payment data outside the UK, including to the United States. Where Stripe acts as our processor, transfers are covered by Stripe’s data processing terms and recognised safeguards, such as the UK Extension to the EU–US Data Privacy Framework or the ICO’s International Data Transfer Addendum. Where Stripe acts as an independent controller, it is responsible for its own transfers – see stripe.com/gb/privacy. [VERIFY STRIPE’S CURRENT SAFEGUARDS.]) For example, the country may be covered by UK “adequacy regulations” (such as the EU/EEA, or US organisations certified under the UK Extension to the EU–US Data Privacy Framework), or we use the ICO’s International Data Transfer Agreement or Addendum. Contact us for more details.
Only adults (18 or over) can start a trial or subscription, so account and billing data relate to adults. Golfers aged 13 to 17 may use DESHANK under a parent’s or guardian’s subscription, with their permission. Children under 13 should only use the Service with, and under the supervision of, a parent or guardian. Because camera and swing data stay on the device, we do not collect children’s video or body data. We do not knowingly collect personal data directly from children under 13. If you believe a child under 13 has sent us personal data (for example by email), please contact us and we will delete it.
For users under 18, we recommend that a parent or guardian helps to set up the device and the practice area safely. We have considered the ICO’s Age Appropriate Design Code (“Children’s Code”): subscriber accounts are for adults only. The Service has no profiling, no advertising, no social features, no location tracking and no analytics, and its privacy-protective settings are the default: the microphone is off until a voice session is started, a listening indicator is shown throughout, and sessions time out. We recommend that under-18s only use voice sessions with their parent’s or guardian’s agreement (see section 3.5).
Under UK data protection law you have the right to:
To use any of these rights, contact privacy@deshank.com. We will respond within one month (this can be extended in some cases). There is normally no charge. You can also close your account at any time. We will delete account data except records we must keep by law (such as tax records). Please note that we cannot access, export or delete data stored only on your device – you can do that yourself as described in section 3.3.
We use appropriate technical and organisational measures to protect the personal data we hold, including secure (HTTPS) connections to our website. Keeping swing data on your device rather than on our servers also reduces risk, and card payments are handled by Stripe, which meets the payment card industry security standard (PCI DSS). You are responsible for the security of your own device.
If you have a concern about how we handle your data, please contact us first at privacy@deshank.com so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
We will update this policy if the Service changes – for example if we add cloud storage or analytics, or change how accounts or payments work. We will post the new version here with a new date and, where changes are significant, tell you in the Service before the change applies.