Turfly Privacy Policy

Last updated: 19 October 2026

This policy explains what personal information Turfly collects, why we collect it, who we share it with and what your rights are. We've tried to keep it short and in plain English. If anything is unclear, just ask us at hello@turflyfleet.com.

1. Who we are

Turfly is an equipment pre-start check and maintenance log for golf club greenkeeping teams. It is run by Leigh Swann (sole trader), trading as Turfly ("Turfly", "we", "us"), based at 9 Leconfield Drive, Stoke-on-Trent, Staffordshire ST4 8GP, England, United Kingdom.

2. Our two roles: controller and processor

Under UK data protection law (the UK GDPR and the Data Protection Act 2018), it matters who decides how personal data is used.

  • Turfly is the controller for data about our customers and website visitors. That includes manager accounts, billing contacts, marketing preferences, support conversations and website analytics. This policy mainly covers that data.

  • Each golf club is the controller for the data its own staff enter into Turfly, such as staff names typed into pre-start checks, check results, defect notes and photos. For this data Turfly acts as a processor: we store and handle it only on the club's behalf and on its instructions, as set out in our Terms of Service. If you are a member of a club's staff and have questions about your data, please contact your club first. We'll help them respond.

3. What we collect

From club managers and account holders

  • Your name, email address and club name

  • Login details (handled by Firebase Authentication; we don't see your password)

  • Details of your machines, service logs and any settings you choose

  • Your marketing preference (whether you ticked "I'd rather not receive Turfly news and offers" or later unsubscribed)

  • Messages you send us by email or WhatsApp

Payment information

  • Payments are handled by Stripe. We do not store your card number. Stripe gives us limited details such as your billing name, email, subscription status, the last four digits and expiry date of your card, and payment history.

From staff using a Turfly Tag (processed on behalf of the club)

  • The name typed into a pre-start check

  • Check answers, date and time of the check and which machine it relates to

  • Any defect notes and photos added

Staff don't need an app or a login to complete a check.

From website and app visitors

  • Basic usage information collected by Framer analytics on turflyfleet.com, such as pages visited, approximate location (country/region), device and browser type and referring site. Framer analytics does not set cookies or store anything on your device.

  • Technical information needed to run the app securely, such as IP address and log data held by our hosting provider (Vercel).

We don't intentionally collect special category data (such as health information). Please don't include it in defect notes or photos.

4. Why we use it and our lawful bases

  • Set up and run your account, provide the service, send and track Turfly Tags (including returns) and give support. Lawful basis: Contract: we need it to provide the service you signed up for.

  • Take payments and manage your subscription. Lawful basis: Contract.

  • Send service emails (e.g. defect alerts, account and billing notices) from alerts@turflyfleet.com. Lawful basis: Contract.

  • Keep financial and tax records. Lawful basis: Legal obligation.

  • Keep the service secure, prevent misuse and fix problems. Lawful basis: Legitimate interests: running a safe, reliable service.

  • Understand how our website is used so we can improve it. Lawful basis: Legitimate interests.

  • Send customers Turfly news and offers by email (see section 5). Lawful basis: Legitimate interests: telling existing business customers about our own similar products and services, as allowed by the "soft opt-in" under the Privacy and Electronic Communications Regulations (PECR). You can opt out at any time.

  • Remember your marketing opt-out so we don't email you again. Lawful basis: Legal obligation and legitimate interests.

  • Store and process staff check data. Lawful basis: We act as processor for the club. The club decides its own lawful basis (usually legitimate interests or legal obligation linked to health and safety).

5. Marketing emails

If you sign up for a Turfly subscription, we may send you occasional emails about Turfly news, new features and offers on our own products and services.

  • Opting out at sign-up: the sign-up form has a box saying "I'd rather not receive Turfly news and offers". It is unticked by default. Tick it and we won't send you marketing emails.

  • Opting out later: every marketing email includes an unsubscribe link. You can also email hello@turflyfleet.com at any time. It's free and won't affect your service.

  • We send marketing only to account holders who signed up with us (not to staff who use Turfly Tags), and we never sell or share your details for other companies' marketing.

  • Service emails (such as defect alerts, billing and account notices) are not marketing. You'll still get them while you have an account.

  • If you opt out, we keep a short record of your email address and opt-out so we can make sure we respect it.

Marketing emails are sent using Resend (see section 6), with no open or click tracking.

6. Who we share it with

We don't sell personal data. We use trusted service providers ("sub-processors") to run Turfly:

  • Google (Firebase Authentication and Cloud Firestore). What they do: Logins, sign-in security logs and database storage. Our database is stored in Google's London region (europe-west2).

  • Vercel. What they do: Hosts the web app at app.turflyfleet.com.

  • Stripe. What they do: Payment processing, subscriptions and the customer billing portal.

  • Resend. What they do: Sends service emails from alerts@turflyfleet.com and our marketing emails.

  • Framer. What they do: Hosts our website turflyfleet.com and provides website analytics.

  • WhatsApp (Meta). What they do: Only if you choose to contact us on WhatsApp.

We may also share information with our professional advisers (such as an accountant), with delivery services when posting or returning Turfly Tags (Royal Mail), or where the law requires it (for example, to HMRC or the police), or if the business is sold or restructured (the buyer would have to protect your data in the same way).

7. International transfers

Some of our providers are based in, or may access data from, outside the UK (for example in the United States or the EU). When that happens, we make sure appropriate safeguards are in place, such as:

  • UK "adequacy" regulations (for example for the EU/EEA, or the UK–US "data bridge" where the US provider is certified), or

  • the ICO's International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, included in the provider's data processing terms.

You can ask us for more detail at hello@turflyfleet.com.

8. How long we keep it

We keep personal data only as long as we need it. Our current approach is:

  • Account and club data (including check records and service logs): while your subscription is active, then deleted within 90 days of cancellation unless you ask us to delete it sooner or export it first.

  • Billing and financial records: 6 years after the end of the financial year they relate to, to meet HMRC requirements.

  • Marketing: we stop sending marketing when you unsubscribe or your account closes. We keep a record of opt-outs (email address only) for as long as needed to respect them.

  • Support emails and WhatsApp messages: 2 years after the conversation ends.

  • Website analytics: as set by Framer. Framer's analytics are anonymous: visitors' IP addresses are scrambled with a key that Framer deletes every day, so they can't be used to identify you.

  • Sign-in logs: Google (Firebase and Google Cloud) keeps a log of sign-in activity (email address, IP address and time) for 30 days for security, then deletes it automatically.

  • Backups: daily backups of the database are kept for 30 days, then deleted automatically.

Clubs can export their records as CSV at any time while their account is active.

9. How we keep it safe

We use reputable providers with strong security, encrypted connections (HTTPS), and access controls so that each club can only see its own data. Only people who need access to help run Turfly can see customer data. No system is 100% secure, but if a data breach affects you we'll tell you and the ICO where the law requires us to.

10. Your rights

Under UK data protection law you have the right to:

  • access a copy of your personal data

  • correct inaccurate data

  • delete your data (in some circumstances)

  • restrict or object to how we use it, including an absolute right to object to direct marketing at any time

  • data portability: get your data in a usable format

  • withdraw consent, where we rely on consent

To use any of these rights, email hello@turflyfleet.com. We'll respond within one month. There's usually no charge. If your request is about staff check data held for a club, we'll pass it to the club and help them respond.

11. Cookies and analytics

  • turflyfleet.com (website): uses Framer analytics to understand visits. It doesn't use cookies or store anything on your device, so there's no cookie banner.

  • app.turflyfleet.com (web app): uses only cookies and similar storage that are strictly necessary to keep you logged in and the app working (for example, Firebase Authentication). The app uses no analytics or advertising trackers.

  • Marketing emails: sent with Resend, with no open or click tracking.

You can block or delete cookies in your browser settings, but the app may not work properly without the essential ones.

12. Children

Turfly is a business service and is not intended for children. Each club, as controller, is responsible for the data of its own staff, including any apprentices under 18.

13. Changes to this policy

We may update this policy from time to time. We'll post the latest version here with a new "last updated" date, and tell account holders by email about any important changes.

14. Contact us and complaints

If you have any questions or concerns, please contact us first:

  • Email: hello@turflyfleet.com

  • Post: Leigh Swann (sole trader), trading as Turfly, 9 Leconfield Drive, Stoke-on-Trent, Staffordshire ST4 8GP, England

If you're not happy with how we've handled your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:

  • Website: ico.org.uk/make-a-complaint

  • Helpline: 0303 123 1113