Last updated 8 July 2026

Privacy Policy

This policy explains how Tuvabook Ltd (“Tuvabook”, “we”, “us”, or “our”) collects, uses, stores, and shares personal data in connection with our platform and services. It applies to golf clubs and venues that use our platform, and to golfers who book through a Tuvabook-powered app or website.

1. Who we are

Your golf club is in charge of your data. When you book, join, or play at a club that runs on Tuvabook, that club is the data controller of your information, and Tuvabook Ltd processes it on the club’s behalf under a written data processing agreement (in legal terms, we are the club’s processor under Article 28 of the UK GDPR).

Tuvabook is the data controller only for a narrow set of things we do for ourselves: keeping the platform secure, running this website, and billing the clubs we work with. This policy explains both roles, what we collect, and the choices you have either way.

Tuvabook Ltd is registered in England and Wales (company number 17289923), with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

For data protection queries, you can contact your club, or contact us via our contact form and we will pass your request to your club where they are the controller.

2. Data we collect

We collect different categories of data depending on how you interact with us.

From golfers

Name, email address, and phone number provided at account creation or checkout
Booking history, tee time preferences, and payment records
Payment card data (handled entirely by Stripe; we do not store card numbers)
Device information and IP address when using the app or website
Communications you send to us or to a venue through the platform
Date of birth, when a membership needs it (for example junior or age-banded memberships)
Handicap index and, if you provide it, your CDH number (your England Golf handicap ID)
Your profile photo, if you add one
Marketing preferences and the consent choices you make at signup

From venues (golf clubs)

Business name, address, and contact details
Names and email addresses of staff who access the admin dashboard
Tee sheet data, pricing, and availability configurations
Bank account details provided to Stripe for payouts
Transaction and payout history

3. Children

The short version, if you are under 18

You need to be at least 13 to have an account. We only ask your date of birth when your membership needs it, and we never use it to show you ads. We do not send marketing emails to anyone under 18. On competition leaderboards, other golfers see your first name and last initial, not your full name. If you want your data changed or deleted, you or a parent can ask your club, or delete your account yourself in the app.

Accounts on Tuvabook are for golfers aged 13 and over. Younger juniors do play at our clubs, but under-13s are managed by the club without their own account, so children under 13 do not sign up or log in themselves.

We never send marketing to anyone under 18, even if a marketing box was ticked. On club-wide leaderboards and live score notifications, we show a junior’s first name and last initial rather than their full name.

A parent or guardian of an under-18 member can contact the club, which is the controller of their child’s data, to see, correct, or delete that data on the child’s behalf.

4. Legal basis for processing

Where your club is the controller, the club relies on these legal bases and we process on the club’s instructions. For the narrow processing we do as our own controller, the basis is shown alongside. The bases set out in the UK GDPR are:

Contract performance: processing needed to provide the booking service you have entered into, including managing bookings, processing payments, and sending confirmations. Billing the clubs we work with also rests on this basis, and that part is our own.
Legitimate interests: keeping the platform secure, preventing fraud, and running this website. Keeping the platform secure is our own interest, and we balance it against your rights before relying on this basis.
Legal obligation: retaining transaction records and other data required by applicable law.
Consent: where processing rests on consent (such as marketing messages), you may withdraw it at any time, with no effect on processing already carried out.

5. How we use your data

Processing and managing tee time bookings, payments, and refunds
Sending booking confirmations, reminders, and cancellation notices
Providing venues with their booking and revenue data
Preventing fraud and ensuring platform security
Complying with legal and regulatory obligations
Improving and developing our platform based on usage patterns (using anonymised or aggregated data where possible)
Sending service communications and, where consented, marketing messages

6. Who we share your data with

We share personal data only where necessary and with appropriate safeguards in place.

Stripe: our payment processor. Stripe processes payment card data and manages payouts to venues under their own privacy policy. Stripe also acts as an independent data controller for some of its own purposes, such as fraud prevention and meeting its regulatory obligations. Stripe’s own privacy policy covers that processing.
Venues: when you make a booking at a golf club through Tuvabook, that club receives the information needed to manage your booking (name, contact details, booking details).
Cloud infrastructure providers: our platform runs on Supabase and Vercel, which store data on servers within the UK/EEA or under appropriate transfer mechanisms.
Email: Resend delivers the emails we send you (booking confirmations, receipts, and club news if you opted in). Emails and addresses handled by Resend are stored on servers in the United States with appropriate safeguards in place.
Push notifications: Expo, Apple, and Google deliver push notifications to your phone. Notification content is kept to a minimum, and Apple and Google handle delivery under their own terms as independent controllers.
Sign-in providers: if you sign in with Apple or Google, they confirm your identity to us and act as independent controllers of your sign-in with them.
Handicaps: if your club uses England Golf handicap services and you have given your CDH number, we send your CDH number to England Golf’s central database to keep your handicap record in sync. England Golf controls that database.
Error monitoring: we use Sentry to spot and fix errors on the platform. Error reports include technical details and an account identifier so we can see how many golfers an error affects; they never include payment details, and they are deleted after around 90 days.
Rate limiting: we use Upstash to protect the platform from abuse and keep it running smoothly. It processes IP addresses only, never your name, email, or booking details.
Website analytics: we use Vercel Analytics to understand how our website is used. It works without cookies and gives us aggregated numbers only, never your name or email.
Legal and regulatory authorities: where required by law, court order, or to protect our legal rights.

We do not sell personal data to third parties.

7. International transfers

Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place before any transfer takes place. Some of our providers are based in the United States (Vercel, Sentry, Resend, Expo, and Stripe’s US entities), and those transfers rely on the UK Extension to the EU-US Data Privacy Framework or on UK-approved standard contractual clauses.

8. Retention

We retain personal data for as long as necessary for the purposes it was collected, or as required by law. Typical retention periods:

Booking and transaction records: 7 years (UK tax and accounting obligations)
Golfer account data: for the duration of the account, plus 12 months following closure
Venue account data: for the duration of the contract, plus 7 years
Marketing consent records: until consent is withdrawn, plus 12 months

9. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

Access: request a copy of the personal data we hold about you.
Rectification: ask us to correct inaccurate or incomplete data.
Erasure: request deletion of your data where there is no compelling reason for us to keep it.
Restriction: ask us to pause processing of your data in certain circumstances.
Portability: receive your data in a structured, machine-readable format.
Objection: object to processing based on legitimate interests or for direct marketing.
Withdraw consent: where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us via our contact form. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

Deleting your account

You can delete your account and personal data yourself, in under a minute, from your club’s Tuvabook app: open the Profile tab, tap Edit profile, then tap Delete account at the bottom and confirm. That removes your profile and personal details and signs you out straight away.

If you belong to more than one club that uses Tuvabook, deleting your account at one club removes your details there; each club holds its own records, so your account and data with any other club are unchanged. Deleting your last remaining club account also removes your sign-in itself.

If you booked as a guest, no longer have the app, or you run a club, contact us via our contact form with the email address on the account and we will delete it for you. As noted under Retention above, a small amount of transaction history is kept in de-identified form for up to 7 years to meet UK tax and accounting law.

10. Cookies

We keep cookies to a minimum. The platform uses essential cookies only:

Essential cookies: required for the platform to work (signing you in and keeping your session). These cannot be disabled.

Our analytics does not use cookies. We measure how the website is used with Vercel Analytics, which works without cookies or cross-site tracking and gives us aggregated numbers only. Because of this there is nothing to opt in or out of, and no cookie banner to click.

You can clear or block cookies in your browser settings, though blocking essential cookies will stop you signing in.

11. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These include encryption in transit and at rest, access controls, and regular security reviews. No method of transmission over the internet is entirely secure; we cannot guarantee absolute security but we take reasonable and appropriate precautions.

12. Changes to this policy

We may update this privacy policy from time to time. Where changes are material, we will notify you by email or by prominent notice on our platform. The date at the top of this page reflects when the policy was last revised. Continued use of our platform after changes take effect constitutes acceptance of the revised policy.

13. Contact

For any questions about this policy or how we handle your data:

Tuvabook Ltd
Registered in England and Wales, company number 17289923
71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
Contact form