Privacy Policy
How GolfX handles your personal data. Last updated July 2026.
1. Who we are
GolfX.Chat ("GolfX", "we") operates this website and the MJ assistant. For GDPR we are the data controller; under DPDP we are the Data Fiduciary. Contact details are in section 10.
2. What we collect
| Data | Why | Legal basis |
|---|---|---|
| Mobile number | To create your account and sign you in via OTP | Contract / necessary for the service |
| Name (optional) | To address you in the app and on your profile | Contract |
| Handicap, home city, golf persona, saved players | To tailor recommendations to how you play | Consent — you can decline and still use GolfX |
| Questions you ask MJ | To answer them, and to keep your chat history | Contract |
| Posts, photos and videos you publish | To display them in the community feed | Contract |
| A random viewer token | To count ad impressions and clicks without identifying you | Consent |
| Payment records | To process subscriptions and meet tax obligations | Legal obligation |
We do not collect your precise location, contacts, or biometric data, and we do not run third-party advertising or analytics scripts.
3. Cookies
| Cookie | Purpose | Life |
|---|---|---|
| PHPSESSID | Keeps your signed-in session | Until you close the browser |
| golfx_token | Sign-in persistence and ad measurement | 12 months |
| gx_lang | Remembers your language choice | 12 months |
| gx_consent | Stores your privacy choices | 6 months |
The first three are strictly necessary. You can change your choices at any time — .
4. Children
GolfX is not intended for anyone under 18. Under DPDP we do not knowingly process a child's data without verifiable parental consent, and we do not carry out behavioural advertising or tracking directed at children. If you believe a child has registered, contact us and we will delete the account.
5. Who we share with
We share data only where necessary to run the service:
- OpenAI — the text of questions you ask the assistant, to generate answers.
- Razorpay — payment details, processed directly by them; we never see your card number.
- SMS provider — your mobile number, to deliver the one-time sign-in code.
- Our hosting provider — as part of storing the database.
We do not sell personal data, and we do not share it with advertising networks or data brokers.
6. International transfers
Some processors (notably OpenAI) operate outside India and the EEA. Where data leaves those regions we rely on the processor's Standard Contractual Clauses or equivalent safeguards. Under DPDP, transfers are limited to countries not restricted by the Central Government.
7. How long we keep it
- Account data — while your account is open, then 90 days after deletion.
- Chat history — until you clear it in Settings.
- Ad measurement — aggregated after 90 days; the token is discarded.
- Payment records — 8 years, as required by Indian tax law.
8. Your rights
Under both GDPR and DPDP you can:
- Access the personal data we hold about you
- Correct anything inaccurate or incomplete
- Delete your account and data ("erasure")
- Withdraw consent at any time, as easily as you gave it
- Object to or restrict certain processing (GDPR)
- Data portability — receive your data in a machine-readable format (GDPR)
- Nominate someone to exercise your rights if you die or become incapacitated (DPDP s.14)
- Complain — to your local supervisory authority (GDPR) or the Data Protection Board of India (DPDP)
The quickest route for most of these is your Settings page. For anything else, use the request form below and we will respond within 30 days.
9. Security
Traffic is encrypted with HTTPS. Sign-in uses one-time codes rather than stored passwords. Uploaded files are validated by content and served from directories where script execution is disabled. No system is perfectly secure, and we will notify you and the relevant authority of a breach affecting your data as required by law.
10. Contact and grievance officer
DPDP requires us to name a contact for privacy questions. Write to privacy@golfx.chat, marked for the attention of the Grievance Officer. If you are in the EU or UK you may also contact your national data protection authority.
11. Make a privacy request
Use this form to ask for a copy of your data, a correction, or deletion.
