Website Privacy & Cookie Notice
Last updated: 7 September 2026
This notice explains what happens to information about you when you visit sweetspot.io.
If you use the Sweetspot mobile app, or book and pay through a Sweetspot user account, a different notice applies to that: see Sweetspot's Privacy Policy. That one covers your account, your bookings, your payments and your golf federation data. This one covers only your visit to this website.
1. Who is responsible
Sweetspot AB, organisation number 559095-3583, Hangövägen 29, 115 41 Stockholm, Sweden, is the controller for the processing described here.
You can reach us at hello@sweetspot.io with any question about this notice, or to exercise any of the rights in section 9.
2. What this notice covers
This notice applies when you browse sweetspot.io, read our blog, watch a video on one of our pages, or submit one of our contact forms.
It does not cover:
- The Sweetspot app and user accounts — see the app privacy policy linked above.
- Booking at a golf facility. Bookings happen at book.sweetspot.io or in the app, under the app privacy policy.
- The club portal at club.sweetspot.io, where golf facilities sign in. That is a separate product for our business customers and is governed by the agreement with the facility rather than by this notice.
- Websites we link to. When you follow a link to the App Store, Google Play, LinkedIn, Facebook, YouTube or a golf club's own site, that site's notice applies from the moment you arrive. We have no control over what they collect.
3. What we collect when you visit
3.1 Technical and usage information, collected automatically
When you open a page on sweetspot.io, the following is collected without you entering anything:
- Device and browser information — browser type and version, operating system, device type, screen and window size, language setting.
- Your IP address, and an approximate location derived from it at country, region and city level. We do not collect GPS or precise satellite location on this website.
- How you arrived — the referring website, and any campaign parameters in the link you followed.
- What you did on the page — pages viewed, the order you viewed them in, time on page, scroll depth, clicks on links and buttons, files downloaded, and form interactions.
- A pseudonymous identifier stored on your device, which lets us recognise a returning browser without knowing who you are. See section 5.
We do not ask for your name, and we do not know who you are, unless you tell us by submitting a form.
3.2 Session recordings
We use a tool that records a reconstruction of your visit — the pages you saw, where you moved and clicked, and how you scrolled. A recording lets us see where a page confuses people.
- Recordings are kept for 30 days and then deleted automatically.
- Recordings are linked to the pseudonymous identifier above, not to your name.
- Recordings are made on this website only — not in the Sweetspot app, and not in the booking flow at book.sweetspot.io.
If you do not consent to analytics, no recording is made.
3.3 Information you give us
Our pages carry contact buttons that open a form hosted by HubSpot. If you submit that form, we collect your name and email address, and optionally the name of your facility or club, your region, whether you are a golf facility or a golfer, and anything you write in the free-text field. You are asked to confirm that we may store and process the request, and separately whether you also want other communications from us.
We also receive the page you came from and the campaign parameters in the link, so we know which page prompted your request.
The form is protected by Google reCAPTCHA, which assesses whether you are a person or a bot. Google receives your IP address and interaction data for that purpose.
4. Why we process it, and on what legal basis
| Purpose | Legal basis | How long |
|---|---|---|
| Delivering the website — serving pages, images, fonts and video, and keeping the site secure and available | Legitimate interest: we cannot deliver a website without it | For the request, plus short-lived server logs |
| Understanding how the site is used — which pages are read, where visitors lose interest, whether a change helped | Consent, given through our cookie banner | 14 months |
| Session recordings, to diagnose specific usability problems | Consent | 30 days |
| Responding to a request you submit | Your consent for the initial request, then our legitimate interest in following up on a business enquiry, or performance of a contract if you become a customer | See section 8 |
| Sending you other communications, if you ticked that box | Consent | Until you unsubscribe |
| Preventing spam and abuse of our forms | Legitimate interest | Per Google's retention |
5. Cookies and similar technologies
We use very few. Everything in this section is set by our analytics provider. We set no advertising or profiling cookies, we do not sell your personal data, and we do not share it for cross-context behavioural advertising.
5.1 Cookies
All three are first-party cookies on sweetspot.io, set only after you consent to analytics.
| Name | Purpose | Expires |
|---|---|---|
| AMP_c17a451de3 | Holds the pseudonymous device identifier, the current session identifier, a page counter and your opt-out state | 365 days |
| AMP_MKTG_c17a451de3 | Remembers the campaign and referrer that brought you here, so a later action can be attributed to it | 365 days |
| EXP_c17a451de3_identity | Identifies your browser to our experimentation tool, so you see a consistent version of a page being tested, and records when you were first seen | 365 days |
5.2 Other storage on your device
These are not cookies, but they store data on your device and we treat them the same way.
| Name | Kind | Purpose | Cleared |
|---|---|---|---|
| AMP_unsent_c17a451de3 | Local storage | Holds measurements that have not yet reached our provider, so a lost connection does not lose them | When you clear site data |
| AMP_remote_config_c17a451de3 | Local storage | Caches the analytics configuration so it is not re-fetched on every page | When you clear site data |
| AMP_SR_START_c17a451de3_… | Local storage | Marks when a session recording started | When you clear site data |
| EXP_c17a451de3 | Local storage | Which version of a tested page you were assigned | When you clear site data |
| EXP_c17a451de3_DEFAULT_USER_PROVIDER | Local and session storage | The page you landed on, and when you were first seen | When you clear site data, or close the tab |
| AMP_PAGE_VIEW | Session storage | An identifier for the page view you are currently on | When you close the tab |
| AMP_URL_INFO | Session storage | The current and previous page address, so we can see the path you took | When you close the tab |
5.3 Strictly necessary storage
We store your cookie choice itself on your device so we do not ask again on every page. This is necessary to respect your decision and is set whether you accept or decline.
5.4 Changing your mind
Use the Cookie settings link in the footer of any page. You can withdraw consent at any time and it is as easy as giving it. Withdrawing stops further collection; to remove what is already stored on your device, clear site data in your browser, or ask us using the contact details in section 1.
If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics and do not ask again.
6. Who else is involved
We use four external providers. Each acts on our instructions, except where noted. Each also publishes its own list of sub-processors.
- Framer B.V., Amsterdam, Netherlands — hosts this website and delivers its images, fonts, video and code. Framer also records a page view for its own site-analytics feature without setting a cookie: the page address, the referrer, the site and page identifier, and a pseudonymous identifier. Because this is part of how the site is served and stores nothing on your device, we treat it as necessary to deliver the website. Data stays in the EU.
- Amplitude, Inc., San Francisco, United States — provides the usage analytics, the experimentation tool and the session recordings described in section 3.2. Receives everything in section 3.1. Its environment is hosted in the western United States.
- HubSpot, Inc., Cambridge, United States — hosts our contact form and stores the resulting enquiry so we can reply. Receives everything in section 3.3. Our account runs in HubSpot's EU data centre, which is where the records sit day to day, but their agreement permits transfer to and processing in the United States and other jurisdictions, so section 7 applies regardless.
- Google Ireland Limited and Google LLC — for reCAPTCHA on our forms, which receives your IP address and interaction data to tell people from bots, and for a tag-management container that loads on our pages.
We also share information where we must: with authorities where the law requires it, with our professional advisers where necessary, and with a buyer or investor in the event of a reorganisation, sale or merger.
7. Transfers outside the EU and EEA
Amplitude and HubSpot are United States companies, and Google may process data outside the EEA.
Both rely on the same layered mechanism. Where their certification under the EU-US Data Privacy Framework applies, transfers are made under it. Where it does not, the 2021 Standard Contractual Clauses apply, together with the UK Addendum for data protected by the UK GDPR. Both providers' data processing agreements are incorporated into terms we have already accepted, and both treat the Standard Contractual Clauses as signed by our entering into them.
You can ask us for a copy of the safeguards that apply, using the contact details in section 1.
8. How long we keep things
Retention is stated per purpose in section 4 and per item in section 5. In short:
- Session recordings — 30 days, then deleted automatically.
- Cookies and other device storage — the periods listed in section 5.
- Analytics event data — 14 months from the day it is collected. That covers a full year-over-year comparison and no more.
- Enquiry records — for as long as we are dealing with your enquiry and any relationship that follows from it. We review our contact records at least once a year and delete those where there has been no engagement from you and no realistic prospect of one.
When a period ends, the data is permanently deleted. It is not anonymised, and it cannot be recovered.
9. Your rights
Under the GDPR you have the right to:
- Access — get a copy of the personal data we hold about you, and information about how we use it.
- Rectification — have inaccurate data corrected.
- Erasure — have data deleted where we no longer need it, where you withdraw consent, or where you object successfully.
- Restriction — have us store but not otherwise use your data, in the circumstances the GDPR sets out.
- Object — object to processing we base on legitimate interest.
- Portability — receive data you gave us in a structured, machine-readable format, where we process it on consent or contract.
- Withdraw consent — at any time, without affecting processing that already happened. For cookies, see section 5.4.
Exercising any of these is free and we will respond without undue delay. Write to hello@sweetspot.io.
10. Automated decision-making
We do not make decisions about you by automated means alone, and we do not profile you in a way that has legal effects for you.
Where we run an experiment, different visitors see different versions of a page. That assignment is random, it does not depend on who you are, and it has no consequence for you beyond which layout you saw.
11. Children
This website is aimed at golf facilities and golfers, not at children, and we do not knowingly collect personal data from children through it.
12. Changes to this notice
We update this notice when what we do changes. The date at the top always reflects the current version. If a change materially affects you, we will make that clear on this page rather than changing it quietly.
13. Complaints
If you are unhappy with how we handle your personal data, please tell us first — we would rather fix it. You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten), Box 8114, 104 20 Stockholm, imy@imy.se, or to the supervisory authority where you live.
