Privacy & security
How we handle your course's data.
Turfgrass Mastery OS processes greenkeeping data — including employee personal data — on the club's behalf. This statement explains in plain language what we process, where the data lives, how it is protected and what your rights are. A detailed data processing agreement (DPA) is attached to every service agreement.
Roles
The customer club is the data controller: it decides what data enters the system and why. Turfgrass Mastery (Janne Lehto MG) is the processor: we process data only on the club's behalf, under the agreement and its instructions. We never sell, share or use club data for any other purpose.
What data is processed
For club employees: name, job title, contact details, date of birth (age-limit compliance), shifts and working-time records, inductions and qualifications, and wage data for labour-cost calculation (visible to authorised roles only). For user accounts: name, email and a password hash — passwords are never stored in readable form. No special categories of personal data (e.g. health data) are processed, and no golfer or member personal data is processed: the tee-sheet integration stores only aggregated times and player counts, without names.
Where the data lives
The database is hosted in the EU (Turso). The application runs on Vercel. Version control holds only program code — never customer data. For third-party integrations (robotic mowers, soil sensors), keys are stored strongly encrypted and never travel to the browser; no personal data is sent to those services.
How the data is protected
Per-club isolation enforced server-side: a club sees only its own data, on every request. Role-based access control with wage data restricted. Passwords and PINs as bcrypt hashes, TLS-encrypted traffic (HSTS), rate-limited logins, signed session cookies. Backups on two independent levels. A security audit is repeated with every significant change — the latest report is available on request.
Retention and deletion
Data is kept only as long as employer obligations require: working-time records for employment + 2 years, induction and qualification records for employment + 10 years (occupational-safety burden of proof), demo accounts expire in 24 hours. When an agreement ends, the club's full data set is returned in machine-readable form and deleted from our systems within 90 days.
Data subject rights
Employees have the right to access, rectify and, under certain conditions, erase their data, and to receive it in machine-readable form. Requests go to the employer (the controller); we fulfil them on the club's request without delay, within 14 days at most. We notify the club of any personal data breach within 36 hours.
Subprocessors
We use the following subprocessors: Vercel Inc. (application platform) and Turso (database, EU region). Any transfers outside the EU/EEA are protected with the Commission's standard contractual clauses. Customers are notified of subprocessor changes in advance.
AI and the EU AI Act
The platform's calculation and analysis tools — such as growth, disease-pressure and nutrient models — are built on predefined agronomic formulas and statistical models, not on autonomously deciding AI. Under the EU AI Act (EU 2024/1689) risk classification, the service falls in the minimal-risk category in this respect. We follow three design principles: (1) A human always decides — the platform never commands machines or systems (e.g. robotic mowers, irrigation) on its own; every action towards equipment starts from the user's explicit confirmation. (2) Workforce management is not automated — task allocation, shifts and decisions concerning employees are always made by a supervisor; the system does not evaluate, score or monitor employees by means of AI. (3) Transparency — if generative AI features (such as an assistant) are introduced, their use is clearly disclosed to the user and AI-generated content is labelled in accordance with Article 50 of the Act. We document AI-based features and assess their risk category before release.
Questions and requests: Janne Lehto MG · jannenestori@turfgrassmastery.fi
Updated 21 Aug 2026 · The detailed DPA is attached to the service agreement