Last updated 25 October 2026
Privacy policy
1. Who we are
Mulligan is operated by ClubTag [CONFIRM: registered name, UEN, address], Singapore ("ClubTag", "we", "us"). This policy explains how we collect, use and protect your personal data when you use Mulligan at app.clubtag.sg, in line with Singapore's Personal Data Protection Act 2012 (PDPA).
Our Data Protection Officer can be reached at [CONFIRM: privacy@clubtag.sg].
2. What we collect
Account details
- Examples
- Email, name or Mulligan nickname, mobile number, country
- Why we need it
- To create your account, confirm your email and contact you about your trades
Golf details
- Examples
- Home club, handicap verification from your SGA QR code [CONFIRM what is stored], verification by other members, verification of your club membership [CONFIRM what is stored]
- Why we need it
- To verify you are a golfer and a member of the club you trade from. You must verify your club membership before you can pay for Full Membership
Listings
- Examples
- Photos, descriptions, prices, size band
- Why we need it
- To show your items to other members
Trades and messages
- Examples
- Offers, trade records, in-app chat, drop-off photos, problem reports (a reason, a short note and an optional photo)
- Why we need it
- To run trades, settle disputes and keep the Mulligan Locker orderly
Trade payment proof
- Examples
- The screenshot of the buyer's PayNow payment to the seller, one per trade
- Why we need it
- To show the seller the item price was paid, and to settle disputes
Payments to ClubTag
- Examples
- Your "I've paid" confirmations and PayNow references for membership and fees
- Why we need it
- To check payments and keep accounts. We never hold the price of items members sell to each other
A member's junior
- Examples
- If a member claims for their own child through the member flow: the child's display name, birth year and home club [CONFIRM other fields]. This is the member's data about their own child
- Why we need it
- To let the member claim donated equipment for their child
Public junior requests
- Examples
- No name, email or phone number of the junior. The postcode is used only for the search, and we keep only its first 2 digits (the postcode district). We keep the item, the club or academy chosen, an anonymous request code (for example JR-4K7P) and the request status
- Why we need it
- To hold the item for 3 days, show the private status page, and introduce Mulligan to the club or academy chosen
Share-link counts
- Examples
- Anonymous counts of share links opened, by source (item, club link, donor card, poster). No personal data
- Why we need it
- To see which ways of sharing free equipment for juniors work
Technical data
- Examples
- Log-in times, device and browser type, error logs
- Why we need it
- To keep the service secure and working
We do not ask golf clubs for member lists, and we do not collect payment card or bank account details.
3. How we use it
We use your personal data only to run Mulligan: your account and membership, listings, trades and transfers between clubs, Equipment Donations and junior requests, Clubhouse and games, support, security, and to meet legal obligations. When a junior chooses a club or academy, we use that organisation's contact details to introduce Mulligan to it. We do not sell personal data. We will only send marketing messages if you opt in, and you can opt out at any time.
Photo identification. When you list a club, you can ask Mulligan to identify it from your photos. Those photos are sent to our AI provider, Anthropic, to suggest the brand, model and other details, which you then confirm.
4. Who sees what
Other members see your Mulligan name, home club, listings, and Clubhouse and game posts. Your email and mobile number are never shown to other members.
The other member in a trade sees what is needed to complete it, including messages in that trade.
The PayNow screenshot for a trade is seen only by the buyer, the seller and Mulligan support.
When a junior with no golfer in the family chooses a club or academy, Mulligan emails that organisation to introduce itself, naming the item and the request code. We never contact the junior, and the organisation receives no personal data about the junior.
Golf clubs do not receive your personal data.
Our service providers process data on our behalf under contract: Supabase (database, sign-in and file storage), Vercel (hosting), Anthropic (photo identification) and [CONFIRM: email delivery provider; the app's code uses Resend].
Authorities, where the law requires it.
5. Transfers outside Singapore
Some providers store or process data outside Singapore [CONFIRM: regions]. Where they do, we make sure the data is protected to a standard comparable to the PDPA, as the Act requires.
6. Juniors
Donated equipment is for juniors (under 18) only. Juniors aged 13 to 15 can have a Mulligan account once a parent or guardian approves it; juniors aged 16 and 17 can join on their own. Children under 13 can't have an account; a parent, guardian or coach claims for them. A junior's account can browse, ask to join games at their own club, read the Clubhouse and claim donated equipment for themselves. Juniors can't sell, buy, send messages, post or donate, and they never appear in member search. We keep a junior's date of birth privately, and show only their first name and club.
Public junior requests. Anyone can browse free equipment for juniors without signing up. A junior can ask for an item without giving a name, email or phone number. If someone in the family plays golf, the junior shares a link with them from their own device, by WhatsApp or email; Mulligan does not see those contact details, and the family member signs in or joins Mulligan to claim. If no one in the family plays golf, the junior enters a postcode to find nearby clubs and academies; after the search we keep only the first 2 digits (the postcode district). The junior picks a club or academy, and Mulligan introduces itself to that organisation. Each request gets an anonymous request code and a private status page that holds no personal data. The item is held for 3 days.
A member's own child. A member who claims for their own child through the member flow can add the child's display name, birth year and home club. This is the member's data about their own child: the member gives consent for it, and can remove it at any time.
7. How long we keep it
We keep personal data only as long as we need it for the purposes above or as the law requires. Suggested defaults [CONFIRM]:
account data: while your account is open, then deleted or anonymised within 12 months of closure;
trade, payment and dispute records: 5 years, for accounting and dispute purposes;
PayNow screenshots for trades: kept with the trade record, for disputes [CONFIRM period];
drop-off photos: 90 days after the trade closes, unless needed for a dispute;
a member's junior profile: deleted when the member removes it or closes their account;
public junior requests (request code, status, postcode district): [CONFIRM period];
share-link counts: kept as anonymous totals.
8. Keeping it safe
We protect personal data with reasonable security measures, including encrypted connections, access controls on our database and limiting staff access to what each role needs. If a data breach is likely to cause significant harm, we will notify the Personal Data Protection Commission and affected members as the PDPA requires.
9. Your rights
You can ask to see the personal data we hold about you, ask us to correct it, or withdraw your consent to our using it. Withdrawing consent may mean we can no longer provide Mulligan to you. Email our Data Protection Officer; we aim to respond within 30 days.
10. Changes
We will post any changes on this page and tell members about significant ones in the app.