Privacy Policy

Welcome to paddlX. We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how paddlX (operated by [Your Company Legal Name], a company registered in the Philippines) collects, uses, discloses, and safeguards your personal information when you use our website, mobile application, and related services (collectively, the "Platform").

This Privacy Policy applies to all users of the Platform, including players, venue owners, coaches, tournament organizers, and visitors. By using paddlX, you agree to the collection and use of information in accordance with this Privacy Policy.

1.1 Data Controller Information

For the purposes of data protection law, paddlX is the data controller responsible for your personal information. Our contact details are:

• Company Name: [Your Company Legal Name]
• Address: [Business Address], Mandaluyong, Metro Manila, Philippines
• Email: privacy@paddlx.com
• Data Protection Officer: dpo@paddlx.com

1.2 Questions or Concerns

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us using the information provided in the Contact Us section below.

We collect information that you provide directly to us, information we obtain automatically when you use the Platform, and information from third-party sources.

2.1 Information You Provide to Us

Account Registration Information

• Full name
• Email address
• Phone number
• Date of birth
• Password (encrypted)
• Profile photo (optional)
• Gender (optional)
• Location/city

Profile Information

• Skill level and player rating
• Playing preferences and availability
• Bio and personal description
• Social media links (optional)
• Tournament history and achievements

Booking and Transaction Information

• Court bookings and reservations
• Tournament registrations
• Coaching session bookings
• Event participation records
• Booking history and preferences

Payment Information

• Billing name and address (collected by our payment processor)
• Last 4 digits of credit/debit card (for display purposes only)
• Card brand and expiration date
• Transaction history and receipts
• GCash, PayMaya, or other digital wallet information (handled by payment providers)

Important: We do NOT store full credit card numbers, CVV codes, or complete payment credentials on our servers. All payment information is securely processed and stored by Stripe, our PCI-DSS Level 1 certified payment processor.

User-Generated Content

• Reviews and ratings of venues, coaches, and events
• Comments and forum posts
• Photos and videos you upload
• Messages and communications with other users
• Tournament scores and match results

Communications

• Customer support inquiries and correspondence
• Feedback and survey responses
• Email and SMS communications
• In-app messages and notifications

2.2 Information Collected Automatically

When you use the Platform, we automatically collect certain information about your device and how you interact with our services:

Device Information

• Device type, model, and manufacturer
• Operating system and version
• Browser type and version
• Device identifiers (IDFA, Android ID)
• Screen resolution and device settings

Usage Information

• Pages viewed and features used
• Time and date of access
• Time spent on pages
• Links clicked and buttons pressed
• Search queries within the Platform
• Booking and browsing patterns

Technical Information

• IP address
• Log files and error reports
• Crash data and performance metrics
• Referring/exit pages and URLs
• Network connection type

Location Information

With your permission, we collect precise location data from your mobile device to:

• Show nearby courts and venues
• Calculate distances and travel times
• Provide location-based recommendations
• Enable check-ins at venues

You can control location permissions through your device settings at any time. If you deny location access, some features may not be available.

2.3 Information from Third Parties

We may receive information about you from third-party sources:

• Social Media: If you connect your social media accounts (Facebook, Google), we receive basic profile information
• Payment Processors: Transaction confirmations and payment status from Stripe
• Analytics Providers: Aggregate usage data and demographics from analytics services
• Venue Partners: Information about your bookings and check-ins at partner facilities

We do not sell your personal information to third parties. We may share your information in the following circumstances:

4.1 With Service Providers

When you make a booking, your information is shared with the relevant service provider (venue, coach, or organizer) to fulfill your booking. This includes:

• Venue Owners: Name, contact information, booking details
• Coaches: Name, contact information, skill level, session details
• Tournament Organizers: Name, contact information, player rating, registration details

4.2 With Third-Party Service Providers

We work with trusted third-party service providers who help us operate the Platform:

• Payment Processors (Stripe): To process payments securely
• Cloud Hosting (Supabase): To store and manage data securely
• Email Services: To send transactional and promotional emails
• SMS Services: To send booking reminders and notifications
• Analytics Providers: To understand Platform usage (Google Analytics, etc.)
• Customer Support Tools: To provide help and support services

All third-party service providers are contractually required to protect your data and use it only for authorized purposes.

4.3 With Other Users

Certain information is visible to other users to facilitate community features:

• Your public profile (name, photo, skill level, bio) is visible to other users
• Tournament results and match scores may be publicly displayed
• Reviews and ratings you post are publicly visible
• Comments and forum posts are visible to community members

You can control your profile visibility in your privacy settings.

4.4 For Legal Reasons

We may disclose your information if required by law or if we believe in good faith that such action is necessary to:

• Comply with a legal obligation, court order, or subpoena
• Protect and defend our rights or property
• Prevent or investigate possible wrongdoing
• Protect the personal safety of users or the public
• Protect against legal liability

4.5 Business Transfers

If paddlX is involved in a merger, acquisition, asset sale, or bankruptcy, your personal information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on the Platform before your information is transferred and becomes subject to a different privacy policy.

How Payment Processing Works

1. When you enter payment information, it is sent directly to Stripe using encrypted connections
2. Stripe securely processes and stores your payment information
3. Stripe returns a secure token to paddlX to represent your payment method
4. paddlX stores only: last 4 digits of your card, card brand, expiration date, and billing name
5. When you make a booking, we use the secure token to instruct Stripe to process the payment

What Payment Information We Store

• Limited Card Display Information: Last 4 digits, card brand (Visa, Mastercard, etc.), expiration date
• Transaction Records: Date, amount, booking reference, receipt
• Billing Information: Name and billing address for invoicing

Digital Wallet Information

For payments made through GCash, PayMaya, or other digital wallets:

• Payment information is processed by the respective wallet provider
• We receive only transaction confirmation and receipt information
• We do not have access to your wallet credentials or balance

For more information about how Stripe protects your payment data, please visit Stripe's Privacy Policy.

How We Use Location Data

With your permission, paddlX collects and uses your location data to provide location-based features:

• Show nearby courts, venues, and facilities
• Calculate distances and provide directions
• Recommend events and tournaments in your area
• Find and connect with nearby players
• Enable check-in features at venues
• Provide location-specific content and recommendations

Types of Location Data We Collect

• Precise Location: GPS coordinates from your mobile device (when you grant permission)
• Approximate Location: City/region based on IP address
• User-Provided Location: City or region you manually enter in your profile

Controlling Location Permissions

You have full control over location access:

• iOS: Settings > Privacy > Location Services > paddlX
• Android: Settings > Apps > paddlX > Permissions > Location
• Within App: Account Settings > Privacy > Location Permissions

Note: If you disable location services, some features like "nearby courts" and distance calculations will not be available.

What Are Cookies?

Cookies are small text files placed on your device by websites and apps you visit. They help us provide a better experience by remembering your preferences and understanding how you use the Platform.

Types of Cookies We Use

Managing Cookies

You can control cookies through:

• Cookie Banner: Accept or reject optional cookies when you first visit
• Cookie Settings: Manage preferences in your account settings
• Browser Settings: Block or delete cookies through your browser

Note: Blocking certain cookies may affect Platform functionality and user experience.

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction.

Security Measures We Implement

• Encryption: 256-bit SSL/TLS encryption for data transmission
• Data Encryption at Rest: All sensitive data is encrypted when stored
• Secure Authentication: Password hashing and multi-factor authentication options
• Access Controls: Role-based access to limit who can view your data
• Regular Security Audits: Third-party security assessments and penetration testing
• Secure Hosting: Data stored on secure cloud servers with redundancy
• Monitoring: 24/7 monitoring for security threats and anomalies
• Employee Training: Regular security and privacy training for all staff

Your Security Responsibilities

You can help protect your account by:

• Using a strong, unique password
• Never sharing your login credentials
• Logging out after each session on shared devices
• Enabling two-factor authentication (when available)
• Reporting suspicious activity immediately

Under the Data Privacy Act of 2012 and international data protection laws, you have the following rights regarding your personal information:

How to Exercise Your Rights

To exercise any of these rights:

1. Through Your Account: Access and manage many settings directly in your profile
2. Email Us: Send a request to privacy@paddlx.com
3. In-App Request: Use the "Privacy Rights Request" form in Settings

We will respond to your request within 15 days as required by the Data Privacy Act. We may ask you to verify your identity before processing your request.

Opting Out of Marketing Communications

You can opt out of marketing emails by:

• Clicking "Unsubscribe" in any marketing email
• Adjusting email preferences in Account Settings
• Contacting us at privacy@paddlx.com

Note: You will still receive transactional emails (booking confirmations, receipts, etc.) even if you opt out of marketing.