Privacy Policy

Data controller: [Entidade legal a constituir], tax no. [NIF], with registered office at [Morada da sede]. Contact: [email de privacidade].

This policy explains how we handle personal data when you use the Padelatic service ("Service"). It applies to coaches who create an account. The data of the players a coach enters is processed on that coach's behalf — see section 8.

1. What data we collect

From your coach account (we are the controller):

• Identification and contact: name, email, phone (optional), preferred language.
• Authentication: handled by Clerk (see sub-processors); your password is never seen by us.
• Billing: handled by Stripe; we store the customer identifier and subscription status, never the full card number.
• Technical usage data: access logs, IP address, device/browser type, for security and diagnostics.

From your players (processed by us on your behalf — the coach is the controller):

• Player name, email and/or phone (optional, entered by the coach).
• Level, dominant hand, court side, notes, skill evaluations, synergies and progression.
• Minors: the Service may be used to manage under-age players. Parental consent is the coach's responsibility (see section 8).

2. Why we use the data and on what basis

3. Where data is hosted

The primary database is hosted in the European Union (Frankfurt, Germany — Neon). Some sub-processors are based outside the EU (USA); those transfers are covered by Standard Contractual Clauses and/or the EU-US Data Privacy Framework. The full list is in the Data Processing Agreement.

4. How long we keep it

• Account data: while the account is active and up to 30 days after its closure.
• Billing data: for the legally required period (in Portugal, generally 10 years for tax documents).
• Player data: while the coach's account keeps it; deleted when the coach deletes it or when the account is closed (subject to the period above).
• Technical logs: up to 12 months.

5. Your rights

You have the right to: access, rectify, erase, restrict and object to processing, and to data portability. You can export your data and delete your account directly in account settings. For other requests, contact [email de privacidade]. You also have the right to lodge a complaint with the supervisory authority: in Portugal the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.

6. Security

We apply appropriate technical and organizational measures: encrypted connection (HTTPS), authentication managed by a specialized provider, per-account segregation (each coach only accesses their own data), and random, unguessable share tokens (122-bit entropy) for public player pages, revocable by the coach at any time.

7. Public player pages (sharing)

The coach can generate a public link for a player. Anyone with the link sees the information the coach chose to make visible (the level band and progression signal are off by default). The coach can disable the link at any time, which invalidates access. We recommend not sharing minors' data publicly without proper consent.

8. Player data: our role as processor

For player data, we act as processor; the coach is the controller. The coach warrants a lawful basis to process that data (including, for minors, parental consent) and that they have informed the data subjects. The conditions of this processing are in the Data Processing Agreement, which forms part of the Terms of Service.

9. Cookies

We use essential cookies (session/authentication) and, with consent, non-essential cookies. See the Cookie Policy.

10. Changes

We may update this policy; material changes will be communicated by email or in the Service. Contact: [email de privacidade].