Privacy Policy

1. Who we are

We decide how your account, your competitive record and the Platform work, so we are the controller of that data. Write to our Data Protection Officer at privacy@padelhero.app, or to Data Protection Officer, Cogito Mutual Pte. Ltd., 68 Circular Road #02-01, Singapore 049422.

The organiser of a league you join, an Organizer, is a separate controller for the way it runs its league. The Partner Data Terms set out that split.

2. What we collect

We collect data from these sources.

• From you - name, email address, password, phone number, avatar, player display name and club affiliations. Photos and video you upload or link to, with any credit or caption. Heart-rate data, if you choose to import it; importing it is your consent to us processing it, and you can ask us to remove it. Feedback, screenshots and messages you send us.
• From your play - results, sets, match dates, venues, opponents and partners, fixtures, standings, ratings, levels, statistics, video statistics and court positions.
• From Organizers, clubs and venues - rosters, entries, results they enter, contact details they record for you, and footage from venue cameras.
• From partner systems - when your club connects a booking or ranking system such as BookAndGo or Playtomic, we receive results, ratings and the identifier your profile has in that system.
• From your device - a push notification token for each device you turn notifications on for, and whether you use the web, iOS or Android version. A push token identifies one app installation so a notification can reach it. We delete it when you turn notifications off or delete your account. Your IP address and user agent are kept in access logs for 7 days. We do not collect advertising identifiers such as IDFA or IDFV, we do not collect your location, and we do not track your browsing on other sites.
• From analytics - we use PostHog to understand how the app is used and to diagnose errors. It receives page views, web performance measurements, errors, and a short fixed list of product actions: registering, signing up for a season or tournament, submitting, approving or contesting a score, starting and finishing live scoring, joining an open game, voting for a most valuable player, and claiming a profile. Once you sign in, these are tied to your account identifier and your role. We never send your name, email address or phone number to PostHog, and any token in a link is replaced before the link is sent. PostHog also records sessions, which is a replay of the pages you saw and where you clicked and scrolled; text you type into a form is masked and is not recorded. Your browser sends all of this to our own domain, which passes it on to PostHog servers in the European Union.

A club or an Organizer can create a player profile for someone before that person has an account, so that results can be recorded. If a profile like that is yours, you can claim it from the player page, or ask us to remove it.

3. Why we use it, and on what basis

Where we rely on your consent, you can withdraw it at any time by writing to us. Withdrawing consent stops future use and does not undo what we did while the consent was in place.

We do not sell, rent or share your personal data for advertising. No advertising network runs on the Platform and no advertising SDK is bundled with it. Leagues do show their sponsors' logos on season and division pages. Every visitor to a page sees the same logos, and no personal data is used to choose or target them.

4. Ratings, standings and your name

Your name, results, standings, rating and level are shown to the other members of the leagues and events you take part in. They also appear on public league pages, at the identity level the Organizer chooses for that league.

A signed-out visitor sees a reduced identity. How much of a name a visitor sees depends on what they share with that player, not on being signed in.

5. Match video, photos and models

League and event play is recorded by cameras and photographers arranged by the Organizer, the venue or us. Section 6 of the Terms of Service covers what happens to that footage and how to ask for a takedown.

Our video analysis tracks players and the ball as positions on the court. It does not identify faces and it does not build a face template.

We use match footage, results, statistics and gameplay data to train and test the models that produce statistics, clips and insights.

Some text and creative features send match facts to an artificial intelligence provider that works for us under contract: player names, scores, event names and similar facts about a match. We never send heart-rate data or footage to those providers, and they may not use what we send to train their own models.

6. Who we share it with

• The Organizers, clubs and venues of the leagues and events you join, for running them.
• Other players in those leagues, who see results, standings and ratings.
• Service providers under contract: Railway (Singapore), Amazon Web Services (Singapore), Cloudflare, PostHog (European Union), Anthropic (United States), Google, Apple and Firebase.
• Partner systems your club connects, such as BookAndGo or Playtomic. Results and ratings move between the systems only for players linked to that system.
• Authorities, when the law requires it.

We do not sell personal data and we never will. Sign-in providers receive only the authentication request; we receive your name and email. Apple sends a name only the first time you sign in, and passes on a relay address if you choose to hide your email.

7. International transfers

Your data is stored in Singapore. Some providers listed in section 6 process data in the European Union or the United States.

Those transfers rest on contracts that require comparable protection, including the standard contractual clauses of the European Union for players in Europe.

8. How long we keep it

• Account data, for as long as your account exists.
• Results, standings and ratings, for as long as the league record exists. After you delete your account they stay with the league, attached to a player profile that is no longer linked to any account.
• Access logs, 7 days.
• Verification and sign-in tokens, until they are used or expire.
• Backups, on a rolling cycle, after which a deleted record is gone from them too.

9. Your rights

• See your data - your profile, match history and statistics are in the app.
• Correct it - edit what you can in the app and write to us for the rest.
• Delete your account - Settings, then Account, then Delete account. That removes your login, name, email address, avatar and two-factor secrets, deletes your notifications and push registrations, revokes any API tokens you hold, and unlinks your player profile from the account. Write to us to have your phone number, your heart-rate rows and the photos or video you uploaded removed as well.
• Ask for a copy - email privacy@padelhero.app and we send your personal data within 30 days.
• Withdraw consent - by writing to us.
• Object - tell us why and we stop unless we have grounds that override your objection.
• Complain - to us first, and to the data protection authority where you live.

We acknowledge a request within 2 working days and act within 10 working days, sooner where your law requires it.

10. Children

You need to be 16 to hold an account. A player aged 13 to 15 needs a parent or guardian to accept the terms and manage the account. Nobody under 13 may have an account, and we delete one we learn of.

Tell us when a player is under 16 and we limit their profile to a first name and an initial for anyone outside that player's own league.

11. Security and breaches

We protect personal data with technical and organisational measures that follow recognised good practice, including the cyber hygiene measures published by Singapore's Cyber Security Agency and the Personal Data Protection Commission's guidance on protecting personal data in ICT systems.

In practice: data is encrypted in transit and at rest. Passwords are hashed and never stored in plain text. Two-factor authentication is available on every account. Administrator and partner access is limited to the role and the league each person manages, and is logged. Automated access uses personal credentials that can be restricted to read-only and revoked at any time. Sessions can be ended from your account settings. Unusual access patterns are detected and limited.

We practise data hygiene: we collect only what a purpose needs, keep it only while that purpose lasts, delete one-time tokens after use, keep access logs for 7 days, anonymise accounts on deletion and keep backups on a rolling cycle. We review our security controls regularly, check third-party components for known vulnerabilities as part of our development process, and use service providers that meet recognised security standards.

No system is perfectly secure. If a breach affects you, we tell you and the relevant authority within the time the law requires, and we say what happened and what we did.

12. Cookies and analytics

We set a session cookie so you stay signed in, and preference cookies that remember choices such as which league you are looking at. PostHog sets the analytics cookies described in section 2. There are no advertising cookies and no cross-site tracking.

13. Changes to this policy

Each version carries an effective date, shown at the top of this page. We tell you about changes in the app or by email, and ask you to accept the new version the next time you open the app.

14. Contact

• Data Protection Officer: privacy@padelhero.app
• Support: info@saigonpadelleague.com
• Post: Cogito Mutual Pte. Ltd., 68 Circular Road #02-01, Singapore 049422