Privacy Policy

1. Information We Collect

Account Information

• Full name, email address, and phone number (Philippine mobile format)
• Username and password (stored using bcrypt hashing — we never store plain-text passwords)
• Account code (PS-XXXXXX format) for queue check-in and identification
• Profile avatar (optional, uploaded by you)

Transaction Data

• Court booking history and booking details
• Payment records including method used, amounts, and confirmation references
• Refund requests and processing history
• Open Play session registrations
• Coaching session bookings
• Online shop orders and POS purchase records
• Voucher and discount code usage

Communication Preferences

• Email notification preferences (on/off)
• SMS notification preferences (on/off)
• Marketing email opt-in/opt-out status

Technical Information

• IP address (collected for security and rate-limiting purposes)
• User agent / browser information
• Session data (stored server-side, referenced by HTTP-only session cookies with a 2-hour lifetime)

Activity Logs

• Login and logout timestamps
• Platform actions (booking creation, profile updates, payment activities) — logged for security monitoring and audit purposes

2. How We Use Your Information

We use the information we collect for the following purposes:

• Booking services — Processing court reservations, managing hold slots, and sending booking confirmations
• Payment processing — Facilitating payments through supported channels and recording transaction details
• Open Play management — Registering you for drop-in sessions and managing capacity
• Coaching services — Booking coaching sessions and coordinating with coaches
• Online shop — Processing merchandise orders and tracking fulfillment
• Queue and check-in — Managing venue queue via your account code and QR code
• Notifications — Sending booking confirmations, payment receipts, reminders, and platform updates via email and SMS based on your preferences
• Vouchers and promotions — Validating and applying discount codes to your transactions
• Refunds — Processing refund requests and tracking refund status
• Security — Detecting fraud, preventing unauthorized access, enforcing rate limits, and monitoring suspicious activity
• Support — Assisting with account issues, booking problems, and general inquiries

3. Legal Basis for Processing (RA 10173)

We process your personal data based on the following legal grounds under the Data Privacy Act:

• Consent — You provide consent when you register an account and agree to our Terms of Service
• Contractual performance — Processing is necessary to fulfill our booking and payment services to you
• Legitimate interest — Security monitoring, fraud prevention, and platform improvement serve our legitimate business interests while respecting your rights

4. Third-Party Services

We use the following third-party services to operate our platform:

• Xendit — Payment gateway for processing online payments including GCash, Maya, and QR Ph. Xendit processes your payment details under their own privacy policy.
• Resend / AWS SES — Email delivery services for sending booking confirmations, receipts, and notifications
• Semaphore — SMS delivery service for sending text notifications to Philippine mobile numbers
• Google Fonts — Font delivery for the website interface
• Google Maps — Embedded map for displaying venue location

We do not use any advertising or analytics tracking cookies. We do not sell, rent, or trade your personal information to any third party.

5. Data Storage and Security

We implement the following security measures to protect your data:

• Password security — All passwords are hashed using bcrypt before storage. We never store plain-text passwords.
• CSRF protection — All form submissions are protected with CSRF tokens to prevent cross-site request forgery
• Rate limiting — IP-based login rate limiting to prevent brute-force attacks
• SSL/TLS encryption — All data transmitted between your browser and our servers is encrypted via HTTPS
• Session security — Server-side sessions with HTTP-only cookies and a 2-hour expiration
• Activity logging — Administrative and security-relevant actions are logged for audit and monitoring
• Webhook verification — Payment gateway webhook signatures are always validated to prevent unauthorized callbacks

6. Data Retention

• Active accounts — Your personal data is retained for the duration of your active account
• Transaction records — Booking, payment, and financial records may be retained as required by Philippine tax and business regulations
• Account deletion — Upon request, we will delete your personal data, except where retention is required by law or for legitimate business purposes (such as financial records)

7. Your Rights Under RA 10173

As a data subject under the Philippine Data Privacy Act, you have the right to:

• Access — Request a copy of the personal data we hold about you
• Rectification — Request correction of inaccurate or incomplete personal data
• Erasure — Request deletion of your personal data, subject to legal retention requirements
• Object — Object to the processing of your personal data in certain circumstances
• Portability — Request your personal data in a structured, machine-readable format
• File a complaint — Lodge a complaint with the National Privacy Commission (NPC) if you believe your privacy rights have been violated

To exercise any of these rights, contact us using the details in Section 11 below.

8. Cookies and Session Data

Our platform uses minimal cookies:

• Session cookie — An essential HTTP-only cookie that maintains your login session. This cookie expires after 2 hours of inactivity. It cannot be accessed by JavaScript and is not used for tracking.
• Theme preference — Your light/dark mode preference is stored in your browser's localStorage. This is not a cookie, is not sent to our servers, and is not used for tracking.

We do not use advertising cookies, analytics cookies, or any form of cross-site tracking.

9. Children's Privacy

Our platform is intended for users aged 18 and above. Users under 18 must have parental or guardian consent to create an account and use our services. We do not knowingly collect personal data from children under 18 without parental consent.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users via email and/or a prominent notice on the platform. Your continued use of the platform after any changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data privacy rights, please contact us:

Email: [email protected]

Phone: 09615088972