Privacy Policy

We collect the following data when you create an account and use the platform:

• Account data: your email address — the identifier you sign in with and the address we write to — plus your display name, city, skill level, a profile photo if you add one, and a mobile number if you choose to add one or sign in with it.
• Booking and transaction data: your bookings, their amounts and status, refund history and loyalty points.
• Payment data: your card details are handled in full by the licensed payment service provider; we never store your full card number on our systems.
• Technical data: device identifiers, push notification tokens, usage logs, and performance and crash measurements.
• Correspondence: your messages with the support team, your ratings and your content on the platform.

Your email address and core account data are required to provide the service; optional data (such as a profile photo or a mobile number) can be withheld without losing access to the platform.

We process your data exclusively for the following purposes:

• Creating your account, verifying your identity and signing you in.
• Executing bookings, payments, refunds, invoicing and club settlements.
• Running open matches and showing your player profile to participants in your matches.
• Supporting you and responding to your inquiries and complaints.
• Securing the Platform, preventing fraud and abuse, and improving the service.
• Sending operational notifications about your bookings and account.
• Marketing messages — only with your prior consent, which you can switch off at any time as easily as you gave it.

We do not use your data for purposes other than those stated in this policy.

Each processing activity rests on a legal basis under Articles 5 and 6 of the law:

• Contract performance: managing your account and executing your bookings, payments and support — our primary basis.
• Legal obligation: retaining contract, transaction and invoice records under commercial and tax regulations.
• Legitimate interest: protecting the Platform from fraud and improving it through aggregated analytics — for non-sensitive data only and without prejudice to your rights and interests.
• Consent: marketing messages and optional analytics; you may withdraw consent at any time, free of charge, without affecting core services.

We do not sell your personal data to anyone. We share it as narrowly as possible with:

• The club you book with: your display name and the booking details needed to provide the service — never any payment data.
• Competent authorities where there is a lawful request or requirement.

The technical service providers we rely on, under processing agreements that bind them to confidentiality and limit their use of the data to serving us, are:

• Supabase — database, account management and file storage.
• Vercel — hosting for the website and app.
• Cloudflare — domain management and inbound email routing.
• Resend — sending operational email.
• Moyasar — payment and refund processing, a licensed provider in the Kingdom.
• Google Firebase — mobile and browser push notifications, when enabled.
• Sentry — technical error monitoring, when enabled.
• PostHog — usage measurement, when enabled.
• Our SMS provider and WhatsApp Business — verification and support messages, when enabled.

This list may change as our providers change; we update it here whenever it changes materially.

We keep your account data for as long as your account is active. Contract and transaction records are kept for at least three years from the date of the contract under the implementing regulation of the E-Commerce Law, and may be kept longer where tax law requires it. Support correspondence is kept for up to three years, and technical logs for up to twelve months.

When you delete your account, your identifying data is anonymized as soon as you confirm — not after a waiting period: your name, photo, mobile number and email address are removed; your notifications, favorites, follows, posts, comments and push tokens are deleted; and sign-in is closed permanently. Booking, order and payment records remain for the statutory periods above, attached to an identifier that does not point to you; a retained order keeps only the delivery city, never the name, mobile number or street address you entered, and the shipping carrier and tracking number are removed with them.

Some data is beyond the reach of self-service deletion and remains after it: your support correspondence and anything attached to it — including any identity documents you sent us for verification — is kept for the period stated above; self-service deletion does not remove it, because it is part of the support record we are required to keep, and the files you attached are stored under the ticket rather than under your account. Beyond its reach too are your WhatsApp conversations with customer service and any waiting-list requests, because those are keyed to the phone number or email address you contacted us from and not to your account id. If you owned a club that has since been closed or archived, the contact phone and email published on that club's record stay with the club, because they are the club's published business contact and its remaining staff still use them. The same applies if a club booked a court for you at its counter: the name and mobile number the staff member wrote down stay in that club's front-desk booking register, because they are attached to the booking itself and not to your account id. A club's payout and tax details — its IBAN, beneficiary name and VAT number — also stay with the club, because they are the financial record it is paid by and it outlives any one staff account. You can ask for any of it to be destroyed through the help center or the privacy email.

We apply technical and organizational safeguards to protect your data: encrypted connections, need-based access restrictions, separation of privileges, and continuous monitoring and updates.

If an incident affecting your personal data occurs that may cause you harm, we are committed to notifying the Saudi Data & AI Authority (SDAIA) within seventy-two hours and informing you without undue delay, in accordance with Article 20 of the law and its regulations.

The Personal Data Protection Law grants you the following rights:

• To be informed of the purposes for collecting your data and their legal basis.
• To access the personal data we hold about you.
• To obtain a copy of it in a clear, readable format.
• To request its correction, completion or update.
• To request its destruction once it is no longer needed or once you withdraw consent.
• To withdraw your consent at any time, free of charge.

You can exercise the right to erasure yourself from Profile → Delete account in the app, and it takes effect as soon as you confirm. If you have an upcoming court booking that has not finished, an upcoming coaching session that has not finished, a confirmed entry in a paid tournament that has not started, a refund still being processed, a store order that has not been delivered yet, or unsettled club amounts, deletion waits until those obligations are closed and the screen explains why. If you own an active club, its ownership has to be transferred or the club closed first — contact support — because erasing the owner deletes their club_members owner row, and the owner role cannot be re-created from inside the product (it is created once when the club is created, and the club_members policies block a client from assigning it), so the club is left with no owner. If your account is suspended you cannot reach that screen, because sign-in is closed while a suspension stands; contact support or the privacy email and we carry the request out for you — a suspension is a moderation measure and does not take away your right to erasure.

For any other request, use the in-app help center or the privacy email; we verify your identity and respond within thirty days (extendable by a further thirty days for complex or repeated requests) at no cost. You may in all cases file a complaint with SDAIA as the competent authority.

Some of our technical systems (database, hosting, analytics) are hosted with cloud providers outside the Kingdom. Transfers are limited to the minimum necessary to provide the service and are subject to contractual safeguards and protection obligations consistent with Article 29 of the law and the Regulation on Personal Data Transfer outside the Kingdom.

Payment processing is carried out through a payment provider licensed in the Kingdom of Saudi Arabia.

We use cookies and similar technologies as follows:

• Essential: to run your session and sign-in and to remember your language and theme — these are required for the platform to work and cannot be turned off.
• Measurement and monitoring: usage measurement and error monitoring tools, which run only where we have enabled them, are never used for advertising, and whose data is not shared for marketing purposes.

We do not yet show an in-product consent panel, and we are working on one. Until it is available you can block these technologies in your browser settings, or write to our privacy address to have measurement switched off for your account. You can manage notifications from your device or account settings at any time.

We may update this policy from time to time. For any material change we will notify you via the Platform or your registered contact channels before it takes effect, and the “Last updated” date at the top of this page will be revised.

For any inquiry or request concerning your personal data (access, a copy, correction, destruction, or withdrawing consent), email us at privacy@padict.sa or use the in-app Help Center, and we will respond within the timeframes above.

The party responsible for processing your data: Padict Establishment — Commercial Registration No. 7054906065, Kingdom of Saudi Arabia.

You may in all cases lodge a complaint with the Saudi Data & AI Authority (SDAIA).