Privacy Policy

1. Data Controller

The data controller is:

Dynamytheon Limited (company number 17256365)

Email: info@dynamytheon.com

2. Personal Data We Collect

We collect only the personal data necessary to operate and improve the App.

Data you may provide directly includes:

• Name or display name
• Optional unique player tag, including any emoji you choose to include, and your choice to make that tag searchable by verified players
• Email address
• Account credentials (passwords are stored in encrypted form)
• Any information you choose to submit through the App
• If you use Friends: your friend code, friend requests and connections, blocks and reports, messages you send or receive, safety report status and replies, and match details you choose to share with a connected player
• If you set a player tag: searches for that tag and connection requests sent through player search

If you sign in using third-party authentication:

• Apple Sign-In: a unique user identifier and, if you choose to share it, your email address
• Google Sign-In: a unique user identifier, name, and email address

We never receive your Apple ID or Google account password.

If you enable location access:

• Your device's approximate or precise location, used only to find stringers and venues near you

Location access is optional and only requested when you use a feature that needs it, such as searching for nearby stringing shops. You can grant or revoke location permission at any time from your device settings, and the App remains usable without it — you can still search manually or browse without a location-based search.

If you save or enter a shipping address for a Marketplace or Pro Shop order:

• Recipient name and phone number
• Address lines, city, region, postcode, and country
• An address type or label you choose (for example, Home, Office, Billing, or a custom label)

Addresses you save to your address book in Profile are stored for reuse at future checkouts. You can add, edit, or delete saved addresses at any time.

Seller tax and transaction information

If you sell through the Marketplace or operate a venue accepting bookings or sales, we collect your UK VAT registration declaration and the information needed to verify a registered declaration. The sections below explain what you must declare, what PrecisionR checks and calculates, and how this information may be used.

Your VAT declaration

You must select whether you are VAT registered and keep that declaration complete, accurate and up to date. If you select “not VAT registered”, we record your declaration but do not independently verify it with HMRC. HMRC's Check a UK VAT Number service requires a VAT number; it cannot confirm that a business is not registered by searching for its company name. Selecting “not VAT registered” does not mean that your supplies are exempt, zero-rated or outside the scope of VAT.

What the HMRC check verifies

If you declare that you are registered, you must provide your VAT number, registered legal name and registered address. Our server sends the VAT number to HMRC's Check a UK VAT Number service. HMRC returns the registered name and address, which we compare with the details you supplied. We accept the registered declaration only when HMRC confirms the number is registered and both identity details match. If the details are incomplete or do not match, or HMRC's service is unavailable, we cannot verify the declaration; selling and booking features that require verification remain blocked until it succeeds. Existing declarations checked by number alone must be verified again. This check verifies the registration identity returned by HMRC. It does not establish your correct registration effective date or decide whether a particular supply is taxable or what VAT rate applies.

Your responsibilities under VAT law

Your VAT obligations are determined by law and your circumstances, including your taxable turnover and the supplies you make. Your selection in PrecisionR does not determine your legal VAT status. If you are required to register or account for VAT, you remain responsible for doing so even if you select “not VAT registered”, do not show VAT separately to a customer, or PrecisionR did not collect VAT for you. HMRC may require VAT to be accounted for from the date you were liable to be registered, even if you did not charge it to customers. You are responsible for deciding the correct VAT treatment and rate for each supply, keeping the required records, issuing any required invoices, submitting returns and paying VAT due. HMRC may assess unpaid VAT and may charge interest or penalties where the legal conditions apply; the consequences depend on the facts and are determined by HMRC or the courts, not PrecisionR.

How PrecisionR calculates and reports VAT

For relevant transactions, PrecisionR may calculate and save an expected supplier VAT and net amount from the transaction amount and the declared or configured VAT status, treatment and rate. If required information is missing or uncertain, the amount may be left uncalculated or marked for review. The admin VAT report also offers an optional, separate potential VAT exposure estimate for eligible business-supplier transactions where supplier VAT was not recorded or the supplier was marked not registered. That estimate uses stated assumptions about the VAT rate, VAT-inclusive prices and recorded refunds; it does not change the transaction or payment, verify VAT registration, calculate your total taxable turnover, establish your legal VAT liability or produce an HMRC VAT return. PrecisionR records VAT on its own platform fees separately. These figures are estimates based on available data, not an HMRC assessment or tax advice, and may not match the amount you legally owe.

Access to and disclosure of VAT information

VAT numbers and registered identity details are stored in restricted records. They are not shown on public profiles and are accessible only to the account or venue managers authorised to manage that VAT record and authorised PrecisionR financial administrators. We send a VAT number to HMRC when performing the registration identity check; HMRC handles it under its own privacy notice. We may also disclose relevant VAT declarations, identity details, calculated transaction snapshots and related account or transaction records to HMRC or another competent authority where required or otherwise permitted by law, including in response to a lawful request or tax compliance investigation. We assess each disclosure under the applicable law and limit it to relevant information. A mismatch or estimate alone does not automatically trigger a report to HMRC.

We may also collect certain data automatically, such as:

• Device type and operating system
• App version
• IP address
• Usage and interaction data (for example, session duration or features used)
• Optional self-reported play and equipment ratings: how you felt (Off, Good, or On fire) and, when logging a match, how the strings felt (Fresh, Good, Worn, or Replace). You can skip either rating; when provided, it is associated with your logged play and selected racket.

We use ratings you choose to provide for your own play history and trends. The Wellbeing detail screen also calculates a personal 7-day Readiness average and label by combining available daily-feeling, match-feeling, and string-feel ratings (weighted 40%, 35%, and 25% where those values are available). This is a personal sport/racket summary, not a medical assessment or diagnosis, and is not used to infer a health condition. If you skip the feeling rating when logging a match, the match can still be saved, but the App will not create a feeling-history or trend entry for that match. String-feel ratings also contribute to your personal string-wear estimates and related achievement progress. These ratings are optional and are not shared with venues or other player accounts. No Fitbit or other wearable connection is currently provided. The rating controls do not ask for or display an energy level or free-text note. Selecting an optional rating after seeing the point-of-entry explanation is intended to be your consent to save and use that rating for these personal features; accepting the Terms and Privacy Notice alone is not consent to provide a rating. You may skip the rating. To withdraw consent and delete saved feeling and string-condition ratings, open Play > Wellbeing and choose Delete my saved ratings. This removes the recorded ratings and related personal trends; match results remain. You can choose ratings again when logging future play.

3. Legal Basis for Processing

We process personal data under one or more of the following legal bases:

• Performance of a contract (to provide the App and manage your account)
• Your consent, where explicitly requested
• Our legitimate interests, such as improving the App and maintaining security
• Compliance with legal obligations

4. How We Use Your Data

Your personal data is used to:

• Create and manage your user account
• Authenticate users securely
• Provide App functionality and services, including opt-in friend connections and direct messaging
• Let verified players search for your player tag only when you opt in to tag search
• Share a completed match result only when you choose to send it, and let the recipient view it as a read-only record that is not added to their match log
• Review user reports and enforce safety rules for player-to-player interactions
• Show personal play history, trends, string-wear estimates, and achievement progress based on information you choose to log
• Show you nearby stringers and venues, only if you grant location permission
• Communicate with you regarding service-related matters
• Improve performance, usability, and security
• Comply with legal and regulatory requirements

5. Data Sharing

We do not sell your personal data.

We may share limited data with:

• Authentication providers (Apple and Google) for login purposes only
• Supabase, for account authentication, database records, and file storage, and Railway, for backend hosting and API operations
• Stripe, for payment processing and connected seller accounts; Stripe handles identity, bank, and payment details submitted directly through Stripe-hosted pages
• Resend, for transactional email, and Expo Push Service, Apple Push Notification service (APNs), and Firebase Cloud Messaging (FCM), to route push notifications and device tokens
• Analytics, monitoring, and operational infrastructure providers, where used, to maintain service operation and security
• HMRC, when a player seller or venue enters or changes VAT details. We send the VAT number to HMRC’s Check a UK VAT Number API and compare HMRC’s returned registered legal name and address with the details supplied by the seller. The comparison is performed on our server; the HMRC identity response is not exposed to other users. HMRC handles the VAT number it receives under its own privacy notice.
• Google Cloud Vision API (Google LLC), to screen uploaded images for prohibited content and, for some image types, tennis-equipment relevance. This may include avatars, racket, venue, listing, campaign, hire-order, and temporary design-reference images.
• Google Gemini API (Google LLC), to assess some submitted text for safety, fraud prevention, and policy enforcement. This may include player tags, marketplace listing text, messages, reviews and replies, support content, booking notes, venue names, and other free text.
• OpenStreetMap Foundation’s Nominatim service and the device platform’s native geocoder for venue-address searches; Google Maps receives the selected venue location only when you choose to open directions.
• HMRC, regulators, law enforcement or other competent authorities, where disclosure is required or otherwise permitted by law. This may include a lawful HMRC request or tax compliance investigation. We may provide relevant VAT declarations and identity details, calculated tax snapshots, and related account or transaction records for the stated purpose. We assess each disclosure under applicable law and limit it to relevant information; we do not automatically refer every VAT mismatch or suspected error.

When you use Friends, the players you connect with can see your display name and the messages or match score you choose to send them. You can attach a result to a friend request; it remains hidden from the recipient unless they accept the request. A shared match contains the match date, duration, indoor or outdoor setting, court surface and score; it does not include your racket, string setup, location or wellbeing ratings. The recipient can view the result as a read-only record, but it is not added to or editable in their match log. Messages and match details are stored in your account-linked records and are included in your account export.

We maintain supplier records covering the services used, their data-protection terms, processing locations, retention arrangements, subprocessors, and transfer safeguards. Providers may process data outside the United Kingdom, including in the United States or other countries, under the applicable supplier terms and transfer safeguards. The provider and processing location depend on the feature. Contact us at info@dynamytheon.com for details about a provider or data flow relevant to you.

We may use or commercialise market and product insights derived from aggregated and de-identified data only, with safeguards intended to reduce the risk of re-identification.

We do not sell raw account-level records, direct identifiers (such as email addresses), payment card details, message content, or full booking histories to third parties.

We do not automatically share your private contact details with venues. If a venue needs to contact you directly, you can choose to share details through messaging or outside the App.

When you complete a Marketplace or Pro Shop purchase, your shipping address is shared with the seller solely to fulfil that order, and the tracking reference the seller provides is shared with you. This is limited to the two parties in that transaction and is not used for any other purpose.

Payments are processed by Stripe.

We do not store full credit card numbers, card verification values (CVV), or bank account details on our servers. Stripe processes payment instrument data and transaction authentication under its own systems and security controls.

We may retain limited payment metadata where needed for support, accounting, refunds, disputes, fraud prevention, and tax compliance, such as transaction IDs, payment status, refund status, timestamps, and masked card details like the last four digits and card brand.

If you set up a payout account to sell or receive payments (as a Player seller or a venue).

You provide identity verification information (such as your name, date of birth, address, and, where required, government ID) and bank account details directly to Stripe, through pages Stripe hosts outside the App. We do not receive, see, or store this information on our servers. Stripe acts as an independent data controller for the information you give it during this process, under its own privacy policy.

You can manage analytics and data sharing preferences, download a copy of your data, and delete your account from the Privacy & Security screen in the App.

6. Privacy Controls and Data Portability

The App includes privacy controls for data sharing and analytics. These settings are designed to let you limit secondary use of your data while keeping core account and booking services available.

We do not currently use your data to provide personalised advertising to players in the App.

Where technically feasible, we apply minimum-group thresholds and de-identification controls before using data for analytics or insight reporting.

When you disable optional data sharing or analytics controls, we stop using your data for those optional purposes going forward, but we may continue processing data that is strictly necessary to deliver the service, secure accounts, and meet legal obligations.

Account deletion is available in Privacy & Security. After you confirm, we process deletion in the background. We remove your account profile, sign-in identity, account-linked records and account-owned media, and verify that removal before sending a completion email to your verified account email address. If a cleanup step is temporarily unavailable, the request remains queued and is retried. Until deletion and the confirmation email are complete, a restricted service record temporarily holds the account identifier, email address and owned-venue identifiers needed to finish the work and notify you; that record is then deleted. We retain only a minimal, identifier-free deletion receipt for one year after completion and email acceptance. A specific legal obligation or active claim may require us to retain a minimized record; where possible, we detach it from your account, restrict access and delete it when that need ends. Provider logs and backups may persist temporarily under provider retention settings. Contact info@dynamytheon.com if you need information about a deletion request or a specific retained record.

7. International Transfers

Some suppliers process personal data outside the United Kingdom. We assess the destination and use an applicable transfer mechanism where required, such as an adequacy decision or appropriate contractual safeguards under UK data-protection law. The mechanism depends on the supplier, service, and data flow; supplier-specific locations and safeguards are recorded in our supplier records. Contact info@dynamytheon.com for details relevant to a particular service or transfer.

8. Data Retention

We retain personal data only for as long as necessary to provide the App and meet legal obligations. The retention period depends on the category of data:

Account & Profile Data

Your account information is used while your account is active. When you request deletion, the workflow removes your account profile and authentication identity, account-linked database records subject to their documented foreign-key retention rules, and media in the user and owned-venue storage paths covered by the workflow. Minimal transaction or security records may remain where a specific legal obligation or active claim requires them; they are detached from your account where possible, restricted to that purpose and removed when no longer required. Third-party processor logs and backups may persist temporarily under provider retention settings, which may differ from deletion in PrecisionR systems; exact purge periods vary by provider.

Friends, Messages and Shared Matches

A player tag is optional and unique. A player can choose whether verified player accounts can find the tag in search. Search results show the tag only; they do not provide a profile page or expose email address, phone number, avatar, or full name. Search is off by default, and switching it off or removing the tag stops it appearing in future searches. Friend-code connections remain available. Player tags are screened by automated moderation before they can be saved. Friend connections, blocks, messages, reports and safety-team replies are kept while the relevant accounts remain active and the records are needed to operate the feature. Blocking is reversible: while a block is active, the players cannot find each other by tag, send friend requests or new messages, or share matches. The existing friendship and chat history are retained; the chat is read-only for both players until the blocker unblocks the other player. Unblocking restores messaging if the friendship still exists. Removing a friend ends the connection, keeps the chat history as read-only, and cancels pending match shares. If the players connect again, they can use the existing chat. Archiving moves a conversation from the active Messages list into Archived chats, which only the archiving player can see; it does not delete messages or affect the other player's inbox, and it can be restored at any time. Hiding a conversation through the delete action removes it from that player's list but does not erase it or prevent access through other app routes. Account deletion removes account-linked friend records, messages, reports, replies and chat restrictions through the deletion workflow. Messages are screened for safety; they are not end-to-end encrypted.

Safety reports may contain allegations of unlawful conduct and may include criminal-offence data or special-category information. We use report information to assess safety concerns, protect people using Friends and enforce our rules. Our starting basis for proportionate safety review is our legitimate interests. Where a report identifies a person as suspected of an offence, we process that information only where a lawful Article 10 route under UK data protection law applies; reviewers record the classification, applicable condition and why the information is needed. Special-category information is assessed separately under Article 9. Authorised PrecisionR safety reviewers can access reports, the reporter's submitted details and internal review notes. A player who is reported cannot view the report, its category or status while it is under review. If PrecisionR suspends friend messaging or deactivates the account, the affected player receives a private notice explaining the restriction and how to request a review. A data export includes a report about that player only after such a restriction has been applied; it excludes the reporter's identity and private complaint details. A private notice may be delivered in the App and to the affected player's verified email address. Do not include passwords, payment details or unrelated sensitive information in a report. If someone is in immediate danger, contact emergency services; a PrecisionR report is not an emergency service.

Authentication & Security Logs

Some security audit records are configured to expire after 365 days. This is a current system setting, not a statutory period. Provider authentication and operational logs follow the retention terms and settings for the relevant supplier, which vary by service.

Legal Consent Records

Legal acceptance audit records are configured to expire after 730 days so we can evidence which version you accepted and when. This is a current system setting, not a period mandated by data protection law.

Payment & Transaction Records

Payment and transaction records may be retained for accounting, tax, refund, dispute and fraud-prevention purposes. These can include seller VAT declarations, VAT numbers, supplier tax snapshots, PrecisionR fee VAT snapshots, transaction timestamps, Stripe references, refunds and tax adjustments. The registered legal name and address supplied for HMRC matching are stored on the seller or venue VAT record until changed or deleted. Supplier VAT and PrecisionR output VAT are stored and reported separately. Access to VAT numbers and registered VAT identity details is restricted to the account or venue managers authorised to manage that VAT record and authorised financial administrators; these details are not displayed on public profiles. VAT declaration audit records contain status and verification changes, not the VAT number or registered identity details, and are configured to expire six years after each event. This period is intended to align with HMRC's general VAT record-keeping period; it is our retention setting for these audit records and does not mean every payment or seller tax record has the same expiry. We do not store full card details or CVV on our servers; those details are handled by Stripe.

Order & Service Records

Order and service records are kept for as long as needed to fulfil the transaction, provide support, handle refunds and disputes, prevent fraud, and meet legal obligations. The retention period depends on the record type and circumstances. Relevant supplier logs and backups are subject to the supplier's retention and deletion terms.

Shipping addresses and tracking references are kept with order records for fulfilment, refunds, disputes, and legal obligations. Saved address-book entries can be edited or deleted from Profile. Copies held by a seller or venue are subject to that organisation's own privacy practices.

Audit & Activity Logs

Our application retention schedule configures automated cleanup for telemetry and error events after 180 days and deleted inbox items after 90 days. Security audit records are configured to expire after 365 days, and legal acceptance audit records after 730 days. Other activity records follow their own schedule. Supplier operational logs and backups may have separate retention periods under the applicable supplier terms.

Image and Text Moderation Records

Moderation records may include the content type, provider or model, decision, reason, confidence, and timestamp; some text excerpts are not stored. Moderation records are retained under our service and safety-record schedules. Rejected and temporary images may be deleted as part of the upload flow; approved images remain while the associated app content is active, subject to account deletion and legal exceptions. Copies processed by a supplier are also subject to that supplier's terms and retention settings.

You may request deletion of your account at any time through the App settings. Some data may be retained longer where legally required (such as tax records or to investigate fraud). If you have questions about data retention, please contact us at info@dynamytheon.com.

9. Data Security

Dynamytheon Limited, as the data controller, is responsible for the processing described in this notice and for putting appropriate safeguards in place to protect your personal data. We use technical and organisational measures, including encryption, access controls, and secure authentication mechanisms.

10. Your Privacy Rights

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Request data portability for your personal account
• Request a venue-scoped export through support if you manage a venue
• Withdraw consent at any time, where applicable

To exercise your rights, please contact us at info@dynamytheon.com.

11. Complaints

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe your rights have been infringed.

12. Childrens Data

You must be at least 18 years old to create or use an account. The App is not intended for children, and we do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, contact us so we can review and take appropriate steps.

13. Changes to This Notice

We may update this Privacy Notice from time to time. When changes materially affect how we handle your personal data, we will:

• Notify you via in-app notification or email
• Require you to review and accept the updated Privacy Notice before continuing to use the App

For changes required by law, we may implement them immediately. You will be required to accept the updated Privacy Notice before your next use of the App. Your continued use after accepting constitutes your agreement to the updated notice.