Privacy Policy

1. Data Controller

For the purposes of GDPR, the data controller is:

2. Personal Data We Collect

We collect only the personal data necessary to operate and improve the App.

Data you may provide directly includes:

• Name or display name
• Email address
• Account credentials (passwords are stored in encrypted form)
• Any information you choose to submit through the App

If you sign in using third-party authentication:

• Apple Sign-In: a unique user identifier and, if you choose to share it, your email address
• Google Sign-In: a unique user identifier, name, and email address

We never receive your Apple ID or Google account password.

If you save or enter a shipping address for a Marketplace or Pro Shop order:

• Recipient name and phone number
• Address lines, city, region, postcode, and country
• An address type or label you choose (for example, Home, Office, Billing, or a custom label)

Addresses you save to your address book in Profile are stored for reuse at future checkouts. You can add, edit, or delete saved addresses at any time.

We may also collect certain data automatically, such as:

• Device type and operating system
• App version
• IP address
• Usage and interaction data (for example, session duration or features used)

3. Legal Basis for Processing

We process personal data under one or more of the following legal bases:

• Performance of a contract (to provide the App and manage your account)
• Your consent, where explicitly requested
• Our legitimate interests, such as improving the App and maintaining security
• Compliance with legal obligations

4. How We Use Your Data

Your personal data is used to:

• Create and manage your user account
• Authenticate users securely
• Provide App functionality and services
• Communicate with you regarding service-related matters
• Improve performance, usability, and security
• Comply with legal and regulatory requirements

5. Data Sharing

We do not sell your personal data.

We may share limited data with:

• Authentication providers (Apple and Google) for login purposes only
• Hosting and infrastructure providers
• Analytics or monitoring providers, using aggregated or pseudonymised data where possible
• Google Cloud Vision API (Google LLC), to automatically screen images you upload (avatars, racket photos, venue images, and Marketplace Listing photos) for prohibited content before publication. Images are transmitted to Google's servers, which may be located outside the UK/EEA; this transfer is safeguarded under Google's Standard Contractual Clauses. We do not use this service to build an advertising profile of you.
• Google Gemini API (Google LLC), to automatically assess text you submit through the App for safety, fraud prevention, and policy enforcement. This may include Marketplace Listing text, messages, reviews and replies, support tickets and replies, special-order notes, booking notes, venue names, display names, and other free-text content. Text is transmitted to Google's servers, which may be located outside the UK/EEA; this transfer is safeguarded under Google's Standard Contractual Clauses. We do not use this service to build an advertising profile of you.
• Authorities, where required by law

All third parties are required to handle data in compliance with GDPR.

We may use or commercialise market and product insights derived from aggregated and de-identified data only, with safeguards intended to reduce the risk of re-identification.

We do not sell raw account-level records, direct identifiers (such as email addresses), payment card details, message content, or full booking histories to third parties.

We do not automatically share your private contact details with venues. If a venue needs to contact you directly, you can choose to share details through messaging or outside the App.

When you complete a Marketplace or Pro Shop purchase, your shipping address is shared with the seller solely to fulfil that order, and the tracking reference the seller provides is shared with you. This is limited to the two parties in that transaction and is not used for any other purpose.

Payments are processed by Stripe.

We do not store full credit card numbers, card verification values (CVV), or bank account details on our servers. Stripe processes payment instrument data and transaction authentication under its own systems and security controls.

We may retain limited payment metadata where needed for support, accounting, refunds, disputes, fraud prevention, and tax compliance, such as transaction IDs, payment status, refund status, timestamps, and masked card details like the last four digits and card brand.

You can manage analytics and data sharing preferences, download a copy of your data, and delete your account from the Privacy & Security screen in the App.

6. Privacy Controls and Data Portability

The App includes privacy controls for data sharing and analytics. These settings are designed to let you limit secondary use of your data while keeping core account and booking services available.

We do not currently use your data to provide personalised advertising to players in the App.

Where technically feasible, we apply minimum-group thresholds and de-identification controls before using data for analytics or insight reporting.

When you disable optional data sharing or analytics controls, we stop using your data for those optional purposes going forward, but we may continue processing data that is strictly necessary to deliver the service, secure accounts, and meet legal obligations.

Account deletion is already available in the App settings. Deletion removes your account from active use, while some records may still be retained for legal, security, or financial reasons as described below.

7. International Transfers

If personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

8. Data Retention

We retain personal data only for as long as necessary to provide the App and meet legal obligations. The retention period depends on the category of data:

Account & Profile Data

Your account information (name, email, display name, avatar) is retained while your account is active. When you request account deletion, we delete this data within 90 days, though backups may be retained for an additional 30 days for disaster recovery purposes.

Authentication & Security Logs

Records of login attempts, password changes, and security-related events are retained for 365 days (1 year) to help detect fraud and investigate security incidents. This extended retention is necessary to maintain App security and comply with anti-fraud requirements.

Legal Consent Records

Records of your consent to this Privacy Notice and our Terms of Service are retained for 730 days (2 years) in accordance with GDPR requirements. This ensures we can demonstrate compliance with data protection regulations.

Payment & Transaction Records

Payment records are retained for up to 7 years in accordance with UK and EU tax accounting requirements. These records may include transaction amounts, timestamps, and linked account information needed for financial audit and dispute resolution. We do not store full card details or other raw financial instrument data on our servers; those details are handled by Stripe.

Order & Service Records

Records of racket restringing orders are retained for 90 days in standard operation, or longer if disputes are pending. This retention allows sufficient time to handle service complaints, manage refunds, and resolve customer disputes.

The shipping address and tracking reference attached to a Marketplace or Pro Shop order are retained with that order's records for the same 90-day period, or longer if a dispute is pending, and are not affected by later edits to your saved address book. Addresses you save to your address book in Profile are retained until you edit or delete them, or until your account is deleted.

Audit & Activity Logs

General app activity records are retained for 90 days. Security-related activity logs are retained for 365 days. This enables us to investigate issues, improve service quality, and maintain platform security.

Image Moderation Records

Records of image moderation decisions (including the automated content-analysis result, the rejection reason if applicable, and file paths) are retained for 365 days (12 months) to support fraud prevention, content-policy enforcement, and safety investigations, after which they are deleted. Images that are rejected are deleted from storage immediately upon rejection; approved images are retained for as long as the associated profile, racket, venue, or listing remains active.

Text Moderation Records

Records of text moderation decisions may include the submitted text or a reference to it, the content type, moderation provider, model, decision, severity, reason, confidence score, and timestamps. These records are retained for up to 365 days (12 months) to support fraud prevention, content-policy enforcement, safety investigations, appeals, and service debugging, after which they are deleted or anonymised unless a longer period is required for a dispute, legal obligation, or security investigation.

You may request deletion of your account at any time through the App settings. Some data may be retained longer where legally required (such as tax records or to investigate fraud). If you have questions about data retention, please contact us at termsandprivacy@precisionr.app.

9. Data Security

We apply appropriate technical and organisational measures to protect your personal data, including encryption, access controls, and secure authentication mechanisms.

10. Your GDPR Rights

You have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Request data portability for your personal account
• Request a venue-scoped export through support if you manage a venue
• Withdraw consent at any time, where applicable

To exercise your rights, please contact us at termsandprivacy@precisionr.app.

11. Complaints

You also have the right to lodge a complaint with your local data protection supervisory authority if you believe your rights have been infringed.

12. Children's Data

The App is not intended for children under the age of 16, and we do not knowingly collect personal data from children.

13. Changes to This Notice

We may update this Privacy Notice from time to time. When changes materially affect how we handle your personal data, we will:

• Notify you via in-app notification or email
• Require you to review and accept the updated Privacy Notice before continuing to use the App

For changes required by law, we may implement them immediately. You will be required to accept the updated Privacy Notice before your next use of the App. Your continued use after accepting constitutes your agreement to the updated notice.