Privacy Notice

1. Who we are

Padel Ledger is operated by AuraFlow AI Studio LTD, a company registered in England and Wales ("we", "us", "our"). We are the data controller for the personal data we process about you in connection with the Service.

2. Personal data we collect

• Account data — name/display name, email address, hashed password or OAuth identifier, profile image.
• App content — groups you create or join, match results, comments, reactions, achievements, tournament and season data.
• Managed player data — display names (and optional avatars) you add for other players in your group.
• Support data — messages you send us and information you provide when contacting us.
• Usage and device data — pages viewed, features used, approximate location (city/country if you set it), device and browser type, IP address, timestamps, error logs.
• Cookies and similar technologies — see section 8.

Payment-card and billing data is collected and processed directly by our Merchant of Record, Paddle. We do not store your full payment details.

3. How we use your data and our legal basis

• Provide the Service (create your account, run groups, save matches, sync stats) — performance of a contract with you.
• Operate subscriptions (activate features, apply plan limits, manage cancellations) — performance of a contract.
• Keep the Service secure (fraud prevention, abuse detection, incident response) — our legitimate interests and legal obligation.
• Improve the Service (aggregate usage analytics, debugging) — our legitimate interests in improving our product.
• Communicate with you (transactional emails, service notices, support responses) — performance of a contract and legitimate interests.
• Marketing communications — only where you have opted in; you can withdraw consent at any time.
• Legal compliance — where we are required to retain or disclose data by law.

4. Who we share data with

We share personal data only with the categories of recipients listed below:

• Merchant of Record — Paddle.com Market Limited, for sale of subscriptions, subscription management, payments, tax compliance and invoicing.
• Service providers / sub-processors, including our hosting and database provider (Supabase), our application platform (Lovable / Cloudflare Workers), email delivery, error tracking and analytics providers.
• Other users — content you post publicly (public group standings, forum threads, comments, reactions) is visible to other users of the Service.
• Professional advisers — legal, accounting and insurance advisers where necessary.
• Authorities — where we are required by law, court order, or to protect our rights or the rights of others.

We do not sell your personal data.

5. International transfers

Some of our sub-processors are located outside the UK/EEA. Where personal data is transferred internationally, we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses or adequacy decisions to protect that data.

6. Data retention

We keep personal data for as long as your account is active and for a reasonable period afterwards to comply with legal obligations, resolve disputes, and enforce our agreements. Match and group content you contributed may remain visible to other members of that group after you delete your account, in an anonymised form where possible. When we no longer need personal data we delete or anonymise it.

7. Your rights

Subject to applicable law (including the UK GDPR and EU GDPR) you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your data;
• request restriction of processing, or object to processing based on our legitimate interests;
• request portability of data you provided to us;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner's Office at ico.org.uk).

We will respond to valid requests within one month. You can exercise most of these rights directly from your Profile page or by contacting us via the support channels in the app.

8. Cookies and similar technologies

We use a small number of cookies and local storage entries that are strictly necessary to run the Service — for example to keep you signed in and to remember your preferences. We may also use limited analytics to understand aggregate usage and improve the Service. We do not use advertising or third-party marketing cookies.

9. Security

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit (TLS), encryption at rest for our database, access controls and least-privilege service credentials. No system is 100% secure; please notify us immediately if you believe your account has been compromised.

10. Changes to this Notice

We may update this Notice from time to time. Material changes will be notified via the Service or by email. The "Last updated" date at the top shows when this Notice was most recently revised.

11. Contact

To exercise your rights or ask questions about this Notice, contact AuraFlow AI Studio LTD via the support channels available in the app.