Privacy Policy

This Privacy Policy describes how Plymouth Pickleball LLC d/b/a Club Paddle Tap (“CPT,” “we,” “us,” or “our”) collects, uses, and shares information when you use the Club Paddle Tap platform. For privacy-related questions, contact us at privacy@clubpaddletap.com.

We collect the following categories of personal information:

• Account data: your name and email address when you register, and authentication credentials managed by Supabase Auth.
• Player profiles: first name, last name, email address, phone number, and division — entered by Club Administrators on behalf of players.
• Payment data: CPT stores only Stripe customer IDs, subscription status, and invoice metadata. All payment card data is handled exclusively by Stripe, Inc. CPT never stores raw card numbers, CVVs, or full payment account numbers.
• Usage data: page views, feature interactions, and error logs collected via Vercel and Supabase infrastructure logs.
• Cookies: HTTP-only session cookies used by Supabase Auth for secure session management (SSR). We do not use third-party advertising or behavioral tracking cookies.

We use the information we collect to:

• Operate the Platform and deliver the features described in our Terms of Service.
• Send transactional communications, including registration confirmations, invoices, and password resets.
• Provide customer support and respond to inquiries.
• Detect and prevent fraud, abuse, and security incidents.
• Improve the Platform through aggregated, anonymized usage analysis.

We do not use your data for advertising or sell it to third parties.

We share data with the following third-party service providers solely to operate the Platform. Each is a data processor acting on our instructions:

• Supabase, Inc. — database hosting and authentication. Data is processed under Supabase's Data Processing Agreement.
• Stripe, Inc. — payment processing. Stripe's Privacy Policy governs all payment-related data. See stripe.com/privacy.
• Vercel, Inc. — application hosting, edge network, and infrastructure logging.

We do not sell, rent, or share personal data with any other third party.

The Platform is not directed at children under the age of 13, and we do not knowingly collect personal information directly from children under 13. Player profiles for minor athletes are submitted by Club Administrators, who are responsible for obtaining appropriate parental or guardian consent before doing so. If you are a parent or guardian and believe your child's information was submitted to the Platform without your consent, please contact us at privacy@clubpaddletap.com to request access, correction, or deletion.

• Active account data is retained while your account is active and for 90 days following account deletion.
• Payment records and invoice history are retained for 7 years to satisfy tax and legal record-keeping obligations.
• Anonymized aggregate usage data may be retained indefinitely for product analytics.

You may request access to, correction of, or deletion of your personal data at any time by contacting us at privacy@clubpaddletap.com. We will respond to all requests within 30 days. Note that some data may be retained beyond a deletion request where required by law or legitimate business obligation (for example, payment records required for tax compliance).

• All data in transit is encrypted using TLS.
• Data at rest is encrypted at the infrastructure level by Supabase and Vercel.
• Access controls ensure each organization's data is isolated from all other users of the platform.

We may update this Privacy Policy from time to time. For material changes, we will notify you by email at least 14 days before the updated policy takes effect. Your continued use of the Platform after the effective date constitutes your acceptance of the updated policy.

For questions, requests, or concerns about this Privacy Policy, contact us at privacy@clubpaddletap.com.