Privacy Policy
Last updated: October 17, 2026
1. Data Controller
The data controller for personal data collected via Padel Snipe is Hadriel Dié, sole trader (Entrepreneur individuel, France), SIREN 103 532 644, registered office at 59 rue de la République, 33130 Bègles, France, publisher of the Padel Snipe service.
Contact: contact@padelsnipe.com
2. Data Collected
Padel Snipe collects only the data strictly necessary for the service to function:
| Data | Purpose |
|---|---|
| Email address | Account creation, authentication, booking notifications |
| Password | Authentication (hashed via Supabase Auth, never stored in plain text) |
| Playtomic credentials | Authentication on third-party platform for automatic booking (encrypted with AES-256-GCM) |
| Slot preferences | Automatic booking configuration (days, times, clubs) |
| Booking history | Dashboard display, personal statistics |
| Billing data | Subscription management: processed by Stripe (we do not store card data) |
| Supersub profile (optional) | First name, level, clubs, city, availability and number of requests per week: offering you to join a game when a player is missing. Players only see your first name, your level and your club or city, and only if you turn the profile on. |
| Phone (optional, supersub) | If you choose it as your contact: sent only to the player whose game you accept, never before you accept. Otherwise, your email is sent under the same conditions. |
| Supersub sign-up without a password | From the Supersub page: email, first name, level, city or clubs, availability, chosen contact and your dated consent, kept pending until you click the link sent to that address. The account, without a password, and the profile are only created on that click. The IP address is only kept as an encrypted fingerprint, to limit abusive sending. |
| Supersub requests | When you look for players for a booking: your first name, the match, the chosen price (spot on the house or a share as a guide) and the supersubs asked. Your email, or the phone number given for the request, is only sent to the supersubs who accept, and their contact is only shown to you at that moment. |
| Phone (optional, Elite SMS alert) | If you turn on the SMS alert (Elite plan): your mobile number and your dated consent, to send you two texts only, "booked" after a booking and "payment to approve" if a 3D Secure payment is waiting. Never any advertising. The number is sent to Twilio for delivery, to no one else. We keep a log of the texts sent (type, country, estimated cost), without the number. |
3. Legal Basis for Processing
Processing relies on the following GDPR legal bases (art. 6):
- Consent (art. 6.1.a): collected at sign-up for account creation and notification delivery;
- Performance of contract (art. 6.1.b): processing credentials and preferences to perform requested bookings;
- Legitimate interest (art. 6.1.f): service security, fraud prevention, technical logs;
- Legal obligation (art. 6.1.c): retention of billing data (10 years).
Supersub relies on your consent: the profile only exists if you create it, and sending your first name, your level and the chosen contact to the player whose game you accept requires your agreement, dated and stored with the version of the text. You can withdraw it at any time in Settings, Supersub (switch off, then untick the box); nothing is sent until you accept a game. Signing up from the Supersub page follows the same rule: consent is ticked and dated in the form, and nothing is created without a click on the link sent to your address.
The Elite SMS alert also relies on your consent: the box is never ticked in advance, consent is dated and stored with the version of the text, and you can withdraw it in one click in Settings, Notifications (Turn off button): the number is then erased.
4. Credential Security
Third-party platform login credentials (Playtomic email + password) are encrypted using AES-256-GCM before any database storage. The encryption key is stored separately in secure server environment variables. No person, including the Padel Snipe team, can read these credentials in plain text.
5. Data Retention
| Data | Retention |
|---|---|
| Account and profile data | For the lifetime of the account. Deleted 30 days after account deletion. |
| Encrypted Playtomic credentials | Deleted immediately upon disconnecting the third-party platform or account deletion. |
| Booking history | 3 years from booking date (anonymizable for statistics). |
| Billing data | 10 years (legal accounting obligation). |
| Technical logs (IP, requests) | 12 months (security, incident investigation). |
| Supersub profile and phone | As long as the profile exists. The phone is erased as soon as you choose email as your contact. Deleted with the account. |
| Supersub requests and answers | 13 months after the match date, then deleted. Deleted with the account. |
| Pending supersub sign-up | Link valid for 24 hours, once. Answers erased on confirmation; the request (email, IP fingerprint) is deleted 7 days after it was sent, confirmed or not. |
| SMS alert phone number | As long as the alert is on, even if the Elite plan ends (no text is sent then). Erased as soon as you turn it off, and with the account. |
| Log of texts sent | Type, country, estimated cost and Twilio identifier, without the number: linked to the account while it exists, then detached from any identity when it is deleted (cost accounting). |
| First snipe on us: fingerprints | When you link a platform account (Playtomic, Playbypoint, Anybuddy), we compute two encrypted, non-reversible fingerprints (keyed HMAC): one of that account's email and one of its identifier. They are only used to offer the first snipe once per person, and no email is stored in clear. Kept for 24 months after your Padel Snipe account is deleted, then deleted. |
6. Sub-processors and Hosting
Padel Snipe does not sell or rent your data. It is shared only with the following sub-processors, bound by GDPR-compliant Data Processing Agreements (DPAs):
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication | AWS eu-west (Ireland) + Singapore (replicas) |
| Stripe | Payment, subscription management | USA / EU |
| Resend | Transactional email delivery | USA |
| Twilio | Elite SMS alert texts (opt-in) | USA |
| Upstash | Job queue (Redis) | eu-west-1 (Ireland) |
| Vercel | Application hosting (Next.js) | USA (HQ), EU edge (Paris, Frankfurt) |
7. Transfers Outside the European Union
Some sub-processors (Stripe, Resend, Twilio, Vercel) are established in the United States or operate infrastructure outside the EU. These transfers are governed by the European Commission's Standard Contractual Clauses (SCCs) and, where available, by the sub-processor's adherence to the EU-US Data Privacy Framework. No data is transferred to a country without appropriate safeguards under GDPR.
8. Your Rights (GDPR)
Under GDPR, you have the following rights:
- Right of access: obtain a copy of your data;
- Right of rectification: correct inaccurate data;
- Right to erasure: delete your account and all your data;
- Right to portability: receive your data in a structured format;
- Right to object: object to certain processing;
- Right to restriction: restrict processing in certain cases.
To exercise these rights, contact contact@padelsnipe.com. We respond within 30 days. You may also lodge a complaint with your national data protection authority.
9. California Residents (CCPA / CPRA)
If you reside in California, the California Consumer Privacy Act grants you specific rights in addition to those under GDPR:
- Right to know: know the categories of data collected, their purpose, and the categories of third parties with whom they are shared;
- Right to delete: request deletion of your personal data;
- Right to non-discrimination: the service will not be degraded or denied for exercising your rights.
Padel Snipe does not sell or share your personal data with third parties for commercial purposes, within the meaning of the CCPA. To exercise CCPA rights, contact contact@padelsnipe.com.
10. Cookies
By default, Padel Snipe only sets cookies essential for the service to work (session, language, and remembering your cookie choice).
If you arrive through a referral link, or through a link a player sent you (email to the partners of a match, WhatsApp message), a Padel Snipe first-party cookie keeps that link for 30 days to attach it to your sign-up: ps_ref for the referral code, ps_acq for the shared link. Only our server can read them (httpOnly) and they serve no other purpose. For the same reason, your browser also keeps the referral code (ps_ref_code) and the link marker (ps_acq) in its local storage, in case you confirm your sign-up later or from another tab. This data stays on your device; you can erase it by clearing the site data in your browser.
Audience measurement (Google Analytics 4, and Microsoft Clarity when enabled) and the Meta advertising pixel only load if you accept them in the cookie banner. If you decline, none of these scripts is loaded. You can withdraw your consent at any time by deleting the cookie_consent cookie in your browser settings (the banner then shows again) or by writing to contact@padelsnipe.com.
The emails we send through Resend contain an invisible image and tracking links that tell us, with the date, whether the email was delivered, opened or a link was clicked. Linked to your account, this information is used only to measure how useful our emails are and to spot delivery problems, and is kept for 13 months; to block open measurement, turn off automatic image loading in your email app, or write to us to object.
| Cookie | Purpose | Duration |
|---|---|---|
| sb-*-auth-token | User session (Supabase Auth) | 1 year (renewed) |
| NEXT_LOCALE | Language preference (fr / en / es / it) | 1 year |
| cookie_consent | Stores cookie consent preference | 1 year |
| ps_ref | Referral code from the link you followed (?ref=), applied when you sign up | 30 days |
| ps_acq | Arrival through a link shared by a player (email to match partners or WhatsApp message), linked to your sign-up. The cookie only holds a signed marker of that link, no personal data | 30 days |
| _ga, _ga_* | Google Analytics 4 audience measurement (only after consent) | 2 years |
| _fbp | Meta advertising pixel (only after consent) | 3 months |
11. Changes
Padel Snipe may update this policy at any time. The date of last update is shown at the top of this page. Substantive changes will be notified by email or on next login.