RacquetLink Privacy Policy
DRAFT for team review — not legal advice. Written on 2026-10-02 to follow the Data Privacy Act of 2012 (RA 10173) and the National Privacy Commission's rules. Items in
[brackets]need filling in, including the Data Protection Officer. Have a lawyer review this policy before any live launch.
Version: 0.1 (draft) · Effective: [date]
[RacquetLink legal entity name] ("RacquetLink", "we") is the personal information controller for the data described here.
1. What we collect
| Who | Data | Why |
|---|---|---|
| Players with an account | Full name, mobile number, email, password (stored securely, never in readable form), optional profile photo | Account, bookings, receipts, messaging, notifications |
| Guest players | Name, mobile number, optional email | To complete the booking and let the venue identify you |
| Venue owners and staff | Name, email, mobile number; venue details, photos and PDFs; payout account details | Registration, verification, running the venue, payouts |
| Inspections | Notes made by RacquetLink staff during the in-person venue visit | Verifying venues. Internal only; never shown to anyone outside RacquetLink |
| All users | Bookings, payment records (amount, method, status), messages, device push token | Providing the service, accounting, notifications |
We do not collect government IDs. We do not store card numbers or e-wallet credentials: payments are processed by Xendit, our payment provider, under its own privacy policy.
2. Who sees your data
- The venue you book with sees your name, mobile number and booking details, and uses them only to manage your booking.
- Xendit processes payments, refunds and payouts.
- Our service providers host our data and deliver notifications: Supabase (database and storage, Singapore region), Cloudflare (website hosting), Expo (push notifications), [email provider] and [error reporting provider] (error reports about the website, with email addresses, mobile numbers and sign-in links removed before they leave your browser).
- Authorities, when the law requires it.
We do not sell personal data, and we do not share it for third-party advertising.
3. How long we keep it
- Account data: until you delete your account.
- Booking and payment records: [10] years, for accounting and tax purposes. After account deletion these are kept anonymised.
- Messages: [period], then deleted.
- Guest booking details: [period] after the booking date, then anonymised.
4. Your rights
Under RA 10173 you have the right to be informed, to access, to object, to correct, to erasure or blocking, to data portability, to file a complaint and to claim damages.
- Delete your account yourself in the app. Your personal details are removed or anonymised. Booking and payment records stay, without your identity, for accounting.
- For anything else, contact our Data Protection Officer.
- You may file a complaint with the National Privacy Commission (privacy.gov.ph).
5. Security
Access to data is restricted by role at the database level. For example, venues see only their own bookings, and inspection notes are visible only to RacquetLink staff. Data is encrypted in transit. Payment details never touch our servers.
6. Children
RacquetLink accounts are for users aged [18] and over. [A minor may be booked for by a parent or guardian.]
7. Changes
We will notify you of material changes to this policy.
Data Protection Officer: [name] · [email] · [address]