Privacy Policy

1. Introduction

Welcome to StringerPal ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, store, and protect your information when you use our tennis stringing management application available at stringerpal.app (the "Service").

This policy complies with the General Data Protection Regulation (GDPR), Australian Privacy Principles (APPs), and other applicable data protection laws.

2. Data Controller

StringerPal
Email: support@stringerpal.app
Website: https://stringerpal.app

For GDPR purposes, StringerPal is the data controller responsible for your personal data.

3. Information We Collect

3.1 Information You Provide Directly

Account Information:

• Email address (required for account creation)
• Password (encrypted and never stored in plain text)
• Name (optional)
• Business name (optional)

Customer Data You Create:

• Customer names and contact information
• Racquet specifications (brand, model, string pattern)
• String job details (string type, tension, dates, payment information)
• Customer feedback and ratings
• Notes and preferences

Payment Information:

• We do not store credit card numbers or CVCs
• Your StringerPal subscription: Stripe (website), Apple (iOS), or Google Play (Android)
• Customer Pay Now links: Stripe Connect — card details stay with Stripe; we store the session and payment result
• Customer in-person cards: Square (Terminal, Tap to Pay, Reader, Stand, or Square POS when enabled) — card details stay with Square; we store the connection to your Square account and the payment result
• Billing address and payment history for your subscription; subscription tier and status

A card payment on the phone may ask for location, Bluetooth, or microphone access because Square's payment software requires it for that charge. StringerPal does not collect or store device location, and that location is not sent to StringerPal.

3.2 Information Collected Automatically

• Device type and operating system
• Browser type and version
• IP address (anonymized after 30 days)
• Pages visited and features used
• Error logs and performance data

4. How We Use Your Information

We process your personal data under the following legal bases:

• Contract Performance: To provide the Service you've subscribed to
• Legitimate Interest: To improve our Service, prevent fraud, and ensure security
• Consent: For marketing communications and non-essential cookies
• Legal Obligation: To comply with tax, accounting, and legal requirements

5. Data Sharing and Disclosure

We share data with trusted third-party service providers:

• Supabase: Database and authentication (Singapore data center)
• Stripe: Web subscriptions and customer Pay Now links (PCI-DSS). Card details stay with Stripe. Stripe Privacy Policy
• Square: In-person customer cards (PCI-DSS). Card details stay with Square. We store the Square connection and payment result, not card numbers or device location. Square Privacy Notice
• Apple: In-app Pro subscriptions on iOS. Apple Privacy Policy
• Google Play: In-app Pro subscriptions on Android. Google Payments Privacy Notice
• Vercel: Web hosting, content delivery, and AI Gateway request routing
• Resend/SendGrid: Transactional email delivery
• OpenAI (via Vercel AI Gateway): AI-powered recommendations; receives the account and customer data needed to answer your request and does not use it to train OpenAI models
• PostHog: Product analytics and AI usage telemetry (US data centers)

All service providers are contractually bound to protect your data and use it only for specified purposes.

6. Data Retention

Soft Delete Retention:

• Free Tier: 7 days
• Paid Tier: 30 days

Upon account deletion, all personal data is permanently removed within 30 days. Anonymized aggregate data may be retained for analytics. Financial records retained for 7 years for tax/legal compliance.

AI requests are processed by OpenAI through Vercel's AI Gateway, which permanently deletes prompts, responses, and request data after each request completes. OpenAI does not use this data to train its models.

7. Your Rights

• Right to Access: Request a copy of your personal data
• Data Portability: Receive your data in a structured, machine-readable format
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Object: Object to processing based on legitimate interests

To exercise any of these rights, contact us at support@stringerpal.app. We will respond within 30 days.

8. Data Security

We implement industry-standard security measures:

• Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Authentication: Secure password hashing (bcrypt) and optional 2FA
• Access Controls: Row-Level Security (RLS) ensures users only access their own data
• Regular Backups: Automated daily backups with 30-day retention

In the event of a data breach affecting your personal data, we will notify you within 72 hours.

9. International Data Transfers

Your data is primarily stored in Supabase (Singapore) and Vercel (global CDN). Stripe and Square process card payments in their own regions. In-app subscriptions are billed by Apple or Google Play. AI requests may be processed by OpenAI in the United States or other regions, and analytics telemetry is processed by PostHog in the United States. For transfers outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs).

10. Children's Privacy

StringerPal is not intended for users under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us immediately at support@stringerpal.app.