Privacy Policy — ZONEPLAY

1. Who we are

ZONEPLAY is a pickleball court-booking, open-play, and matchmaking platform operated by ZONEPLAY Website Application Services, a sole proprietorship registered with the Department of Trade and Industry (DTI BN 8129273) and the Bureau of Internal Revenue in the Philippines ("ZONEPLAY", "we", "us", "our"). Our registered address is Brgy. Daro, Dumaguete City, Negros Oriental 6200, Philippines.

We are the Personal Information Controller responsible for your personal data under the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC). This policy explains what we collect, why, how we protect it, and the rights you have.

2. Information we collect

Account details — your name, username, email address, password (stored only as a salted hash), and profile photo.
Profile and gameplay data — your city/location, skill ratings (singles and doubles), match history and results, friends, and content you submit such as scored matches.
Booking and transaction data — courts and venues you book, dates and times, booking status, and payment references. Card and e-wallet credentials are collected and processed directly by our payment provider, Xendit; we do not receive or store your full payment credentials.
Device and usage data — IP address, device type, app and diagnostic logs, and device push-notification tokens used to deliver alerts.
Location data — your approximate location (city), and, only if you grant permission, your device location to show nearby courts. You can revoke location permission at any time in your device settings.
Communications — messages, requests, and feedback you send to our support team.

3. How we collect it

Directly from you — when you register, complete your profile, book courts, score matches, or contact support.
Automatically — through cookies, local/session storage, device tokens, and server logs as you use the Service.
From third parties — payment and payout status from Xendit, and, if you choose social or third-party sign-in, basic profile details from that provider.

4. Why we use your data and our legal basis

We process your personal data for the purposes below, each supported by a lawful basis under the Data Privacy Act:

To provide the Service — create your account, run matchmaking, calculate ratings, and manage bookings (performance of our contract with you).
To process payments, payment reversals for verified processing errors, and owner payouts (performance of contract and compliance with legal obligations, including tax and anti-fraud requirements).
To send booking confirmations, match invitations, reminders, and service notifications (your consent and our legitimate interest in operating the Service).
To keep the platform safe — prevent fraud, abuse, and unauthorized access, and enforce our terms (our legitimate interest).
To comply with legal, tax, and regulatory obligations (legal obligation).
To maintain, troubleshoot, and improve the Service (our legitimate interest).

Where we rely on your consent, you may withdraw it at any time, without affecting processing already carried out.

5. What other players can see

Some information is shown to other players so the Service can work — on leaderboards, match cards, and your public profile:

Visible to other players: your display name, username, profile photo, city, skill ratings, and match history.
Never shown to other players: your email address, phone number, password, exact address, and payment details.

6. How we share your data

We share personal data only as needed to run the Service, and never sell it. Recipients include:

Court owners and venues — the booking details required to honour your reservation.
Payment provider — Xendit, to process payments and payouts securely.
Infrastructure and service providers — Supabase (database, authentication, and hosting), Vercel (application hosting), Resend (transactional email delivery), Cloudflare (Turnstile bot protection, which processes your IP address and browser signals when you sign in or sign up), Upstash (rate limiting, which processes your IP address), and our push-notification delivery providers. These providers act as our Personal Information Processors and may process your data only on our documented instructions.
Legal and regulatory authorities — where required by law, regulation, court order, or to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of our users or the public.
Successors — in connection with a merger, acquisition, or transfer of the business, subject to this policy.

7. International data transfers

Some of our service providers may store or process data on servers located outside the Philippines. Where this happens, we take steps to ensure your data continues to receive a level of protection consistent with the Data Privacy Act, including through contractual safeguards with those providers.

8. How long we keep your data

We retain your personal data for as long as your account is active and as needed to provide the Service. Transaction and payment records are retained for the periods required by Philippine law (for example, tax record-keeping rules) and by our payment provider. Server and diagnostic logs are kept for short, rolling periods. When data is no longer required, we securely delete or anonymise it. Residual copies of deleted data may persist in encrypted backups for a limited period until those backups expire on their normal rotation schedule; backup copies are not restored to live systems except for disaster recovery.

9. How we protect your data

We apply organisational, physical, and technical security measures appropriate to the risk, including:

Encryption of data in transit using HTTPS/TLS, and encryption at rest for sensitive fields such as payout account details.
Passwords stored only as salted hashes — never in plain text.
Row-level access controls and authentication on our database.
PCI-compliant payment processing handled by Xendit, so card and e-wallet data does not touch our servers.

No method of transmission or storage is completely secure, but we work to protect your data and will notify you and the NPC of a personal data breach where required by law.

10. Your rights

Under the Data Privacy Act, you have the right to:

Be informed about how your personal data is processed.
Access the personal data we hold about you.
Object to or restrict certain processing, including direct marketing.
Have inaccurate or outdated data corrected (rectification).
Request erasure or blocking of your data, subject to legal retention requirements.
Obtain a copy of your data in a portable format (data portability).
Be indemnified for damages arising from unlawful processing.
Lodge a complaint with the National Privacy Commission.

To exercise any of these rights, email us at zoneplay.support@gmail.com. We may need to verify your identity before acting on a request, and will respond within the period required by law.

11. Cookies and local storage

We use cookies and similar technologies (including browser local and session storage) to keep you signed in, remember your preferences, secure the Service, and understand how it is used. We do not use third-party advertising trackers. You can control or clear cookies through your browser settings, though some features may not work without them.

12. Children's privacy

The Service is not directed to children under 18, and we do not knowingly collect personal data from minors without the consent of a parent or guardian. If you believe a minor has provided us personal data without such consent, contact us and we will take steps to delete it.

13. Third-party links and services

The Service may link to venues, payment pages, or other third-party services that operate under their own privacy policies. We are not responsible for the practices of those third parties, and we encourage you to review their policies.

14. Changes to this policy

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide notice within the app. Your continued use of the Service after an update means you accept the revised policy.

15. Contact us

For privacy questions, data requests, or to reach our Data Protection Officer, contact ZONEPLAY Website Application Services at zoneplay.support@gmail.com or +639524875141, Brgy. Daro, Dumaguete City, Negros Oriental 6200, Philippines.

You also have the right to lodge a complaint with the National Privacy Commission if you believe your data privacy rights have been violated.