Privacy policy

The following gives a simple overview of what happens to your personal data when you visit this website or use your customer account. Personal data is any data that can identify you personally. The sections below explain it in detail.

Data on this website is processed by its operators. You can find their contact details under "Responsible party" and in the imprint of this website.

Some data you give us yourself, for example when you sign up, while you use your account or by email.

Other data is recorded automatically by our IT systems when you visit the website. This is mainly technical data (for example your browser, operating system or the time you opened a page).

We use the data to run the website without errors, to keep your customer account and to provide the services you bought. To improve the product, we also look at how the public pages are visited and which parts of the app are used (see "Web analytics with Umami" and "Usage log").

You have the right at any time to be told free of charge where your stored personal data came from, who received it and why it is stored. You also have the right to have this data corrected or deleted. Under certain circumstances you can also ask us to restrict the processing of your personal data. You also have the right to lodge a complaint with the competent supervisory authority.

You can contact us at any time about this and any other question about data protection.

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in line with the statutory data protection rules and this privacy policy.

When you use this website, various personal data is processed. This privacy policy explains which data we process and what we use it for. It also explains how and for what purpose this happens.

Please note that data sent over the internet (for example by email) can have security gaps. Complete protection of data against access by third parties is not possible.

The parties responsible for data processing on this website are:

• Karsten Will, Im Wiesengrund 2, 25474 Ellerbek, Germany
• Aljosha Köcher, Metzer Straße 10, 22049 Hamburg, Germany

Email: info@padelscout.io

The responsible party (controller) is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data (for example names or email addresses).

Unless this privacy policy states a more specific period, your personal data stays with us until the purpose for processing it no longer applies. If you make a justified request for deletion, we delete your data unless we have another legally permitted reason to keep it; in that case we delete it once that reason no longer applies.

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

If the GDPR is violated, data subjects have the right to lodge a complaint with a supervisory authority. The competent supervisory authority for Austria is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40-42, 1030 Vienna, Austria (phone: +43 1 52 152-0, email: dsb@dsb.gv.at, web: www.dsb.gv.at). This right exists without prejudice to any other administrative or judicial remedy.

You have the right to receive data that we process automatically to fulfill a contract, or to have it handed to a third party, in a common, machine-readable format. If you ask for the data to be transferred directly to another controller, we do so only where it is technically feasible.

Within the applicable law, you have the right at any time to be told free of charge which personal data we store about you, where it came from, who received it and why it is processed, and where applicable a right to have it corrected, deleted or its processing restricted. You can contact us at any time about this and any other question about personal data.

The provider of these pages automatically records and stores information in server log files, which your browser sends to us automatically. These are:

• browser type and version
• operating system
• referrer URL
• requested page (URL)
• time of the server request
• IP address

This data is not combined with other data sources. We delete the server log files after 14 days.

The data is recorded on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in presenting and improving the website without technical errors, and the server log files are needed for that.

Our server logs security-relevant events of a customer account, such as sign-ins, failed sign-in attempts and changes to two-factor sign-in, each with the internal account number. The legal basis is our legitimate interest in running the service securely (Art. 6(1)(f) GDPR).

Signing in uses two strictly necessary cookies that scripts in the browser cannot read (httpOnly): __pa_session keeps you signed in for 15 minutes, and __pa_refresh (valid for 7 days) renews the session without a new sign-in. Of the renewal token, our server stores only a hash. The cookie __pa_rr lasts 10 seconds and prevents a redirect loop while the session is renewed.

NEXT_LOCALE remembers your language (up to one year), and ps-theme remembers a dark or system color scheme (one year).

Some display settings, such as the color scheme, the market you picked or recently searched places, are kept in your browser's local storage. To show maps faster, the app also stores the map images of the profitability calculator with their map point in your browser's database (IndexedDB). None of these entries are sent to us, and you can delete them in your browser settings. The legal basis is Art. 6(1)(b) and (f) GDPR.

On the public pages, such as the home page, the features, the methodology, sign-in and sign-up, we count visits with Umami, an open-source web analytics tool we run ourselves (sitestats.padelscout.io). Umami sets no cookies and builds no personal profile. It records the page visited without its parameters, the referring page, browser, operating system, device type, screen size, language, the approximate location derived from the IP address (country, region, city) and a few events, such as the package overview coming into view or a completed sign-up. Umami does not store the IP address itself. We do not share this data. Umami does not run inside the app once you are signed in.

The legal basis is our legitimate interest in improving our service (Art. 6(1)(f) GDPR). We serve the fonts of this website from our own server.

If you email us, we store your details to handle your request and in case of follow-up questions. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract or to steps prior to one, and otherwise our legitimate interest in handling the requests we receive effectively (Art. 6(1)(f) GDPR).

With the “Request a demo” form you can ask for a demo of Padelscout Analytics. We store your name, your email address, the role you chose and, if you give them, your company or club and your message, together with the page language and the time we received the request. The request is kept in our database on our host’s server (see Hosting). We do not store your IP address with the request, and we do not link the request to a customer account.

We notify ourselves of a new request by email and through the Telegram messenger. Both notices say only that a demo request has arrived and which role was chosen; they contain neither your name, your email address, your company nor your message. We see the request itself only in our admin area. We reply by email to arrange a time for the demo. We do not send a confirmation email.

The legal basis is Art. 6(1)(b) GDPR, as the request serves steps prior to a contract taken at your request, and otherwise our legitimate interest in answering the requests we receive (Art. 6(1)(f) GDPR). We delete the request 12 months after we received it, or earlier if you ask us to; keeping it until then rests on our legitimate interest in answering follow-up questions (Art. 6(1)(f) GDPR).

When you sign up, we store your name, your email address and your password. We keep the password only as a bcrypt hash, never in plain text, and it never appears in any log. We also store when the account was created and last changed, when you confirmed your email address and last signed in and when you accepted which version of the terms of use. After you sign up, we send you a link to confirm your email address (valid for 24 hours); you can sign in only after that. This makes sure nobody creates an account with someone else's address. If an account's address is not confirmed within 7 days, we delete the account completely. We send no welcome email.

To prevent abuse, we limit the number of sign-up and sign-in attempts per IP address and the number of sign-ups per email address. For this, the IP address and a hash of the email address are held briefly in memory only.

The legal basis is Art. 6(1)(b) GDPR (the service contract and steps prior to it). Confirming the email address and limiting requests rest on our legitimate interest in running the service securely (Art. 6(1)(f) GDPR).

When you set a password (at sign-up, when resetting it or when accepting a team invitation), we check whether it appears in known data breaches. Our server sends only the first five characters of the password's SHA-1 hash to the Have I Been Pwned service (api.pwnedpasswords.com) and asks for a padded answer. Neither the password nor its full hash leaves our server, and the service cannot tell which password was checked. The legal basis is our legitimate interest in keeping accounts secure (Art. 6(1)(f) GDPR).

If you turn on two-factor sign-in, we store the secret it uses in encrypted form (AES-256-GCM). If you turn it off, we delete the secret.

We send you emails that you trigger or set up yourself: a link to confirm your email address (valid for 24 hours), a link to reset your password (valid for 1 hour), a sign-in link (valid for 15 minutes), the alerts you create in the app and a reply to an error report you sent us. Of these links we store only hashes. We delete confirmation links, sign-in links and reset links 7 days after they were created, and expired sessions 7 days after they expired.

If you invite someone to your team, we store their email address with the invitation (valid for 7 days) and email them the invitation. We delete it 30 days after it was accepted, revoked or expired. Brevo sends them for us (see Email delivery).

What you create in the app is stored with your account: your favorites, saved scenarios of the profitability calculator (with the point you picked on the map and your assumptions), alerts (area, radius and frequency) and your team membership. The legal basis is Art. 6(1)(b) GDPR.

While you are signed in, we log which parts of the app you open (such as the market overview, a club page or the profitability calculator) and a few actions (such as creating an alert, adding a club to your watchlist or starting a purchase), each with the time, your internal account number and, where the page shows a market, its country. The log holds no search terms, map points or other input.

We use it to improve the product and to help you with questions about your account. Only we analyze it, and we do not share it. The legal basis is our legitimate interest in improving the service and supporting our customers (Art. 6(1)(f) GDPR). We delete each entry after 13 months, and all of them at once when your account is deleted.

With “Report an error” you can tell us about wrong information in the app. We store your report (the kind you chose and your text) with your account, together with the address of the page you sent it from, the section you reported and the text it showed you, the size of your browser window, the name and major version of your browser, the name of your operating system, the page language and your plan at that time. We do not store your IP address or your browser’s full identification string.

We notify ourselves of a new report by email and, for reports from a paid plan, also through the Telegram messenger. Both notices name only the plan, the kind of report and the area of the app; they contain neither your name, your email address nor your text, and no number that could lead back to your account. We see the report itself only in our admin area. Once we have dealt with your report, we may send you a short reply by email.

The legal basis is Art. 6(1)(b) GDPR (the contract of use). We delete a closed report 12 months after closing it, and at once with your account; keeping it until then rests on our legitimate interest in spotting recurring errors (Art. 6(1)(f) GDPR).

The place search in the profitability calculator and in alerts sends your search term or the point you picked on the map from our server to the Photon (photon.komoot.io) and Nominatim (nominatim.openstreetmap.org) services, without your IP address or account details. The legal basis is Art. 6(1)(b) GDPR.

Your browser loads the maps in the app directly from the OpenFreeMap service (tiles.openfreemap.org). The service receives your IP address and the map area shown. The legal basis is our legitimate interest in a working map display (Art. 6(1)(f) GDPR).

If you buy a plan online, the payment provider Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland) handles the payment. For this we pass your name, your email address and your account's internal number to Stripe. You enter your payment details and billing address directly with Stripe, and your company name and VAT number if you wish; these details never reach us. You manage your subscription in Stripe's customer portal.

We store the IDs of your Stripe customer record and of your subscription; Stripe keeps the invoices and payment records for us. The legal basis is Art. 6(1)(b) GDPR. We keep invoices and other accounting records for 8 years, as German tax and commercial law requires (§ 147 AO, § 257 HGB); the legal basis for this is Art. 6(1)(c) GDPR.

Stripe may also process data in the USA (Stripe, LLC). This is covered by the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. Stripe's own privacy policy also applies to the processing at Stripe.

We keep your account data for as long as the account exists. You can ask us to delete your account at any time by emailing info@padelscout.io. Deletion removes your name, your email address, your password, the two-factor secret, the ID of your Stripe customer record, your sessions, favorites, scenarios, alerts, error reports, team invitations and team links. What remains is a record under the internal account number that no longer identifies you. We keep the details of plans you bought (plan, period, countries and the Stripe subscription ID) as a record of the purchase, and invoices for the statutory period (see Payment).

We back up our database in encrypted form to a Hetzner Storage Box in Falkenstein (Germany); we have a data processing agreement with Hetzner under Art. 28 GDPR. We keep full backups for at most 5 weeks, so deleted data may remain in a backup until then. Older full backups from before our sales launch hold no customer data. A separate long-term archive of the market data holds no account data: no accounts, teams, invitations, usage logs, alerts, error reports, favorites, scenarios, plan records or admin accounts.