Last updated: October 2026
This Privacy Policy explains how PaddleStacks ("we," "us," or "our") handles personal information when you use our Service, in line with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173). It applies to two groups of people: club owners and staff who use PaddleStacks, and players and customers whose details a club enters, or who enter their own details at a venue. Players and customers can also read our shorter Player Privacy Notice.
Club owners and staff: full name, username, email address, role and permissions, a securely hashed password and PIN (we never store them in readable form), and security records such as sign-in times and IP addresses. A tablet that stays signed in keeps a device record (device name, IP address and last-used time) and a small cookie.
Club details: club name, address, city, province, venue name, the Reclub club link or organizer handle given at signup, and any payment QR codes the club uploads.
Players: name; optionally a Reclub username, mobile number, email address, and country, province and city; a profile photo link taken from the player's public Reclub profile; check-in times; game results, wins and losses, session history and statistics; and notes that staff add. Players enter some of this themselves at the Kiosk, on the check-in page or on the registration page; staff or the club enter the rest, including names imported from a Reclub RSVP list the club chooses to import.
Payments recorded in the app: for open-play fees, rentals and sales, the amount, date, method (for example cash, GCash, Maya or bank), status and notes, and photos or screenshots of proof of payment. Proof photos are stored privately and are only shown to logged-in staff of that club.
Court rentals and online bookings: the customer's name, mobile number, email address, the times booked, notes, a booking reference, any proof-of-payment photo, and a one-time email code used to verify the email address.
Emails: we keep a record of the emails the Service sends, such as booking confirmations, including the recipient's address.
Our own subscriptions: when a club pays for a plan, we record the amount, date and plan. Payments go through PayMongo; we do not store card, GCash or Maya account details.
Technical information: IP address and basic device information in our security records, and the cookies described in section 9.
We do not sell personal information, and we do not use it for advertising.
We use service providers to run PaddleStacks. They handle information only to provide their service to us:
We may also disclose information when the law requires it, or to protect the rights, safety or property of PaddleStacks, our users or the public.
Our servers are in Singapore (DigitalOcean), so information is stored and processed outside the Philippines. We choose providers that protect information with their own security measures.
We keep a club's information for as long as the club's account exists, and afterwards for as long as we need it to provide the Service, keep accurate records (including payment and audit records), settle disputes and comply with the law. We do not currently delete older records automatically, so a club's history stays available to it. You can ask us to delete or anonymize your information (see section 8); we will do so unless we must keep a record by law or to protect against a claim.
Under the Data Privacy Act, you have the right to:
To use these rights, contact your club or contact us using the details in section 14. We may need to confirm who you are before we act on a request.
We protect information with encrypted connections (HTTPS), hashed passwords and PINs, access limited by club and by role, private storage for payment photos that are checked every time they are viewed, and an audit log of sensitive actions. No system is completely secure, and we cannot guarantee absolute security.
If a security incident is likely to put your rights at risk, we will tell the National Privacy Commission and the people affected as the law requires.
PaddleStacks is meant for venue staff and adult players. A club that lists a player under 18 is responsible for getting a parent's or guardian's consent. If you believe a child's information was submitted without proper consent, please contact us so we can deal with it.
We may update this policy from time to time. The "Last updated" date above shows the latest version. Continued use of the Service after a change means you accept the updated policy.
Questions about this policy or your information, and requests to use your rights, can be sent to paddlestacks@gmail.com or +63 916 458 4648.