Paddio Paddio
Enter Paddio

Privacy Policy

Last updated: 14 June 2026

This Privacy Policy explains how PADDIO SPORT TECHNOLOGIES ("Paddio", "we", "us") collects, uses, shares, and protects personal data when you use the Paddio platform (app.paddio.club and the Paddio mobile apps). For Mexican residents, this policy is complemented by our Spanish-language Aviso de Privacidad, which prevails for purposes of the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP). For details specific to the mobile apps, see the Mobile App Privacy Policy.

1. Who is responsible for your data

Paddio is the controller (responsable) of personal data processed to run the platform itself (your account, authentication, platform analytics, security).

For data you provide when registering for a Club's event, booking, class, membership, or purchase, the Club is the controller and Paddio acts as a processor on the Club's instructions under a Data Processing Agreement. Contact the relevant Club for requests about that data; we will assist.

Controller contact: contacto@paddio.club — PADDIO SPORT TECHNOLOGIES, Río San Lorenzo #214, Col. Compuertas, C.P. 21218, Mexicali, Baja California, Mexico.

2. Data we collect

You provide:

  • Identity & contact: name, email, phone number.
  • Profile: preferred sport, skill level, avatar photo, team/partner details.
  • Registration & booking details: events you join, shirt size, screening-question answers, notes, match results.
  • Information about other people you enter: when you register a doubles partner, you provide their name and, optionally, their email and phone; when you register someone on their behalf (a "managed player", such as a child), you provide their name and, optionally, a phone number. You must be allowed to provide this information; see Section 9.
  • Payment details: processed by Stripe; we receive transaction status and limited card metadata (e.g., last four digits, brand), never full card numbers.
  • Communications: messages you send us or through the platform.

Collected automatically:

  • Device & usage: app version, device type/OS, IP address, pages/screens viewed, diagnostic logs.
  • Approximate location (mobile): coarse location, only if you grant the permission, used to show events near you. The app works without it.
  • Push notification tokens (mobile), if you enable notifications.
  • Cookies and similar technologies on the website — see our Cookie Policy.

We do not knowingly collect sensitive data (e.g., health, biometric, racial/ethnic, sexual-orientation data) and ask that you not submit it.

3. Why we use your data (purposes)

  • create and authenticate your account (OTP login);
  • process registrations, bookings, classes, memberships, and store orders;
  • process payments and refunds through Stripe;
  • send transactional messages (confirmations, schedules, results, receipts) and, where permitted, service updates;
  • provide customer support;
  • maintain security, prevent fraud and abuse, and debug;
  • comply with legal, tax, and accounting obligations;
  • with your consent where required, send marketing and use non-essential cookies.

Legal bases (where applicable, e.g., for EU/UK users): performance of a contract, your consent, our legitimate interests (security, improving the Service), and legal obligations.

4. How we share data

  • With the Club whose event, class, or service you use — they receive your registration, contact, and payment-status data (including any doubles-partner or managed-player details you provided) to deliver the service.
  • With service providers (sub-processors) who process data on our behalf:
    • Supabase — database, authentication, and file storage (hosting infrastructure);
    • Stripe — payment processing and payouts;
    • Resend — transactional email delivery;
    • Push-notification providers (Apple Push Notification service / Firebase Cloud Messaging) — mobile notifications.
  • For legal reasons — to comply with law, enforce our Terms, or protect rights, safety, and security.
  • In a business transfer — if Paddio is involved in a merger, acquisition, or asset sale, subject to this policy.

We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

5. International transfers

Our infrastructure providers may process data in the United States and other countries. Where data is transferred internationally, we rely on appropriate safeguards and the protections described in this policy and our Aviso de Privacidad.

6. Data retention

We keep personal data for as long as your account is active and as needed for the purposes above. After account deletion we delete or anonymize your personal data, except transaction and financial records, which we retain in anonymized form for the period required by tax, accounting, and dispute-resolution rules. See Account & Data Deletion.

7. Security

We use commercially reasonable safeguards: encryption in transit and at rest, least-privilege access, and row-level security on our database. No system is perfectly secure; we cannot guarantee absolute security.

8. Your rights

Depending on where you live, you may have rights to:

  • access the data we hold about you;
  • correct inaccurate data;
  • delete your data;
  • object to or restrict certain processing;
  • port your data;
  • withdraw consent at any time (without affecting prior processing);
  • opt out of marketing.

To exercise any right, email contacto@paddio.club or use the Account & Data Deletion page. We will respond within the timeframes required by applicable law. You will not be discriminated against for exercising your rights.

Mexico (LFPDPPP) — ARCO rights

If you are in Mexico, you have ARCO rights (Access, Rectification, Cancellation, Opposition) and may limit the use or disclosure of your data, as described in our Aviso de Privacidad.

United States — your state privacy rights

If you are a resident of California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Indiana, Kentucky, Rhode Island, or another state with a comprehensive privacy law, you have the rights listed above, including the right to access, delete, and correct your personal information, and to opt out of the sale or sharing of personal information and of targeted advertising. Paddio does not sell or share your personal information for these purposes. California residents may also request information about disclosures and exercise rights through an authorized agent. To make a request, email contacto@paddio.club. We will verify your identity before responding and will not discriminate against you for exercising these rights. You may appeal a denied request by replying to our response.

9. Minors and managed players

You must be 18 or older to create a Paddio account, and minors may not create their own accounts or provide data directly to us. We do not knowingly collect personal data directly from children.

An adult may register a minor for an event as a managed player. In that case the adult provides only the minimal data needed to enter the minor (a name and, optionally, a phone number — no account or email), is responsible for that information, and confirms they are the minor's parent or legal guardian or otherwise authorized to provide it and to consent on the minor's behalf. We use a managed player's data solely to enter and manage that person's participation and share it with the organizing Club.

If you are a parent or guardian and want to access, correct, or delete a managed player's data — or if you believe a child created an account or provided data directly — contact contacto@paddio.club and we will act promptly.

10. Changes to this policy

We may update this policy and will revise the "Last updated" date. Material changes will be notified in-app or by email.

11. Contact

contacto@paddio.club — PADDIO SPORT TECHNOLOGIES, Río San Lorenzo #214, Col. Compuertas, C.P. 21218, Mexicali, Baja California, Mexico.