Privacy Policy

Data Controller

The controller of your personal data is Tembo Solutions Adam Szum, Tax ID 7123037984, registered at ul. Skowronia 3J lok. 1, 30-650 Kraków. For any privacy-related matters, please contact kontakt@tembosolutions.pl.

Who can access your data

Within the service your data may be visible to the following roles:

• Group member (player) — sees their own display name and the names of other members in the context of shared sessions, and, when settling a session's payments, the payment contact details (phone, bank account, Revtag — Revolut payment tag) of the person the payment is owed to.
• Group owner and administrator — manage the group and see the member data needed to organise play (including display name). They see phone number, bank account and Revtag only in the context of settled sessions — exactly like other group members, with no extra access granted by the administrator role. Tembo Solutions Adam Szum remains the sole data controller under GDPR — group owners and administrators are not separate data controllers, and no separate data processing agreement is entered into with them.
• Application administrator (the provider) — has the technical access needed to maintain and operate the service.

What data we process

The application processes the following data:

• Email address — required for login and communication
• Display name — visible to other group members
• Profile picture (avatar) — optional, uploaded by you or retrieved from your Google account when signing in with Google
• Phone number — optional, used solely for group payments
• Bank account number — optional, used solely for group payments
• Revtag (Revolut payment tag) — optional, used solely for group payments
• Date and time of last login
• Activity history — session registrations, payments, no-shows
• The text of comments posted in sessions — visible to other group members
• Reports and blocks: who reported which content or person, for what reason, a copy of the reported content and the moderator's decision; the list of people you have blocked. They serve community safety and our obligations under the Digital Services Act (DSA).
• Web Push subscription data — only if you grant permission in your browser
• Mobile app push notification token — only if you allow notifications in your phone's system settings
• Telegram account ID — only if you link your account to the app's bot
• The name of a person added as a guest (without creating an account) by another group member — used solely to identify them within that session
• Contact form or email data (name, email address, group name, message content) — only if you contact us
• Approximate device location — optional, only with your consent (system or browser permission), used to show the distance to groups and open sessions ("Games nearby") in your area and to sort them nearest first; is never stored in our database or logs.
• City and addresses of group venues — optionally provided by the group administrator, visible to other signed-in users browsing the list of groups to join, if the administrator has enabled this option.

Legal bases for processing

We process data on the following legal bases (GDPR):

• Performance of the service agreement — data necessary to use the application and settle payments within the group.
• Legitimate interest — service security, handling requests, and pursuing potential claims.
• Consent — optional data (e.g. push notifications, linking with Telegram), which you may withdraw at any time.
• Legal obligation — e.g. retention of accounting records.

Purpose of processing

Data is processed solely to provide the sports group management service — organising sessions, managing waitlists, payments and notifications. Data is not used for marketing purposes or sold to third parties.

Data recipients

Data may be entrusted to trusted parties supporting the operation of the service:

• The infrastructure/hosting provider on which the application runs: DigitalOcean (servers located in Germany).
• Transactional email delivery provider (account verification, password reset, notifications): Amazon SES (Amazon Web Services).
• Email forwarding provider for the contact address (kontakt@tembosolutions.pl): ImprovMX (ImprovMX Incorporation, USA) — the content of messages sent to this address passes through its servers.
• Invoicing and accounting software provider (applies to people we issue invoices to): SaldeoSMART.
• Geocoding provider (converting group city name or venue address to geographic coordinates for nearby group and open session search): Nominatim / OpenStreetMap Foundation — receives only the city name or venue address provided by the group administrator, never your location or other personal data.
• Weather forecast provider (forecasts for games on outdoor courts — tennis, padel, pickleball): MET Norway (Norwegian Meteorological Institute, Norway) — for venues with outdoor courts it receives only the approximate venue location (rounded to about 5 km), never your location or other personal data. Weather data comes from MET Norway and is provided under the CC BY 4.0 licence.
• Application error monitoring provider (detecting and diagnosing failures): Sentry (Functional Software, Inc.), data stored in the EU region.
• Push notification providers: Expo (650 Industries, Inc.) and Apple and Google (for the mobile app), as well as the browser vendor's push service (for Web Push) — they receive the notification content and a device identifier solely to deliver it.
• Telegram — if your group uses bot notifications, or if you link your own account to the bot to receive private notifications.
• Google — only if you sign in with a Google account.
• Apple — only if you sign in with an Apple account.
• Some providers (including DigitalOcean, Sentry, Expo, Google and Apple) are based in the United States. Data is transferred outside the European Economic Area on the basis of certification under the EU-U.S. Data Privacy Framework or standard contractual clauses.
• We do not sell your data or share it for marketing purposes.

Cookies

The web application uses only technical cookies and browser local storage (localStorage): either strictly necessary for its operation or remembering settings you choose yourself. No consent is required.

In the browser's local storage (localStorage) we keep only settings you choose:

On the sign-in and registration pages, the “Sign in with Google” button is loaded from Google's servers (accounts.google.com). Google may read its own cookies to recognise whether you are signed in to a Google account. We have no access to these cookies; their use is described in Google's privacy policy (policies.google.com/privacy).

The application does not use cookies or local storage for analytics, advertising or tracking.

Third parties

• Telegram — if your group uses notifications, your name may appear in messages sent by the bot. Telegram Privacy Policy: telegram.org/privacy
• Google — if you log in via Google OAuth, your email address, full name, and profile picture are retrieved from your Google account. Google Privacy Policy: policies.google.com/privacy
• Apple — if you sign in with Apple, your email address and, optionally, your name are retrieved from your Apple account. Apple Privacy Policy: apple.com/legal/privacy

Data storage and deletion

We store account data for as long as the account exists. After account deletion, identifying data (name, phone number, bank account, Revtag, email address, and the text of session comments) is hidden in the app immediately and permanently deleted after 12 months — the longer period accounts for the possibility of a billing dispute; the game and payment history of other, still-active group members is not affected. Data belonging to a group that did not pay for a subscription after its trial period ends switches to read-only mode once the grace period passes, and — as an additional safeguard — is encrypted after a further month; paying for the subscription automatically restores access to the data. Group data is kept for up to 12 months in total after a subscription expires or the agreement ends, after which it is deleted or anonymised, unless the law requires longer retention. You can delete your account yourself at any time in the app's profile settings, or request deletion at kontakt@tembosolutions.pl — we will carry it out without undue delay. We keep content reports for 12 months after they are decided, and blocks until they are lifted or the account is deleted.

Your rights

Under GDPR you have the right to access, rectify, erase, restrict and port your data, as well as the right to object and to lodge a complaint with the supervisory authority (the President of the Personal Data Protection Office). For these requests, please contact kontakt@tembosolutions.pl.