PRIVACY POLICY: FenixPlay

1. Identity of the data controller

In compliance with Regulation (EU) 2016/679 (GDPR) and applicable data protection laws, we inform you that the personal data you provide will be processed by:

Controller: Aaron Sarmiento

Trade name: FenixPlay

Contact address: Santa María 153, 08340 Vilassar de Mar, Spain

Contact email: soporte@fenixplay.app

Activity: Development and management of a padel tournament organization app.

2. What data do we collect?

• Name and surname to complete the profile
• Email address
• Password protected by hashing in the authentication service
• Profile data you provide, such as phone, photo, location and playing level; messages and content you publish
• Account and device identifiers, app interactions and technical error and performance data
• Tournament registration data (history, date, payments)
• Purchase, product, transaction and registration data; external providers process payment details

3. Purpose of processing

• Manage registration and access to the app
• Enable tournament registration
• Send notifications related to tournaments or app activities
• Send commercial communications (only with your consent)
• Comply with legal obligations (invoicing, taxation)
• Prepare drafts and proposals with AI only after your specific authorization, which you can withdraw
• Analyze service usage and errors to improve its operation and protect it against abuse

4. Legal basis

• Contract execution (use of the app)
• User consent (when required)
• Legal obligation (in case of invoicing or legal requirements)

5. Data retention

Your account and profile are removed when you confirm. Provider erasure is processed separately. Tournaments and matches involving other participants may remain, without the link to your profile. Purchase records needed for legal obligations or claims follow applicable retention periods. Erasure requests: handled within 30 days. We will tell you if a legal exception requires more time. Older diagnostics and backups remain restricted until their retention cycle expires. We review exceptions when handling your request and prevent reuse in the service. We do not consider provider erasure complete when a request has only been accepted.

6. Data sharing

We use Supabase for authentication and the database in the EU; ImageKit for images; Amazon SES for emails; Sentry for errors; PostHog for interactions and diagnostics, with session recording configured to mask input fields; Stripe for web payments and registrations; and RevenueCat with Apple or Google for native digital purchases. Google and OpenRouter process AI requests only after authorization, as explained in the AI section. Processing may occur outside the European Economic Area. Nominatim, operated by OpenStreetMap Foundation, receives place searches and technical metadata such as the IP address, and retains usage logs to provide and improve the map service. Data is not sold or shared for third-party advertising.

7. Signing in with Google or Apple

When you sign in with Google, we receive the account identifier, email, name and profile photo you authorize to create and authenticate your FenixPlay account. We do not request access to Gmail, contacts or calendar. This data is managed through Supabase and may appear in your profile and tournaments you join. You can revoke access in your Google account and request deletion of your FenixPlay account. We do not sell this data or use it for third-party advertising or AI model training. If you sign in with Apple, we receive its user identifier and the name and email address you authorize, which may be an Apple private relay address. They are used through Supabase to create and authenticate your account. FenixPlay does not receive your Apple Account password. You can manage access from your Apple Account and request deletion in FenixPlay.

8. Purchases through Apple and Google

Native digital purchases are processed through Apple App Store or Google Play. We use RevenueCat to verify and restore purchases and synchronize access. We process your FenixPlay account identifier (UUID), products, receipts or transaction identifiers, dates, subscription status and technical device data for this purpose. For these purchases FenixPlay does not receive your full card number or security code.

9. AI assistant privacy

Purpose and data: the assistant prepares drafts, answers and proposals for tournament organization. We process your request and, where relevant, the necessary categories, courts, schedules, availability and registration data. Detected names and identifiers are replaced with labels. These labels and context may still be personal data. Your authorization does not permit sending other people’s data without a separate legal basis.

Providers: Google processes requests with Gemini through a project with active billing. If capacity is unavailable, OpenRouter may forward them to the Gemini model provider. Google states that it does not use inputs and responses from this paid service to improve its products and may temporarily retain them for security. OpenRouter is configured to reject routes allowing data collection and require zero retention endpoints. Processing may occur outside the European Economic Area; consult provider terms and request information about transfer safeguards from FenixPlay’s privacy contact.

Retention: FenixPlay does not store request text or responses in usage logs. Account-linked metrics are retained for up to 90 days: date, action, model, status, tokens and duration. Reports store a reference and reason, without the conversation, and are deleted 180 days after resolution. Permission and the adult declaration are linked to your account; authorization evidence is retained while valid and for up to 3 years after withdrawal. Billing records and information you save in a tournament have separate retention periods.

Permission and rights: authorization to transmit data to AI is specific and can be withdrawn from the assistant. Withdrawal blocks new transmissions; it does not reverse requests already processed. Security and report management protect the service and are documented separately. To access, correct, delete or object to processing, contact the privacy email in the general policy. You can complain to the AEPD or your data protection authority.

Use: FenixPlay is restricted to people aged 18 or older. AI-generated responses can contain errors. Review data and proposals before saving, publishing or applying changes. AI does not decide player admission or execute payments. Access and the current quota are shown in your account; withdrawing permission does not itself cancel a subscription. You can report a response from its result.

10. User rights

You can exercise your rights of access, rectification, erasure, restriction, portability and objection by writing to soporte@fenixplay.app. Identify your account and the right you wish to exercise. Do not send an ID copy initially; we will request proportionate additional information only if there are reasonable doubts about your identity. You can request account deletion in app settings or at https://fenixplay.app/en/delete-account.

You can also file a complaint with your local data protection authority.

11. Security

We apply technical and organizational measures to protect your data, including encryption in transit, access controls and password protection through the authentication service.

12. Data used for regional pricing

To display prices adapted to your country we use: (a) your IP address, from which we only extract the ISO country code via our CDN provider (Cloudflare), the full IP is not stored in our systems; (b) your device timezone, as a fallback when the IP is not conclusive; (c) your browser's preferred language, as a last-resort fallback; and (d) a technical cookie "fp_region" that stores your manual selection for 30 days. The legal basis for this processing is contract performance (Art. 6.1.b GDPR), as it is necessary to display the correct price. We retain a record of displayed quotes (Pricing Quotes) for 24 months for legal audit, dispute defence and compliance with the right of access (Art. 15 GDPR), as set out in Sec. 12.12 of the Terms & Conditions. These data are not shared with third parties for advertising purposes and, being strictly necessary for the provision of the service, no additional cookie consent is required.

13. Policy changes

This policy may be modified. We will inform you by email or through the app in case of substantial changes.