Privacy Policy

Last updated: 30 June 2026

The ThePadelBase Platform (“ThePadelBase”, “we”, “us”, or “our”) is committed to protecting your personal data in accordance with the Personal Data Protection Act 2010 (Malaysia) (“PDPA”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use our services — the padel coach directory and booking app at coach.thepadelbase.co and the coach dashboard at hub.thepadelbase.co (collectively, the “Platform”).

1. Personal Data We Collect

Depending on how you use the Platform, we may collect:

Name, email address, and phone number
Coach profile information (bio, photo, certifications, languages, coaching locations, pricing, availability)
Booking details between coaches and customers
Payment-related information processed by our payment provider (we do not store full card details — see Section 4)
Account and authentication data (managed by our authentication provider)
Technical data such as IP address, device, and browser information
Google account data, if you connect Google Calendar (see Section 2)

2. Google API Services — User Data

ThePadelBase offers an optional Google Calendar integration that allows coaches to sync their coaching schedules with Google Calendar. This feature uses Google API Services and is subject to the Google API Services User Data Policy, including the Limited Use requirements.

2.1 Google Data We Access

When you connect your Google account, we request access to the following scopes:

Google email address — to identify the connected Google account and display it in your settings
Calendar events (read) — to retrieve your free/busy times and prevent double-booking
Calendar events (write) — to create, update, or cancel coaching session events in your Google Calendar when bookings are confirmed, modified, or cancelled

2.2 How We Use Google Data

Google user data is used solely to:

Display your connected Google email address in your calendar integration settings
Query your calendar for busy times so that your coaching availability is accurate
Create, update, and delete calendar events that correspond to coaching session bookings

We do not use Google user data for advertising, analytics, market research, or any purpose unrelated to providing and improving the calendar sync feature you have enabled.

2.3 How We Store Google Data

Your Google OAuth refresh token and access token are encrypted at rest using AES-256-GCM encryption and stored in our database. These tokens are used only to maintain your calendar connection.
Your Google email address is stored in plaintext for display purposes in your settings.
Calendar event data (event titles, times, busy/free status) is queried in real time from Google and is not permanently stored in our database.

2.4 Google Data Sharing

We do not share, transfer, or disclose Google user data to any third party, except: with your explicit consent; where necessary for security purposes (e.g. investigating abuse); where required by applicable law, regulation, or legal process; or in connection with a merger, acquisition, or sale of assets, provided the successor agrees to protect Google user data in accordance with this policy. We do not transfer Google user data to advertising platforms, data brokers, information resellers, or any party engaged in surveillance or profiling.

2.5 Limited Use Compliance

ThePadelBase’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

We only use Google user data to provide and improve the calendar integration feature that is visible and prominent to you as a user.
We do not allow humans to read your Google user data unless you have given explicit affirmative consent, it is necessary for security purposes, it is required to comply with applicable law, or the data has been aggregated and anonymised for internal operations.
We do not transfer or sell Google user data to third parties, except as described in Section 2.4 above.

2.6 Revoking Google Access

You may disconnect your Google Calendar integration at any time through your coach dashboard settings. When you disconnect, your stored Google OAuth tokens are permanently deleted, your stored Google email address is removed, and we will no longer access your Google Calendar data. You may also revoke access directly from your Google Account permissions page.

3. Purpose of Processing

We process your personal data to: create and manage your account; operate the coach directory and facilitate bookings between coaches and customers; process subscription payments; send transactional communications (e.g. booking confirmations); provide optional integrations you enable; maintain the security and integrity of the Platform; and comply with legal obligations.

4. Disclosure of Personal Data

We do not sell your personal data. We share it only with service providers who process data on our behalf under appropriate safeguards, including:

Payment processing — Stripe (we do not store full payment card details)
Authentication — Clerk
Database & storage hosting — Supabase
Application hosting — Vercel
Transactional email — Resend
WhatsApp notifications (where enabled) — Twilio
Error monitoring — Sentry
Calendar integration (where enabled) — Google

We may also disclose data where required by law or to protect the rights, safety, and security of our users and the Platform.

5. Cookies

We use cookies and similar technologies for authentication, security, and to remember your preferences. You can control cookies through your browser settings, though disabling them may affect Platform functionality.

6. Your Rights

Under the PDPA, you have the right to access and correct your personal data, withdraw consent, and limit its processing. To exercise these rights, contact us at the address below. We may require verification of identity before processing such requests.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law. When no longer needed, data is securely deleted or anonymised.

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption of sensitive data at rest and in transit. However, no method of transmission or storage is completely secure.

9. International Transfers

Some of our service providers may process data outside Malaysia. Where such transfers occur, we take reasonable steps to ensure the receiving jurisdiction provides an adequate level of protection.

10. Children

The Platform is not intended for individuals under 18. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Updated versions will be posted with a revised “Last updated” date. Continued use of the Platform constitutes acceptance of the updated policy.

12. Contact Us

For questions or concerns regarding this Privacy Policy or your personal data, please contact:

ThePadelBase
Email: hello@thepadelbase.co
Website: thepadelbase.co