Privacy

Who we are

The data controller is Nirama Solutions AB (reg. no. 556792-3700).

VAT no. SE556792370001

Stenbocksvägen 20, 549 48 Skövde, Sweden

Contact: support@niramasolutions.com

On your device

Tournaments you create, the keys that let you update your live links, and your language choice are saved in your browser’s local storage. So is your player library: your saved player lists, and the players you renamed or merged. Player stats are calculated on your device from your tournaments; they are never sent to us. An unfinished new tournament is kept in session storage until you close the tab, and the app’s files are cached so it works offline. This is needed for the app to work, so it doesn’t require consent. Nothing is uploaded unless you create a live link or sign in (see “Accounts”). You can remove everything by deleting the tournaments in the app or clearing the site data in your browser.

Live links

When you create a live link, the tournament (its name, the player names you entered and the results) is stored on our server so that others can follow it. Anyone with the link can see it, so only share it with the people it’s meant for. Live links are not listed in search engines. You can delete a live tournament at any time with “Stop sharing” in its Share tab; otherwise it is deleted automatically 6 months after its last update.

Player names are entered by the organizer, not by the players themselves. Only use names players are happy to share: first names or nicknames are enough, especially for children. If you are a player and want your name changed or removed, ask the organizer, or email us the link and we’ll do it.

Accounts

An account is optional: everything works without one, and guests get no cookie and no account on our server. If you sign in, we store your email address, when your account was created and when it was last used, and a session for each browser you sign in on: a random token, when it was created and last used, and when it expires. We don’t store your IP address or browser details with sessions.

To sign in, we email you a code and a link. Until it is used, we keep a hash of the code (never the code itself). It stops working after 10 minutes, and is deleted when you sign in or within a day. To limit how many sign-in emails one address can get, we also keep a keyed hash of the address (not the address itself) with the time of each email, and delete it within two days. Sign-in emails are sent through Cloudflare’s email service, so Cloudflare processes your email address on our behalf. We use your email address only to sign you in.

The legal basis is the contract (GDPR Art. 6(1)(b)): we need your email address to provide the account you ask for. We keep the account until you delete it; accounts not used for 24 months are deleted automatically.

While you are signed in, the tournaments on the device you sign in on, and those you create or change while signed in, are saved to your account: their names, the player names you entered, the results and the settings. They are stored on our server, visible only to you, so that they appear on every device where you sign in. They are stored until you delete them or your account; when you delete a tournament, its contents are deleted from our server straight away, and only a note of its deletion (without names or results) is kept for 30 days so your other devices delete it too. Signing out keeps the tournaments on that device.

While you are signed in, your player library is saved to your account too: your saved player lists (their names, and the names of the players in them with M/W where you set it for Mixed play) and the players you renamed or merged. It is visible only to you, so that it appears on every device where you sign in, and stored until you delete it or your account; when you delete a list, its name and players are deleted from the account the next time your device syncs. Player stats are not stored on our server. Signing out keeps the library on that device.

Signing in sets one cookie, the session cookie (pa.session_token), which keeps you signed in for up to 60 days after you last used the site. It is strictly necessary for the sign-in you ask for, so it doesn’t require consent. Your browser also remembers your email address in local storage, to show that you are signed in.

On the account page you can sign out on this browser or everywhere, and delete your account with “Delete account”. That deletes your email address, sessions, the tournaments and player lists saved to your account and any pending code from our server straight away. Tournaments on your devices are kept.

Usage statistics and error reports

We count page views with Cloudflare Web Analytics, and events such as “tournament created” or “live link opened” as anonymous daily totals. This uses no cookies and stores no IP addresses or anything else that identifies you.

If the app runs into an error, it sends us a short technical report: the error message, the type of page (without any tournament link), the app version and your browser name. It contains no names, results or links, and is kept for 7 days.

Hosting and security

The site runs on Cloudflare. To deliver pages and protect the service from abuse, Cloudflare processes your IP address and basic browser information with each request, for example to limit how many live links one address can create per minute. We don’t keep request logs with IP addresses.

Email

If you email us, we use your address and message only to answer you, and delete the conversation when it is no longer needed, at the latest 12 months after it ends. Email to our address is forwarded by Cloudflare Email Routing.

Questions from clubs

If you send us a question with the form on the “For clubs” page, we store the club name, the city, your name and email address, your message if you write one, the page language and when you agreed. We use them only to answer you. Sign-ups from our earlier club pilot are kept and deleted the same way.

The legal basis is your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time by emailing us, and we then delete your details. Otherwise we delete them at the latest 24 months after you sent them. We don’t share or sell them.

We are told about each message by an email sent through Cloudflare’s email service, so Cloudflare processes these details on our behalf as well. We delete that email on the same terms.

Clubs

Signed-in organizers can create a club or be invited to one. A club’s name, address, city, country, description, website, public contact email, colours, logo and sponsors (their names, logos and links) are public: they are shown on the club page, which search engines may list, and with the club’s live tournaments. The live links of the club’s published tournaments are listed on the club page, so their names and results are public too. Only enter a contact email the club wants to be public.

We store who is a member of a club and whether they are an owner or an organizer. Owners see the email addresses of the club’s members; other visitors and organizers don’t. Club tournaments are stored on our server for the club and shown to all its organizers, like tournaments in an account, and deleted the same way.

When an owner invites someone, we store the invited email address, the role, who invited them and when, and a hash of the invite link’s code (never the code itself), and email the invite through Cloudflare’s email service. The email shows the club’s name and the inviting owner’s email address. The address is deleted when the invite is accepted or revoked, and the whole invite at the latest when it expires, after 7 days.

Clubs can show season tables, on the club page and on the club’s TV screen. A season table is computed from the club’s tournaments that count for the season and shows the players’ names with their places, points and number of evenings and, if the club uses one, a rating; these names and results are public too, also for tournaments whose live link was never shared. Organizers can merge two spellings of a player’s name and can hide a player from the public tables: ask the club (or us) and you are left out of them. Season tables are deleted with the season or the club.

Logos are stored in Cloudflare R2. When an owner deletes the club, we delete its page, logos, sponsors, members and invites straight away; its tournaments go back to the organizers who created them, as their own. The legal basis is the contract with the club’s organizers (GDPR Art. 6(1)(b)) and, for the public page, the club’s and our legitimate interest in presenting it (Art. 6(1)(f)).

Club events and sign-up

Clubs can publish events on their club page or share them by link, and players sign up without an account. When you sign up, we store your name, your email address, your gender if the event is mixed (to keep the balance between men and women), your partner’s name if you enter one for a pairs event, the page language, and when you signed up and agreed. If you are signed in, we also link the sign-up to your account, so you can see and cancel it there. The club’s organizers see these details, including your email address, and can add, reorder, mark as paid or remove sign-ups. Other players and visitors don’t see them: the event page only shows how many spots are left.

We use these details to manage the event: to confirm your spot or your place on the waiting list, to move you up when a spot opens, and to tell you if the date is cancelled. These emails are sent from events@padel-americano.com through Cloudflare’s email service. Each has a link that cancels your spot once; we don’t store its code, it is derived from your sign-up with a secret key. To prevent abuse, we limit how many sign-ups one IP address can make and how many emails one address gets, as for sign-in emails.

Unless the club turns them off, we also email you a reminder before the event (the day before or two hours before), with a link to cancel your spot and, if you are on the waiting list, your place. When the organizers start the evening’s tournament and publish it, confirmed players get its live link; if the time of a date changes after the reminder, everyone signed up is told. These emails are part of the sign-up. Each reminder and live-link email has an unsubscribe link (also in the email’s headers, for your mail app’s unsubscribe button): you can stop them for one sign-up, or for every event of that club. For the latter we store a keyed hash of your email address (not the address itself) with the club until the club is deleted. Emails that are part of signing up (your confirmation, moving up from the waiting list, a cancelled or moved date) still go out. To prevent abuse, one address gets at most a few reminder emails a day.

Sign-ups, cancelled ones too, are deleted 30 days after the event. Names the organizers put into the event’s tournament stay in its results, like in any tournament (see “Live links”). The club is responsible for how it uses your contact details beyond the event. You can cancel with the link in your email at any time before the event starts, and ask the club or us to delete your sign-up.

The legal basis is the agreement you make by signing up (GDPR Art. 6(1)(b)) and, for the limits against abuse, our legitimate interest in a secure service (Art. 6(1)(f)). Organizers can also add players themselves, for example walk-ins; then only what they enter is stored, and the same deletion applies.

Club subscriptions and payments

Clubs can subscribe to the paid Club plan. Payments are handled by Stripe (Stripe Payments Europe, Ltd., Ireland). When an owner chooses a plan, they enter the club’s billing details (name, billing address, VAT number if any, email address) and payment details on Stripe’s own pages. Stripe stores them, charges the subscription, calculates the VAT and emails invoices and receipts. We never see or store card details.

We create the club’s customer account at Stripe with the club’s name and the email address of the owner who chose the plan, so that Stripe can send the invoices there; owners can change the billing email and details in the billing portal. With the club we store the ids Stripe gives its customer account and subscription, the plan, the subscription’s status (such as trial, active or past due), whether it is paid monthly or yearly, when the current period ends and when the club’s free trial ends. We keep the ids of the payment notifications Stripe sends us for 30 days, to process each one only once.

The legal basis is the contract with the club (GDPR Art. 6(1)(b)) and, for invoices and payment records, our legal obligation to keep accounts (Art. 6(1)(c)): those are kept by Stripe for as long as bookkeeping law requires (in Sweden, 7 years). When a club is deleted, its subscription is cancelled and what we store about it is deleted with the club. Stripe is also an independent controller for its own purposes, such as preventing fraud: see stripe.com/privacy.

Online entry fees

Clubs can let players pay the entry fee online when they sign up. The payment goes to the club, which sells the event: it is made on Stripe’s payment page on the club’s own Stripe account (Stripe Connect), and Stripe (Stripe Payments Europe, Ltd., Ireland) processes the card or wallet details, charges the payment and emails the receipt. We never see or store card details.

For each online payment we store only what is needed to run and account for it: Stripe’s ids for the payment page, the payment and any refund, the amount, our fee and its VAT, when it was paid, refunded or disputed, and which sign-up it is for. When the sign-up is deleted (30 days after the event), the payment record keeps no name or email address; we keep it for 7 years, as bookkeeping law requires, for our monthly statements to the club.

To take payments, a club owner sets up the club’s account at Stripe from the club’s admin page and gives Stripe the club’s details on Stripe’s own pages. We store the account’s id, its country, whether Stripe has enabled payments and payouts, and the legal name, organisation number and VAT number the club enters for our statements. The legal basis is the contract (GDPR Art. 6(1)(b)) and our obligation to keep accounts (Art. 6(1)(c)). The club and Stripe each also process payment data as controllers for their own purposes (the club for its sales and accounts, Stripe for example to prevent fraud).

Legal basis

We process player names and results to provide the live link the organizer asks for, and technical data, statistics and error reports to run, secure and improve the service. In both cases the legal basis is our legitimate interest (GDPR Art. 6(1)(f)) in offering a working, secure tournament tool; we keep the data to a minimum so that it doesn’t outweigh your privacy. Accounts are processed to provide them to you (contract, see “Accounts”). We make no automated decisions about you and never sell your data.

Who receives data

Cloudflare, Inc. hosts the service and processes data on our behalf under a data processing agreement. Cloudflare may process data outside the EU/EEA, for example in the US; these transfers rely on the EU–US Data Privacy Framework and the EU’s standard contractual clauses.

Stripe processes club owners’ billing and payment details for club subscriptions (see “Club subscriptions and payments”); it may transfer data outside the EU/EEA under the EU’s standard contractual clauses and the EU–US Data Privacy Framework.

For online entry fees, Stripe processes players’ payment details on the club’s behalf and its own (see “Online entry fees”).

Your rights

You have the right to access, correct or delete your personal data, to restrict or object to its processing, and to data portability. Email us to use these rights; we answer within one month. For a live tournament, include its link so we can find it. You can also complain to a data protection authority: in Sweden the Swedish Authority for Privacy Protection (IMY, imy.se), or the authority where you live.

Ads

We show ads from Google AdSense to keep the service free. Google and its partners may use cookies and similar technologies to show and measure ads and, if you agree, to personalise them based on your visits to this and other websites. Ad cookies are only used with your consent (GDPR Art. 6(1)(a)): visitors in the EU/EEA, the UK and Switzerland are asked first, and you can change your choice at any time with “Privacy settings” at the bottom of the page. Google acts as an independent controller and may process data outside the EU/EEA, for example in the US, under the EU–US Data Privacy Framework. Google is responsible for its own processing: see how Google uses information from sites that use its services (policies.google.com/technologies/partner-sites) and manage ad personalisation at adssettings.google.com.