Privacy policy

SmashBook is software for padel and tennis clubs (management dashboard, bookings and a WhatsApp assistant) provided by [PLACEHOLDER: nombre y apellidos del titular], tax ID [PLACEHOLDER: NIF], registered address [PLACEHOLDER: domicilio completo] ("SmashBook", "we").

Contact for any privacy matter: info@smashbookapp.com.

• We are the controller of the data of people who use the dashboard on behalf of a club (administrators and staff), of visitors to this website and people who contact us, and of clubs' billing data.
• We are a processor (Art. 28 GDPR) of the data of each club's customers: players, members and students who book with or message the club's WhatsApp. In that case the club is the controller and decides how the data is used. We only process it on the club's instructions and as set out in the Terms (data processing agreement).

If you are a customer of a club, the club is your first point of contact. If you write to us, we will pass your request to the club and help it respond.

• Dashboard users: name, email, password (hashed) or Google sign-in, role in the club and activity logs.
• Club data: name, tax ID, address, courts, prices, opening hours and assistant settings.
• Club customers: name, phone number (WhatsApp ID), language, membership status, bookings, lessons, payment amounts and status, notification preferences, and the content of conversations with the club's WhatsApp (text, voice notes, images and form replies).
• Payments: handled by Stripe. We never see or store card numbers; we only receive the payment status, the amount and technical references.
• Technical data: IP address, browser, server logs and essential cookies (see the Cookie policy).
• Contact or demo forms: name, email, phone, club and message.

Each club connects its own number to SmashBook through Meta's Embedded Signup and the WhatsApp Business Platform (Cloud API). Through it we receive the messages customers send to the club's number, their profile name and phone number, and delivery statuses of the messages the club sends.

We use this data only to provide the service to the club: showing conversations in the dashboard inbox, replying on the club's behalf with the assistant, handling bookings, payments and cancellations, and sending confirmations and reminders.

• We do not sell WhatsApp data or use it for advertising.
• We do not share it with third parties other than the providers listed in this policy, which process it on our behalf.
• We do not use it to train artificial intelligence models.

Meta access tokens are stored encrypted and are used only to operate the club's number. The club can disconnect WhatsApp at any time from the dashboard or from its Meta Business settings. From then on we stop receiving messages and delete the token.

Meta also processes these messages under its own terms: WhatsApp Business Terms of Service and the Meta Privacy Policy.

To reply to customers, the assistant sends the necessary conversation context and the club's information (courts, prices, rules) to large language models. It does so through Vercel AI Gateway, using models from OpenAI, Anthropic or Google.

Voice notes sent by customers are automatically transcribed into text by those same providers (through Vercel AI Gateway) so the assistant can understand them. The audio is processed in memory and is not stored; only the transcript is kept, with the rest of the conversation.

These providers act as sub-processors. Under their business API terms, they do not use the data to train their models.

The assistant only checks availability and books, charges or cancels according to the rules set by the club. It makes no decisions with legal effects on individuals (Art. 22 GDPR). Club staff can take over any conversation, and the assistant hands over to a person on request.

• Providing the service contracted by the club (dashboard, bookings, WhatsApp, payments): performance of a contract (Art. 6(1)(b) GDPR).
• For club customers, the legal basis is determined by the club as controller (normally, managing their booking or relationship with the club).
• WhatsApp notices and reminders: decided by the club. The customer can opt out at any time by replying STOP.
• Support: performance of a contract and legitimate interest.
• Billing and accounting and tax obligations: legal obligation (Art. 6(1)(c)).
• Security, fraud prevention and service improvement using aggregated data: legitimate interest (Art. 6(1)(f)).
• Marketing communications to clubs and replies to contact forms: legitimate interest or consent. You can object at any time.

• Supabase (database, authentication and storage): servers in the European Union (Frankfurt, Germany).
• Vercel Inc. (website and dashboard hosting, network and AI Gateway): global infrastructure.
• Meta Platforms Ireland Ltd. (WhatsApp Business Platform): sending and receiving the club's WhatsApp messages.
• Stripe Payments Europe Ltd. (booking payments through the club's Stripe account and subscription billing). For payment data, Stripe also acts as an independent controller.
• OpenAI, Anthropic and Google (language models for the assistant, via Vercel AI Gateway).
• Resend (transactional email: sign-in, invitations and notices to the club).

We do not disclose data to third parties unless required by law. We will notify clubs of any change of sub-processors. For the data of clubs' customers, the processing terms are in the Data processing agreement.

Some providers (Vercel, OpenAI, Anthropic, Google, Resend) may process data in the United States or other countries outside the European Economic Area. These transfers rely on the EU-US Data Privacy Framework where the provider is certified and, in any case, on the European Commission's Standard Contractual Clauses. The main database is hosted in the EU.

• WhatsApp messages: each club sets the period, between 30 days and 5 years; 365 days by default. After that they are deleted automatically.
• Technical logs: WhatsApp send queues, 30 days; payment events received from Stripe, 90 days; log of notices sent, 180 days.
• Bookings, payments and invoices: while the club has an account and, afterwards, as long as accounting and tax law requires (up to 6 years), with access restricted.
• Dashboard accounts: while the club keeps the service.
• Proof of acceptance of the terms and the data processing agreement (user, email, IP, browser, versions and date): for as long as the relationship with the club lasts and 6 years after, to defend against possible claims.
• When a club leaves, it can export its data. We delete it within 90 days at most, except what we must keep by law. Backups are overwritten in their normal cycle (30 days at most).

Encryption in transit (HTTPS/TLS) and at rest, isolation of each club's data through row-level security policies, encrypted secrets and tokens, role-based access control, activity logs and backups. If a personal data breach occurs, we will notify the club and, where applicable, the authority, as required by the GDPR.

You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent.

• If you are a customer of a club: contact the club, or message its WhatsApp "my data" (copy of your data) or "delete my data" (erasure). You can also write to us at info@smashbookapp.com.
• Otherwise: write to us at info@smashbookapp.com from the email linked to your account.

We will reply within one month. If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) or your local supervisory authority.

Detailed instructions to delete your data (via WhatsApp, from the club dashboard, by disconnecting WhatsApp or by email) are on the Data deletion page.

SmashBook is not directed at children under 14. If a club manages data about minors (for example, academy students), it is responsible for obtaining their parents' or guardians' consent.

We may update this policy to reflect changes in the service or the law. We will publish the new version here, with its date, and notify clubs of relevant changes.