Touch Padel
Privacy Policy
Last updated: 23 September 2026 · Version 2026-09-23
This policy explains what information the Touch Padel app, this website and the venue’s systems collect about you, why, who can see it, how long we keep it, and the rights you have over it.
Who we are
Touch Padel is a padel and café venue in Iraq operated by [FILL: company legal name] (“we”, “us”), commercial registration number [FILL: commercial registration number], of [FILL: registered address]. We decide why and how your information is used, so we are responsible for it. The Touch Padel app, this website and the venue’s staff systems were built and are maintained for us by Kagu Software, which handles information only on our instructions.
What we collect
- Your account. Your first name and surname, your phone number, your password, your preferred language and, if you give one, your email address. Your phone number is required. Your password is stored only in hashed form, so nobody at the venue can read it.
- Verification codes. When you create an account, reset your password or change your phone number, we send a one-time code to that number — on WhatsApp, or by SMS if it cannot receive WhatsApp — through a messaging provider. We keep a record of each message sent (the number, the time and whether it was delivered) to stop abuse and control cost.
- Your bookings. The court, date, time, duration and price, the booking reference, its status (upcoming, played, cancelled or no-show), who made or cancelled it, and any note you or the front desk add to it.
- Café orders from your table. When you scan a table’s QR code, your browser gets an anonymous session with no name or phone number. We record the table, what you order, any note you add to an item, and when. If you are signed in to an account, your orders can be linked to it.
- Notification token. If you allow notifications, your device gives the app a push token. We store it to send you booking confirmations, reminders, cancellations and no-show notices.
- Sign in with Apple or Google (optional). If you choose one of these, we receive your name, your email address and an account ID from that provider. Apple may give us a private relay address instead of your real email. We never receive your Apple or Google password.
- Notes the venue keeps. Staff can add short notes and labels to your customer record — for example a birthday, a preference or a payment note — so they can serve you well. Only staff can see them.
- Your agreement. The version of our Terms of Service and this policy you accepted, and when.
- Security and audit records. Our systems record sign-ins, errors and every change staff make to bookings, orders and payments, with the time and the account or device that made it.
The app does not collect your location or contacts, and a guest account cannot upload photos: only venue staff accounts can attach work photos, in the app’s staff area. The app has no advertising, no tracking and no third-party analytics or crash reporting. There is no online payment, so we never collect card details.
This website: the café menu pages can use privacy-friendly analytics (PostHog, hosted in the EU) to count page views. It sets no cookies, keeps only an anonymous identifier in your browser’s storage, never identifies you and does not record your screen. The legal pages do not load it, and the app does not use it.
Why we use it, and on what basis
We use your information only for these purposes. Each has a legal basis:
- creating and running your account and confirming your phone number or email — to perform our agreement with you (the Terms of Service);
- taking, showing, changing and cancelling your bookings and café orders, and letting the front desk know who booked and contact you about it — to perform our agreement with you;
- sending booking confirmations, reminders and changes as notifications — with your consent, which you can withdraw at any time in your device settings;
- applying the venue’s rules, such as the cancellation window and limits after repeated no-shows, and preventing fraud and abuse — our legitimate interest in keeping courts available and fair;
- keeping the service secure, fixing problems and keeping audit records — our legitimate interest in a safe, reliable service;
- keeping accounting records and answering lawful requests from authorities — our legal obligations.
We do not use your information for advertising, we do not sell it, and we do not make automated decisions about you that have legal or similarly significant effects.
Where your information is stored
Our database is hosted in the European Union (Frankfurt, Germany). Some of the providers above — including Vercel, Expo, Telegram, Twilio and the AI provider — may process information in the United States or other countries. We choose providers that protect information under their own security and data-protection commitments, and we send them only what they need.
How long we keep it
We keep your account information for as long as you have an account.
When you delete your account, your login, name, phone number, email address and linked Apple or Google sign-in are removed immediately, and you are signed out on every device. Your notification token, staff notes about you and any notifications waiting to be sent are deleted too.
Bookings and café orders you have already made stay in the venue’s records with no name, phone number or notes attached, because the venue has to keep its own accounts. They can no longer be linked to you. The record that you accepted our terms stays with them, without your name.
Anonymous café table sessions end when they expire; the orders stay in the venue’s sales records without a name.
Café order messages in the staff Telegram group are deleted after 30 days, and records of staff actions in Telegram after 90 days. Audit and security records, and records of verification messages, are kept for as long as they are needed for security, dispute resolution and accounting.
If you used Sign in with Apple, deleting your account on an iPhone asks Apple to confirm and then revokes Touch Padel’s access to your Apple ID. You can also remove Touch Padel from the list of apps using your Apple ID in your Apple account settings.
Your rights
You can:
- ask what information we hold about you and get a copy of it;
- see and change your name and phone number in the app under Profile → Edit profile (a new number is confirmed with a code), or ask us to correct anything else;
- delete your account in the app (Profile → Delete account) or on our website, or ask us to delete it;
- object to a use based on our legitimate interests, or ask us to restrict it while a question is settled;
- turn notifications on or off at any time in your device settings;
- change the app language under Profile → Settings.
To use any of these rights, email [FILL: privacy contact email] or ask at the front desk. We may ask you to confirm the account is yours. We answer within 30 days. If you are not satisfied with our answer, you can complain to the competent authority in Iraq.
Security
Information is encrypted in transit, passwords are stored only in hashed form, and staff access is limited by role and recorded. No system is perfectly secure; if a breach puts your information at risk, we will tell you and act to limit the harm.
Children
You must be at least 13 to create an account, and if you are under 18 a parent or guardian must agree to it. We do not knowingly collect information from children under 13. If you think a child under 13 has created an account, contact us and we will delete it.
Changes to this policy
If we change this policy, we update this page and the date and version at the top. If the change affects you in a meaningful way, the app asks you to review and accept it the next time you open it.
Contact
Questions about this policy or your information? Contact [FILL: company legal name]:
Email: [FILL: privacy contact email]
Address: [FILL: registered address]
Front desk phone: +995 419 010 203