Privacy Policy

Plain-English summary: This is what we collect, why we collect it, who can see it, and how to get it back or have it deleted. We don't sell your data. We don't track you across the web. We don't show ads. If something here is unclear, write to hello@laceup.club.

Laceup is software that helps small tennis clubs run themselves — events, ladders, members, courts, updates. We're a small team based in Ireland, building for clubs in Ireland and the UK first. This policy explains how we handle the data you and your members put into the product.

We've written it in plain language. Where a legal term is unavoidable, we've tried to define it inline.

Who we are

Laceup is operated by Laceup Ltd, a company registered in Ireland. For the purposes of the General Data Protection Regulation (GDPR), Laceup Ltd is the data controller — the entity that decides why and how your personal data is processed.

You can reach us at hello@laceup.club. A postal address will be added when our registered office is finalised.

What we collect

Your account

When you sign up, we ask for the things we need to identify you and let you back in:

• Your email address
• Your full name
• A password (which we never see in plain text — Supabase Auth stores a hash)

Your profile

You can add an avatar image and a phone number to your profile. Both are optional — but a phone number is required if you want to join a ladder, because opponents need to arrange matches directly. Your phone number is visible only to your current opponent and your club admins.

Your club roles

We record which clubs you belong to and whether you're an admin or a member of each. That's how the product knows what to show you.

What happens inside your club

When you use Laceup, you and your club's admins create content — events, updates, court information, ladder participation, match results, attendee lists. We store all of that so the product can do its job.

What's visible on your club's public page

Every club has a public page at laceup.club/c/{your-club-slug}. The information on that page is intentionally public — anyone with the link can see it. That includes your club's name, location, description, tagline, founded year, and chosen primary colour. We also show aggregate ladder activity (counts only — never names of individual players) so visitors can see your club is alive.

If you don't want a piece of information on your public page, your admin can remove it from club settings.

Irish tennis data explorer

Laceup hosts a public data explorer at laceup.club/ireland-tennis/data-explorer that displays league fixtures from Dublin Lawn Tennis Council (DLTC) and tournament match results from Tennis Ireland. This data is sourced from publicly available results already published by those organisations — we don't collect it from Laceup users.

The data includes player names, scores, dates, and competition details as originally published. Laceup does not enrich this data with additional personal information. If you're a player whose results appear in the explorer and you'd like them removed, email hello@laceup.club and we'll take them down.

Coaches we contact from public directories

Plain-English summary: If we emailed you because you're a tennis coach listed in a public directory, here's where we got your details, why, and how to make it stop.

Separately from the product, we run a small outreach programme to tennis coaches in Ireland. If you got an email from us about a free coaching page on laceup, we found your name and contact email in the Tennis Coach Ireland "Find a Coach" directory (tenniscoachireland.ie) — a public register the association publishes so that people can contact coaches about coaching. We did not get your details from you directly, so this section is the disclosure required by GDPR Article 14.

What we hold: your name and the contact email published in that directory, a link to your directory listing, and the date we recorded it. Where the directory listed them, we may also hold the county and the club you coach at. We do not hold your phone number for this.

Why, and the legal basis: to tell you that a free booking page already exists for your coaching, and to offer it to you. Our lawful basis is legitimate interest (GDPR Article 6(1)(f)) — you offer coaching as a service, the directory publishes your email precisely so you can be contacted about it, and our message is about your trade.

Your choice: every email we send has a one-line opt-out. Reply "stop" (or email hello@laceup.club) and we'll stop contacting you and add you to a do-not-contact list, on every channel, for good. You also have the right to object (Article 21) and to have this data erased (Article 17) — email us and we'll remove you from both our outreach records and the page we built for you. If you never respond, we delete your details within 6 months.

You can complain to the Irish Data Protection Commission (dataprotection.ie) if you think we've mishandled your data.

Why we collect it

Plain-English summary: To run the product. Not to sell ads. Not to build a profile of you for someone else.

The legal bases under GDPR Article 6 are:

• Contract performance — we need this data to provide you the service you signed up for.
• Legitimate interests — running, securing, and improving the product, and communicating with you about your account.
• Consent — for any future use we don't currently make of your data, including marketing emails or analytics that go beyond aggregate product health.

We do not use your data for advertising, profiling for third parties, or anything outside the operation of Laceup itself.

Who can see what

Plain-English summary: Other members of your club see most of what you do inside the club. The public sees only what you've put on the public club page.

Inside a club, members can see:

• Other members' names and avatars
• Events, registrations, and attendee lists
• Club updates posted by admins
• Ladder standings, match results, and participation status

Outside a club, the public can see:

• Your club's public page (laceup.club/c/{slug}) and whatever information your admin has chosen to publish there
• Aggregate counts (e.g. "12 active ladder players") — never individual names

We never share data between clubs. A member of Club A cannot see anything about Club B, and queries are scoped at the database level so this can't happen by accident.

Where your data lives

Plain-English summary: In the EU, on Supabase. The website itself is served from Vercel's global edge network.

• Database, authentication, file storage: Supabase, in an EU region. Your account, your club's content, and any uploaded files (like avatars) live there.
• Web hosting: Vercel. Vercel serves the static parts of the site from edge servers around the world; this is how the site loads quickly. No personal data is stored on those edge servers — they fetch it from Supabase on demand.
• Transactional email: Resend (smtp.resend.com). When we send you an email — to confirm your address, reset your password, or notify you about something in your club — Resend delivers it. They process your email address for as long as it takes to send the message.
• Payments (planned): Stripe will handle payments when paid plans launch. We will never see or store your card details — Stripe holds that information directly. We'll update this policy before any paid feature ships.

What we don't do

We want to be clear about the things we've actively chosen not to do:

• We don't sell your data to advertisers, data brokers, or anyone else.
• We don't show ads inside the product.
• We don't track you across other websites with third-party cookies.
• We don't have AI training built into the product. We don't use your club's content to train models.
• We don't share your data with other clubs on the platform.

We may add product analytics in the future to help us understand which features are used. If we do, we'll update this notice and tell account holders before it goes live. Any analytics will be aggregate and won't be sold or shared.

Your rights

Plain-English summary: It's your data. You can see it, fix it, take it with you, or have us delete it.

Under GDPR (Articles 15–22), you have the right to:

• Access the personal data we hold about you (Article 15)
• Correct inaccurate data (Article 16)
• Delete your data — the "right to be forgotten" (Article 17)
• Restrict how we process it in some circumstances (Article 18)
• Take it with you in a portable format (Article 20)
• Object to processing based on legitimate interests (Article 21)
• Not be subject to fully automated decisions that significantly affect you (Article 22) — we don't make any such decisions

To exercise any of these rights, email hello@laceup.club. We'll respond within 30 days.

You can also delete your account directly in Settings (this is being rolled out — if it isn't in your dashboard yet, email us and we'll handle it).

If you believe we've mishandled your data, you can complain to the Irish Data Protection Commission (dataprotection.ie). If you're in the UK, the Information Commissioner's Office (ico.org.uk) handles UK complaints.

Cookies

We use one cookie: a session cookie set by Supabase Auth so you stay signed in between visits. It's strictly necessary for the product to work — without it, you'd have to sign in on every page load.

We do not use analytics cookies, advertising cookies, or third-party tracking cookies as of the effective date above. If that changes, we'll update this section and ask for consent before setting any non-essential cookies.

Email

Plain-English summary: We email you about your account and your club. We don't send marketing emails unless you've explicitly asked for them.

We send three kinds of email:

1. Account email — sign-up confirmation, password reset, email-change confirmation. You can't opt out of these without closing your account, because they exist to keep your account secure.
2. Club activity email — notifications about events, ladder matches, and updates inside your club. You'll be able to manage which of these you receive in your notification settings.
3. Marketing email — newsletters, product updates, occasional notes from the founder. We only send these to people who have explicitly subscribed. Every marketing email has a one-click unsubscribe link.

Children and junior players

Laceup is not intended for direct use by anyone under 13. Junior players, who are common in tennis clubs, are added by their parents or guardians as managed participants in club ladders and events. The guardian's account is the legal record-holder; the junior's name and ladder rank are content the guardian has chosen to enter on their behalf.

If you believe a child under 13 has signed up for an account directly, contact us at hello@laceup.club and we'll close the account and delete the data.

How long we keep things

• Active account: for as long as you have an account.
• After you delete your account: removed from the live database immediately. Database backups (held by Supabase for up to 30 days) will still contain your data until they age out. We do not restore deleted accounts from backup unless legally required.
• Email logs (Resend): delivery metadata is retained for up to 30 days for troubleshooting.
• Financial records (when paid plans launch): invoice and payment records will be kept for 6 years to comply with Irish tax law, even after account deletion.

When this policy changes

If we make material changes to this policy — meaning changes that affect what we collect, how we use it, or who we share it with — we'll email account holders at least 14 days before the new version takes effect. The current version is always at laceup.club/privacy with the effective date at the top.

Minor edits (typos, clarifications that don't change meaning) will be made without notice, but the effective date will be updated.

Contact

For anything privacy-related — questions, requests, complaints — email hello@laceup.club. A human will read it.

---

This is a v1 baseline written in plain language. We'll have a solicitor review before paid features launch.