Privacy Policy

1.1. The personal data operator is KSLT (Kyrgyzstan Social Lawn Tennis) — an amateur tennis community registered in Bishkek, Kyrgyz Republic.

1.2. This Privacy Policy applies to all personal data that the Operator may receive from the User when using the www.tennis.kg website and the KSLT Tennis mobile application.

1.3. Registration on the website or in the application, as well as use of the Service, constitutes the User's unconditional consent to this Policy and the personal data processing conditions specified herein.

1.4. If the User disagrees with the terms of the Privacy Policy, the User must discontinue use of the Service and request deletion of their account.

2.1. During registration and use of the Service, we collect the following data:

2.1.1. Email address — required. Used for account creation and authentication.

2.1.2. First and last name — required. Used for identification in the system, display in rankings, and at tournaments.

2.1.3. Phone number — optional. May be used for communication regarding tournament participation.

2.1.4. Profile photo (avatar) — optional. Uploaded by the user for profile personalization.

2.1.5. Ranking data — points, match results, win/loss statistics, player category. Generated automatically through tournament participation.

2.2. When authenticating through third-party services (Google, Telegram), we may receive basic profile information: name, email, and photo, which are provided by these services under their authentication protocols.

2.3. We do not collect payment card data. All financial transactions are processed through third-party payment systems.

3.1. Personal data is processed for the following purposes:

3.1.1. Registration and authentication — account creation, login to personal dashboard, access recovery.

3.1.2. User identification — profile display in rankings, on tournament pages, and in match results.

3.1.3. Ranking system — maintaining player rankings, calculating points, determining categories, and forming tournament brackets.

3.1.4. Notifications — informing users about tournaments, results, schedule changes, membership, and other community events via Telegram bot and email.

3.1.5. Service improvement — usage analysis to improve functionality and user experience.

3.2. Personal data is not used for advertising purposes and is not shared with third parties for marketing.

4.1. To ensure the operation of the Service, we use the following third-party services that may process personal data:

4.1.1. Supabase — database hosting and authentication system. Data is stored on Amazon Web Services (AWS) servers. Supabase complies with SOC 2 Type II security standards. Privacy policy: supabase.com/privacy.

4.1.2. Telegram Bot API — used for sending notifications and authentication via Telegram Login Widget. Processed data includes: Telegram ID, username, profile photo. Privacy policy: telegram.org/privacy.

4.1.3. Google (OAuth 2.0) — used for authentication via Google account. Transferred data includes: email, name, profile photo. Privacy policy: policies.google.com/privacy.

4.1.4. Resend — email delivery service. Used for sending notifications (registration confirmation, tournament reminders, system messages). Processed data includes: email address, recipient name. Privacy policy: resend.com/legal/privacy-policy.

4.2. We do not sell or share personal data with third parties, except as required by the laws of the Kyrgyz Republic.

4.3. All listed third-party services are used solely to ensure the operation of the Service and do not have access to data beyond what is necessary to perform their functions.

5.1. All data is transmitted over the secure HTTPS protocol using TLS encryption.

5.2. Access to data in the database is controlled by the Row Level Security (RLS) mechanism, which provides data isolation at the row level. Each user has access only to their own data, unless otherwise specified by the role-based access model.

5.3. User passwords are stored in encrypted form (bcrypt) and are inaccessible even to system administrators.

5.4. Personal data is retained for the entire duration of the user's account existence. Upon account deletion the account immediately stops being shown in the Service, and personal data is erased after 30 calendar days. During this period the User may cancel the deletion by signing in.

5.5. Ranking data (match results, points, tournament statistics) is retained in anonymized form for tournament history purposes even after account deletion: it belongs to past competitions rather than to the account. The player card remains with a note that the account was deleted, and contact details are removed from it.

5.6. Database backups are created automatically and stored in encrypted form on Supabase (AWS) servers.

6.1. The User has the right to:

6.1.1. View their data — all profile information is available in the personal Dashboard on the website and in the mobile application.

6.1.2. Edit their data — name, last name, profile photo, and phone number can be changed in profile settings.

6.1.3. Delete their account — directly in the dashboard under «Settings», or by request to kslt.kyrgyzstan@gmail.com. The account stops being shown in the Service immediately; data is erased for good after 30 calendar days. The deletion can be cancelled at any point during this period.

6.1.4. Opt out of notifications — the user can disable email and Telegram notifications at any time in profile settings by individual category (tournaments, payments, news, system).

6.1.5. Request data export — the user can request a copy of all their personal data by sending a request to kslt.kyrgyzstan@gmail.com.

6.2. To exercise their rights, the user may contact us via email at kslt.kyrgyzstan@gmail.com, specifying the email address linked to their account.

7.1. The Service uses the browser's localStorage mechanism to store authentication session data. This is necessary to maintain the user's login between visits.

7.2. We do not use third-party cookies for tracking or advertising.

7.3. Google Analytics may be used for website traffic analysis. In this case, anonymized data is collected: device type, browser, country, pages viewed. This data does not allow identification of a specific user.

7.4. The user can disable analytics data collection by using browser extensions that block analytics scripts.

8.1. The Operator reserves the right to make changes to this Privacy Policy.

8.2. In case of significant changes, users will be notified via the mobile application and/or by email.

8.3. The current version of the Policy is always available at www.tennis.kg/pages/privacy-policy-en.html.

8.4. Continued use of the Service after the publication of changes constitutes the user's agreement with the updated Policy.

9.1. For any questions regarding the processing of personal data, you may contact us:

Email: kslt.kyrgyzstan@gmail.com

Organization: KSLT (Kyrgyzstan Social Lawn Tennis)

Address: Bishkek, Kyrgyz Republic

Website: www.tennis.kg