1. Who this policy covers
This policy applies to Serving T visitors, waitlist members, adult account holders, participants, hitting-partner applicants and approved hitting partners. Serving T is responsible for the Platform records described here. For privacy questions or requests, email hello@servingt.com.
2. Information we collect
- Account and authentication: email address, name, date of birth, phone number where supplied, account identifiers, sign-in method, confirmation and recovery events, session and security records.
- Participants and dependants: first and last name, date of birth, adult or Junior status, account-holder link and optional notes relevant to the session or safety.
- Hitting partners: application answers, experience, biography, service area, venue, provider-derived rating information, approval state, public profile content, availability, media and payout-readiness state.
- Booking drafts, bookings and requests: partially entered account-holder or dependant details, selected participant, partner, offering, time, location, price, consent choices, messages, status changes, reschedules, cancellations, no-shows and policy versions. An abandoned draft expires and is scheduled for deletion.
- Payments: Stripe customer and transaction identifiers, amounts, payment status, saved-payment-method references, refunds, disputes, transfers and checkout/webhook records. Serving T does not receive or store complete card numbers.
- Communications and content: booking messages, reviews and private feedback, support correspondence, reports, moderation notes, email content and delivery status.
- Waitlist and marketing: email, exact consent wording and version, time and source. Where a current Analytics choice permits attribution, we may also record a referrer path and campaign fields. Joining the waitlist currently does not itself send an automatic email.
- Technical and security: cookie choices, browser storage described in the Cookies Policy, request information, HMAC-pseudonymised network addresses used for rate limiting, and technical logs generated by our providers.
Pseudonymised identifiers can still be personal information when they can be connected with a person or device. We do not describe that data as anonymous unless re-identification is not reasonably possible.
3. Dependants and indirect collection
A Junior does not need a separate Serving T Auth account. Their parent, guardian or other authorised adult supplies their name and date of birth so Serving T can determine age, show compatible offerings, enforce Junior safeguards and identify the participant for a booking. The adult is responsible for having authority to provide that information and keeping it accurate.
Serving T personnel, the adult account holder and the approved hitting partner may access the limited participant and session information reasonably needed to administer or safely deliver the booking. We do not use known under-18 or dependant information for personalised advertising, audience matching, lookalike audiences or brand disclosure.
4. How we use information
- provide accounts, password and email-based authentication, participant profiles and booking management;
- assess, approve and monitor hitting partners, including separate Junior-session approval;
- check provider-based eligibility, availability, booking concurrency and participant compatibility;
- process deposits, balances, payouts, refunds, disputes and payment recovery through Stripe;
- send authentication, booking, payment, safety and service communications;
- prevent fraud and abuse, rate-limit requests, secure the Platform and maintain audit records;
- investigate reports, enforce policies, resolve complaints and meet legal obligations;
- send optional direct marketing only where the recipient has consented or another lawful basis applies; and
- produce aggregated operational reporting that is not used to expose individual user records to brands.
Transactional authentication, booking, payment, safety and policy messages are part of operating the service and are separate from optional marketing choices.
5. Who receives information
We disclose only what is reasonably needed to:
- Supabase for authentication, database services and public partner-media storage;
- Stripe for customer records, card payments, saved payment methods, refunds, disputes, Connect onboarding and partner payouts;
- Resend for transactional email delivery and delivery-status events;
- Vercel for website hosting, request handling, scheduled jobs and operational logs;
- the relevant adult booker, participant and hitting partner where needed for a request or confirmed booking;
- professional advisers, insurers, banks, venues or other suppliers where authorised and necessary; and
- regulators, law enforcement, courts or Inland Revenue where disclosure is permitted or required by law.
We do not currently provide raw customer lists to tennis brands, operate matched audiences, or allow a brand to browse Serving T user records. A future identifiable advertising use would require a separate assessment, clear notice and any required adult-user consent.
6. Overseas processing
The service providers above may store or process information outside New Zealand. Their processing locations and subprocessors can change. We assess provider safeguards and use contractual and technical controls appropriate to the information and service. You can ask us for current information about the providers relevant to your account.
7. Marketing, advertising and analytics
Optional Serving T news and offers are separate from essential service messages. A person can decline or later withdraw marketing consent without losing access to booking or account functions. Use an account preference where available, an unsubscribe link in a marketing email, or contact us.
Serving T does not currently initialise website analytics, advertising pixels, advertising identifiers or audience-matching tools. The cookie manager keeps Analytics and Advertising and personalisation off unless an adult visitor opts in. Enabling a category does not by itself start tracking while no provider is installed. See the Cookies Policy.
8. Retention, deletion and security
We retain information only for as long as reasonably needed to provide the Platform, administer open bookings and payments, keep required transaction and consent evidence, handle safety issues or disputes, prevent fraud, and meet tax, accounting or other legal obligations. Different records have different operational and legal lifecycles. We delete or de-identify information when it is no longer required and doing so is technically and legally appropriate.
We use access controls, Row Level Security, restricted service credentials, encrypted transport, provider security controls and audit records. No online service can guarantee absolute security. Please protect access to your email account and tell us promptly if you suspect unauthorised use.
You may ask us to close an account or delete information. We may need to keep limited booking, payment, consent, safety, dispute or legal records after account access ends, and we will explain an applicable exception.
9. Access, correction and complaints
Subject to the Privacy Act 2020, you may ask for access to or correction of your personal information. You can also ask about a dependant's information you supplied, withdraw an optional consent, or make a privacy complaint. Email hello@servingt.com and provide enough information for us to verify and action the request without sending passwords or full card details.
If we cannot resolve a concern, you may contact the New Zealand Office of the Privacy Commissioner at privacy.org.nz.
10. Changes to this policy
We may update this policy as Serving T or its providers change. We will update the version and effective date and give an appropriate notice for a material change. A separate Terms acceptance is recorded where the current Terms require explicit reacceptance.