Sign upLog in

Your information

Privacy Policy

Effective 14 October 2026 | Version 2026-10-14

The essentials

servingT uses personal information to run a curated tennis marketplace.

We collect the information needed to create and secure accounts, assess hitting partners, organise sessions, process payments, communicate about bookings and resolve safety or support concerns. An adult may provide a dependant's information on that dependant's behalf. We do not currently sell personal information, let brands browse user records, or run advertising scripts on the website. Google Analytics runs only if you allow Analytics.

1. Who this policy covers

This policy applies to servingT visitors, adult account holders, participants, hitting-partner applicants and approved hitting partners. Serving T Limited, trading as servingT, is responsible for the Platform records described here. For privacy questions or requests, email hello@servingt.com.

2. Information we collect

  • Account and authentication: email address, name, date of birth, phone number where supplied, account identifiers, sign-in method, confirmation and recovery events, session and security records.
  • Participants and dependants: first and last name, date of birth, adult or Junior status, account-holder link and optional notes relevant to the session or safety.
  • Hitting partners: application answers, experience, biography, service area, venue, provider-derived rating information, approval state, public profile content, availability, media and payout-readiness state.
  • Booking drafts, bookings and requests: partially entered account-holder or dependant details, selected participant, partner, offering, time, location, price, consent choices, messages, status changes, reschedules, cancellations, no-shows and policy versions. An abandoned draft expires and is scheduled for deletion.
  • Payments: Stripe customer and transaction identifiers, amounts, payment status, saved-payment-method references, refunds, disputes, transfers and checkout/webhook records. servingT does not receive or store complete card numbers.
  • Communications and content: booking messages, reviews and private feedback, support correspondence, reports, moderation notes, email content and delivery status.
  • Legacy launch registrations: we retain historical email, consent wording and version, time, source and any attribution fields collected with consent. The registration form is no longer active.
  • Technical and security: cookie choices, browser storage described in the Cookies Policy, request information, HMAC-pseudonymised network addresses used for rate limiting, and technical logs generated by our providers.

Pseudonymised identifiers can still be personal information when they can be connected with a person or device. We do not describe that data as anonymous unless re-identification is not reasonably possible.

3. Dependants and indirect collection

Guardian-supplied Junior photographs are indirect collection. We assess the lawful basis under IPP 2 and take reasonable steps to provide the young person with the collection notice as soon as reasonably practicable under IPP 3A, unless a supported exception applies. The guardian should explain public display in an age-appropriate way and consider the Junior's wishes and objections. Guardian acknowledgement alone does not replace servingT's own duties. Contact us if authority or the young person's wishes change.

A Junior does not need a separate servingT Auth account. Their parent, guardian or other authorised adult supplies their name and date of birth so servingT can determine age, show compatible offerings, enforce Junior safeguards and identify the participant for a booking. The adult is responsible for having authority to provide that information and keeping it accurate.

servingT personnel, the adult account holder and the approved hitting partner may access the limited participant and session information reasonably needed to administer or safely deliver the booking. We do not use known under-18 or dependant information for personalised advertising, audience matching, lookalike audiences or brand disclosure.

4. How we use information

Voluntary partner photos and crop, upload-notice, licence and moderation records are collected to manage approved public profiles. Originals stay private to authorised managers and staff; approved processed photos are public and may be edited for presentation. Adult photos uploaded under the October photo terms may also promote servingT through website content, social media, paid advertising, email, press and other servingT materials within the scoped licence. Junior uploads authorise marketplace display only; promotion needs separate specific manual authorisation. Supplying a photo is optional and does not determine access to booking services.

  • provide accounts, password and email-based authentication, participant profiles and booking management;
  • assess, approve and monitor hitting partners, including separate Junior-session approval;
  • check provider-based eligibility, availability, booking concurrency and participant compatibility;
  • process deposits, balances, payouts, refunds, disputes and payment recovery through Stripe;
  • send authentication, booking, payment, safety and service communications;
  • prevent fraud and abuse, rate-limit requests, secure the Platform and maintain audit records;
  • investigate reports, enforce policies, resolve complaints and meet legal obligations;
  • send optional direct marketing only where the recipient has consented or another lawful basis applies; and
  • produce aggregated operational reporting that is not used to expose individual user records to brands.

Transactional authentication, booking, payment, safety and policy messages are part of operating the service and are separate from optional marketing choices.

5. Who receives information

Published partner images are visible to website visitors. Authorised adult promotional images may be shared with contracted production, social media, advertising, press and email recipients for servingT promotion. Contractors receive only necessary scoped processing authority, not independent advertising rights. We assess overseas recipients and processor roles under IPP 12 and use appropriate safeguards; ask us for current provider details.

We disclose only what is reasonably needed to:

  • Supabase for authentication, database services and partner-media storage;
  • Stripe for customer records, card payments, saved payment methods, refunds, disputes, Connect onboarding and partner payouts;
  • Resend for transactional email delivery and delivery-status events;
  • Vercel for website hosting, request handling, scheduled jobs and operational logs;
  • Google for Google Analytics 4 website measurement, only when a visitor allows Analytics;
  • the relevant adult booker, participant and hitting partner where needed for a request or confirmed booking;
  • professional advisers, insurers, banks, venues or other suppliers where authorised and necessary; and
  • regulators, law enforcement, courts or Inland Revenue where disclosure is permitted or required by law.

We do not currently provide raw customer lists to tennis brands, operate matched audiences, or allow a brand to browse servingT user records. A future identifiable advertising use would require a separate assessment, clear notice and any required adult-user consent.

6. Overseas processing

The service providers above may store or process information outside New Zealand. Their processing locations and subprocessors can change. We assess provider safeguards and use contractual and technical controls appropriate to the information and service. You can ask us for current information about the providers relevant to your account.

7. Marketing, advertising and analytics

Optional servingT news and offers are separate from essential service messages. A person can decline or later withdraw marketing consent without losing access to booking or account functions. Use an account preference where available, an unsubscribe link in a marketing email, or contact us.

The cookie manager keeps Analytics and Advertising and personalisation off unless an adult visitor opts in. If Analytics is allowed, servingT uses Google Analytics 4 to measure visits, campaign sources and steps such as viewing a hitting partner profile, starting a booking or completing a deposit. servingT sends opaque references rather than names, email addresses, phone numbers or form content, and disables Google Signals and advertising personalisation. servingT does not currently initialise advertising pixels, advertising identifiers or audience-matching tools. See the Cookies Policy.

8. Retention, deletion and security

Abandoned photo uploads are cleaned after one day; unreviewed photos expire after 30 days; rejected private images are normally purged 30 days after rejection, with identifiable-third-party rejections queued for prompt deletion; approved private originals are purged after 90 days. Public processed photos remain until replacement or removal. Private-original retention does not delete legacy admin photographs or public derivatives. Removing a photo queues its known private and public profile objects for deletion, while necessary decision and licence provenance remains under a justified audit-retention schedule.

Profile-photo removal and an adult contractual promotional licence are separate. Appropriate promotion may continue within the October Terms' bounded duration while the partner remains active; we create no new promotional content featuring a partner who has left the site. Controlled existing materials have the Terms' sunset period. Distributed print, third-party copies and necessary backups cannot always be recalled immediately. Privacy rights, copyright and legally required removal still apply; requests are assessed independently rather than automatically accepted or rejected by the contract. Earlier photos keep their original permission limits.

We retain information only for as long as reasonably needed to provide the Platform, administer open bookings and payments, keep required transaction and consent evidence, handle safety issues or disputes, prevent fraud, and meet tax, accounting or other legal obligations. Different records have different operational and legal lifecycles. We delete or de-identify information when it is no longer required and doing so is technically and legally appropriate.

We use access controls, Row Level Security, restricted service credentials, encrypted transport, provider security controls and audit records. No online service can guarantee absolute security. Please protect access to your email account and tell us promptly if you suspect unauthorised use.

You may ask us to close an account or delete information. We may need to keep limited booking, payment, consent, safety, dispute or legal records after account access ends, and we will explain an applicable exception.

9. Access, correction and complaints

Subject to the Privacy Act 2020, you may ask for access to or correction of your personal information. You can also ask about a dependant's information you supplied, withdraw an optional consent, or make a privacy complaint. Email hello@servingt.com and provide enough information for us to verify and action the request without sending passwords or full card details.

If we cannot resolve a concern, you may contact the New Zealand Office of the Privacy Commissioner at privacy.org.nz.

10. Changes to this policy

We may update this policy as servingT or its providers change. We will update the version and effective date and give an appropriate notice for a material change. A separate Terms acceptance is recorded where the current Terms require explicit reacceptance.