Version of 8 October 2026, revision 4
Privacy notice
Match Masters at tennisclub.tech is provided by a UK sole trader, trading as TheProCut (“we”, “us”). Contact me@theprocut.co.uk for support, billing or privacy enquiries.
1. Who is responsible for your information
We are the controller for information used to run Match Masters accounts, subscriptions, support and service security. This means we decide why and how that information is used.
A club, academy or independent coach normally acts as the controller for the player and competition records it adds. We process those records on its instructions to provide the service. For questions about a player’s entry, results or a player access link, contact the club first. We can help identify the responsible workspace and assist it with a request. Our processing terms for workspace records are in section 10 of the service terms.
2. What we collect and why
| Information | Purpose and lawful basis for our own processing |
|---|---|
| Account name, email address, sign-in identifiers and club membership | Create and secure accounts, manage access and provide the service. Contract where you subscribe personally; legitimate interests in administering access for a club’s staff. |
| Workspace name, country or time-zone settings, selected currency, subscription identifiers and billing status | Provide the subscribed service and administer billing (contract); keep records required by applicable tax and accounting law (legal obligation). |
| Hashed account and verified email identifiers, trial reservation and use dates | Check eligibility for the one-use introductory offer and prevent repeat claims (legitimate interests in administering a fair offer and preventing misuse). |
| Support messages and correspondence | Answer enquiries and resolve service or billing problems (contract or our legitimate interest in supporting users, depending on the enquiry). |
| Marketing recipient name and email, permission records, delivery records and opt-out preferences | Send product emails you have agreed to receive (consent). Keep evidence of permission, prevent duplicate messages and honour opt-outs (our legitimate interest in responsible correspondence and applicable legal obligations). |
| IP address, browser/device information, request and error logs, security events and session identifiers | Deliver pages, prevent misuse and diagnose faults (legitimate interests in operating a secure, reliable service). |
Workspace data can include player names, optional profile images and coaching notes, groups, venues, event entries, fixtures, scheduled dates and times, match results, participation statistics and player access tokens. Clubs choose what to enter and must identify a lawful basis for their use. We do not use these records to train an AI model or sell them to advertisers.
Account and checkout details needed to authenticate you or provide a subscription are required to use the portal. Optional profile fields and coaching notes can be left blank. We do not make decisions producing legal or similarly significant effects solely through automated profiling. Subscription status controls access to paid features; event pairings and standings follow the format selected by the organiser.
Product marketing is optional and separate from club access. You can stop it using the unsubscribe link or by replying to an email. Club player records are not added to marketing lists. Our launch emails do not use tracking pixels or rewrite links to track opens or clicks.
3. Children’s records and player access
Coach accounts and subscriptions are intended for adults acting for a club or coaching business. Children do not need an account for their club to record a match. A parent, guardian or player may view an individual player’s page through a link supplied by the club.
The club must give players and, where appropriate, their parents or guardians suitable privacy information and ensure the records and sharing are lawful. Keep entries limited to what is needed for tennis administration. Do not enter medical, safeguarding, identity-document, payment-card or other sensitive information in player names, images or coaching notes.
A player access link is a bearer link: anyone who has it can open that player’s record without signing in. The page shows that player’s scores, results and scheduled fixtures, including relevant opponents, doubles partners, event names, courts and optional times. The parent/player selection records the intended recipient; it does not authenticate the person opening the link. Share it only with intended recipients and do not post it publicly. Authorised coaches can turn link access off or replace a link in the app if it has been shared too widely. Contact the club promptly if a link or result exposes information that should not be available.
4. Who can receive information
Authorised coaches in the same workspace can access its records. Workspace owners control coach membership and exports. We may access records where needed for support, security, legal obligations or an instructed correction. We do not publish a searchable directory of player profiles.
- Clerk provides authentication and account verification, processing account and session information. Its processing of app user data is governed by its agreement with us. Clerk’s privacy information.
- Stripe provides checkout, card storage, subscriptions and billing. Card details are entered on Stripe; Match Masters stores payment and subscription identifiers and status, not full card numbers. Stripe also processes information for its own payment security and legal responsibilities. Stripe’s privacy policy.
- Cloudflare hosts the app, delivers static files and provides network and security services. Requests and associated technical information pass through its infrastructure. Cloudflare’s privacy policy.
- MongoDB Atlas stores account, workspace and player records. The current app database is configured in Ireland; provider support and related processing can involve other countries. MongoDB’s privacy policy.
- Mailgun (Sinch Email) sends consented product emails and forwards replies to our business inbox. It processes recipient addresses, email content, delivery events and unsubscribe, bounce and complaint records. The sending domain currently uses Mailgun’s US region. It is not given club player records for marketing. Mailgun’s privacy information.
Some portal pages load icons from Cloudflare’s cdnjs service. An externally hosted player image, if entered by a coach, is requested from that image’s host when displayed, revealing ordinary request information to that host. Avoid images from providers you do not trust.
Information may also be disclosed where a legal obligation requires it or where necessary to establish, exercise or defend legal claims. We assess such requests before disclosing records.
5. International processing
The providers above operate internationally, so some processing can occur outside the UK or the user’s country. A database region does not mean all service data stays in that region. Where UK data protection law requires protection for a restricted transfer, the applicable provider agreement and transfer mechanism must cover it, such as an adequacy decision or approved contractual safeguards. Contact us for information about the arrangements relevant to your data. We do not promise country-specific residency for the whole service.
6. How long records are kept
Account and workspace records are kept while needed to provide the service. Cancelling a subscription does not immediately delete a workspace: its records remain read-only so the owner can retrieve and export them. The current service does not automatically purge cancelled workspaces after a fixed period. Owners should contact us to arrange deletion when records are no longer needed.
We review a deletion request to confirm the requester’s authority and identify which records it covers. Player information is normally corrected or removed on the club’s instructions. Information required for accounting, fraud investigation, a legal obligation or an existing dispute may be retained separately for as long as that purpose requires. Technical-log retention also depends on the provider’s settings and service requirements. Contact us for the current retention information relevant to a particular record.
We keep a limited trial-eligibility record after cancellation or account deletion while needed to enforce the one-use offer. It contains hashed account and verified email identifiers, workspace references and reservation/use dates, not player records or card details. These hashes are still personal data. We review continued retention when the offer changes and when you ask us to erase or challenge the record; contact us if an eligibility decision seems wrong.
Marketing contacts are used while their permission remains valid and relevant. After an opt-out, we keep the minimum suppression information needed to avoid contacting that address again. Permission evidence and delivery records are kept while needed to account for correspondence and resolve complaints; contact us for a review or deletion request. An email unsubscribe does not cancel a subscription or block essential service correspondence.
Deleting a player is different from deleting all historical match data: linked results may remain for the other participants. Ask for complete removal or anonymisation if that is needed. Deleting a local browser session does not delete server records.
7. Access, corrections and your rights
Depending on the circumstances, UK data protection law provides rights to access and correct information, request erasure, restrict processing, object to processing based on legitimate interests, and obtain portable data. These rights are not absolute. Where processing relies on consent, you can withdraw it without affecting processing that was lawful before withdrawal.
Owners can export workspace records from Settings. For other requests, email the contact address above and describe the account or club concerned. Do not send identity documents unless we ask for information needed to verify the request. We respond within the applicable legal period and explain any lawful extension or refusal.
You can complain to the Information Commissioner’s Office, the UK regulator, or your local supervisory authority where applicable. You can contact us first, but you do not have to do so before raising a regulatory complaint.
8. Cookies and browser storage
The app uses an essential session cookie, mm_platform_session, to maintain your signed-in workspace and protect requests. Clerk uses authentication cookies and session storage to provide sign-in. Stripe may use its own cookies on checkout and billing pages, and Cloudflare may use security cookies when protecting a request. Blocking essential cookies can prevent sign-in or checkout from working.
Opening an invitation offer sets __Host-mm-offer, a secure signed cookie that remembers the requested offer and currency for up to 30 days, including through sign-in. It contains an offer reference and currency, not an email address. It is used to retain that price for checkout, not to track activity across websites.
Browser storage also remembers interface choices such as the displayed court sides. The commercial app does not include the former club app’s Vercel analytics script, advertising pixels or session-replay tooling. Club statistics are calculated from recorded matches. If we introduce optional tracking, we will explain it and obtain consent where required before enabling it.
9. Security and updates
Support requests are visible to the coaching team in the relevant workspace and to authorised Match Masters business administrators. Administrators can keep private investigation notes and record support actions, including billing refreshes, renewal changes and workspace corrections. Unexpected service errors are recorded with the route pattern, error type, time and workspace reference; these diagnostic entries do not include request bodies, query strings or exception messages. Support conversations and administrative records are retained while needed to handle enquiries, investigate faults and account for changes, subject to the deletion process described above.
Access is checked against club membership and records are separated by workspace. Connections to the hosted app and database use encryption in transit. Keep account credentials and player access links private, remove coaches who no longer need access, and report suspected unauthorised access to our contact email. No online service can guarantee that an incident will never occur.
We update this notice when the service or its processing changes. The version date appears above. Material changes will be brought to affected users’ attention where required.