Legal

Privacy Policy

This privacy notice explains what Voleea collects, why it is used, and how people can contact Voleea about their rights.

Controller

Legal entity: Voleea
Privacy contact: info@voleea.com

Personal data we collect

Voleea collects only the data needed to run a padel coaching marketplace, keep accounts secure, process Voleea fees, and send service messages.

Google sign-in profile data: name, email address, email verification status, Google account identifier, avatar image, and OAuth account/session records.
Account and session data: user role, onboarding status, locale preference, session token, expiry time, IP address, user agent, and timestamps.
Coach profile data: display name, bio, lesson price, home venue, levels taught, languages, years of experience, lesson length, published status, availability rules, one-off blocked time, and cancellation policy.
Player profile data: level, languages, and preferred venue when the player provides them.
Lesson and booking data: coach, player, venue, start and end time, lesson status, court source, lesson price, booking fee, cancellation data, no-show markers, calendar export data, and booking timestamps.
Reviews: star rating, optional comment, related lesson, coach and player identifiers, and timestamps.
Payment metadata: Stripe customer, checkout session, subscription and event identifiers, booking-fee amounts, refund metadata, webhook event type and raw Stripe event payload. Voleea never stores card numbers or card security codes.
Apple sign-in profile data, where the player uses Sign in with Apple: name, email address (which may be Apple's private relay address), and the Apple account identifier.
Push notification data: the device push token issued by Apple or Google via the Expo push service, the device platform, and the in-app notification feed (title, body and link, which name the other party to a booking).
Uploaded photos: a coach or player profile photo, stored as a publicly-addressable file on Vercel Blob.
Guest booking data: where a coach records a lesson agreed off-platform, the name and — optionally — the phone number of the person the lesson is with. This person need not have a Voleea account; see "Your GDPR rights" for how they can ask for it to be removed.
Approximate location, in the mobile app only: used on the device to sort clubs and coaches by distance. It is never sent to Voleea, stored, or linked to an account.

Why we use the data

The data is used for concrete product operations, not for behavioral advertising.

Create and secure accounts through Google sign-in.
Publish coach profiles and show searchable availability to players.
Create, confirm, cancel and display lessons.
Prevent double bookings and keep a record of cancellation policy snapshots.
Process the €0.99 booking fee through Stripe when payments are enabled.
Send transactional email such as booking confirmations, cancellation notices, review prompts, no-show notices, and subscription payment failure notices.
Display reviews, coach ratings and attendance/reliability information.
Maintain logs, debug errors, prevent abuse, and protect the service.

Legal bases

The exact legal basis can depend on the context. The legal bases are:

Contract: to create accounts, manage bookings, show coach profiles, and process Voleea fees.
Legitimate interests: to prevent fraud and abuse, debug errors, improve reliability, send necessary service messages, keep marketplace records, and enforce policies.
Legal obligation: to keep payment, tax, accounting, and compliance records where required.
Consent: for optional Google Analytics measurement cookies. Analytics runs only after you accept the cookie banner, and you can withdraw consent at any time via the "Cookies" link in the footer.

Children's data

Voleea accounts are for people aged 16 or over, and Voleea does not knowingly collect personal data from a child under 16. Coaching for juniors is booked by a parent or guardian from their own account, so the account holder — and the personal data Voleea holds — is the adult.

Where a coach records a lesson agreed off-platform with a junior, the name and phone number they enter should be the parent's or guardian's. If you believe Voleea holds a child's data, contact the privacy address above and it will be deleted.

Payments

Voleea uses Stripe Checkout for the booking fee. Stripe handles card entry and card processing on its hosted pages.

The lesson price is paid in cash directly between the player and coach. Voleea does not process lesson money, does not hold lesson funds, and does not run payouts to coaches.

Processors and service providers

Voleea uses external providers to operate the service. This list reflects the current codebase and launch architecture.

Neon/Postgres for database hosting.
Vercel for hosting the Next.js application and scheduled cron routes.
Stripe for hosted Checkout, booking-fee payments, refunds, and payment webhooks.
Resend for transactional email delivery.
Sentry for error monitoring.
Google OAuth for Google sign-in.
Google Analytics for aggregated usage statistics — only after cookie consent.
Vercel Blob for storing uploaded profile photos.
Expo (and, through it, Apple Push Notification service and Firebase Cloud Messaging) for delivering push notifications to the mobile app.
Apple for Sign in with Apple.

Cookies

Voleea uses strictly necessary cookies and similar storage: authentication/session cookies and locale preference handling. These do not require consent.

With your consent, Voleea also uses Google Analytics to measure how the site is used (pages visited, approximate region, device type). Analytics cookies are set only after you accept the cookie banner; declining keeps analytics fully off. You can change your choice at any time via the "Cookies" link in the footer.

Voleea does not use advertising cookies, tracking pixels, or behavioral advertising.

Retention

Account data is kept until account deletion is requested and completed, unless Voleea needs to retain specific records for legal, accounting, dispute, fraud-prevention, or security reasons.

Account deletion is available in the app: Profile → Delete account, on the web and in the mobile app. It signs the account out everywhere, severs the Google/Apple link, and deletes the profile, push tokens, notification feed and uploaded photo. Lessons, reviews, group-class registrations and payment records are kept, with the account's identity replaced by an anonymous placeholder, because they are also the other party's records and Voleea's accounting records. Deletion is refused while a lesson is still upcoming or money is still in flight; cancel those first.

Session records expire according to the authentication system's expiry settings.
Booking, payment, subscription, review and dispute-related records may be retained after account closure where needed for legal obligations or legitimate interests.
Transactional email records may remain with the email provider for delivery, audit and abuse-prevention purposes.

Your GDPR rights

People in the EU/EEA have rights over their personal data. These may include access, rectification, erasure, restriction, objection, portability, and the right to complain to a data protection authority.

The quickest route to erasure is Profile → Delete account in the app. For anything else — a copy of your data, a correction, or an objection — contact Voleea using the privacy contact above.

If a coach recorded a lesson with you and you do not have a Voleea account, you can still ask for your name and phone number to be removed: contact the privacy address above with the name and number the coach would have entered.

Security and international transfers

Voleea uses hosted infrastructure providers, access controls, HTTPS, OAuth sign-in, database constraints, webhook signature verification, and operational monitoring to protect the service.

Voleea's database (Neon), application hosting and cron routes (Vercel) and error monitoring (Sentry) are configured to EU regions. Some providers — Stripe, Resend, Google and Apple among them — may process data outside the EU/EEA under their own transfer mechanisms, such as the EU Standard Contractual Clauses.