Privacy Policy

This policy explains what personal data we handle when we provide Pulse, why we handle it, and the rights you have. It applies to padel and sports clubs that use Pulse, to the players who message or book with those clubs, and to visitors to this website.

Depending on where you are, the following laws apply: UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL), the UK GDPR and Data Protection Act 2018, the EU GDPR, the Swiss Federal Act on Data Protection, and the DIFC and ADGM data protection laws for clubs in those free zones.

Who we are

Pulse is a product of Refinr Agency FZC LLC (licence number 2626518482888), a company registered in Ajman NuVentures Centre Free Zone, United Arab Emirates. Our registered address is BC-892837, 26th Floor, Amber Gem Tower, Ajman, United Arab Emirates.

For privacy questions or to exercise your rights, email contact@refinr.xyz.

Who is responsible for your data

This matters, because it decides who you deal with.

• Player data: the club is responsible. When Pulse handles messages and bookings for a club, that club is the controller of the data. We act only as its processor, on the club’s instructions and under a Data Processing Agreement. We never use player data for our own purposes and we never sell it.
• Our website and sales enquiries: we are responsible. For visitors to this site and people who contact us or book a demo, Refinr Agency FZC LLC is the controller.

What we collect

Player data, handled for the club. This comes from the club’s Playtomic account and its WhatsApp Business number:

• name, phone number and email
• padel level, gender and primary club, where the club holds them
• booking history, spend and frequent playing partners
• WhatsApp messages and attachments sent to or from the club
• whether a player can be reached on WhatsApp, and whether they have opted out of marketing
• activity status, such as active or lapsed, worked out from booking history
• campaign results: whether a message was delivered, read or replied to, and any booking that followed

We don’t seek sensitive data such as health information. If a player mentions it in a message, for example an injury, we don’t use it for anything else.

Club staff data. Names, emails and login details for staff who use the Pulse dashboard.

Website visitors. Only the cookies and technical data described in our Cookie Policy. We don’t currently use website analytics, and non-essential cookies load only if you agree.

Demo and contact requests. Your name, email, club and anything you tell us when you get in touch.

Why we use it, and our legal basis

• To provide Pulse under our contract with the club. Answering player messages, managing bookings within the club’s rules, the player CRM, reporting and campaigns. For player data, the club decides the purpose and we follow its instructions.
• Legitimate interests. To run, secure, fix and improve the service, and to reply when a club contacts us.
• Consent. For non-essential cookies, and for marketing messages where the law requires consent. You can withdraw it at any time, and players can reply STOP to any marketing message.
• Legal obligation. Where the law or an authority requires us to keep or disclose data.

Providers we use

We share data only with the providers we need to run Pulse, each under a contract that protects it to the same standard.

Playtomic and Meta (WhatsApp) also handle player data, but under the club’s own accounts and agreements with them. Pulse connects to them with the access the club gives us.

Anthropic does not train its models on data sent through its commercial API, and deletes it within 30 days. Clubs are told about any new provider in advance under their Data Processing Agreement.

Where your data is stored

Pulse’s database and app are hosted in the EU. The AI processing happens in the United States. We are based in the UAE, so our team may access data from there to support clubs.

International transfers

When data moves from the UK, EU or Switzerland to a country without an adequacy decision, such as the United States or the UAE, we use the approved safeguards: the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, and their Swiss equivalent. Anthropic’s terms include these clauses. For clubs in the UAE, we follow the PDPL’s rules on transfers.

How long we keep data

• Club and player data: for as long as the club uses Pulse. Within 30 days after the club leaves, we return or delete it, as the club chooses.
• Backups: deleted through the normal backup cycle within 90 days after the club leaves, unless the law requires us to keep them longer.
• Demo and sales enquiries: up to 12 months after we last spoke, unless you become a client or ask us to delete them sooner.
• Chats with the bot on this website: we don’t store them. The conversation is sent to Anthropic to produce a reply, and Anthropic deletes it within 30 days.

Security

We protect data with measures that fit the risk, including:

• encryption in transit and at rest
• each club’s data kept separate, with access only for that club’s authorised users
• staff access on a need-to-know basis, removed promptly when someone leaves
• Playtomic and WhatsApp credentials stored encrypted
• logging of the actions the AI takes
• checks on every provider before we use it

No system is perfectly secure. If a breach affects a club’s data, we will tell the club without undue delay and within 48 hours of finding out, and help it inform the authorities and players where required.

How we use AI

Pulse uses AI to answer player messages for the club, 24 hours a day. The AI only takes actions the club has approved, such as booking, changing or cancelling a court within the club’s rules. Anything unusual is passed to the club’s staff. The AI doesn’t make decisions about you that have legal or similarly significant effects, and you can always ask to speak to a person at the club.

Junior players

Clubs run junior coaching, so some players may be under 18. The club is responsible for getting a parent’s or guardian’s consent where the law requires it, especially before sending any marketing. Pulse isn’t aimed at children, and we don’t knowingly collect children’s data for our own purposes.

Your rights

Depending on the law that applies to you, you can ask for:

• Access: a copy of the data held about you
• Correction: inaccurate or incomplete data to be fixed
• Deletion: your data to be erased, where there is no legal reason to keep it
• Restriction: limits on how your data is used while a question about it is resolved
• Portability: your data in a structured, machine-readable format
• Objection: to processing based on legitimate interests, and to direct marketing at any time

If you’re a player, the club you play at controls your data, so send your request to the club. If you send it to us, we’ll pass it to the club within 5 working days and help them answer it.

For website visitors and demo enquiries, email contact@refinr.xyz and we’ll respond within the time the law allows.

How to complain

If you think we’ve mishandled your data, please tell us first at contact@refinr.xyz. You can also complain to a regulator:

• UAE: the UAE Data Office
• UK: the Information Commissioner’s Office, at ico.org.uk
• EU: the data protection authority in your country, such as the Data Protection Commission in Ireland
• Switzerland: the Federal Data Protection and Information Commissioner

UK and EU representatives

We are not established in the UK or the EU, but we process data about players there. We are appointing representatives in the UK and the EU to act as a local point of contact for players and regulators. Until then, contact us directly at contact@refinr.xyz.

Changes to this policy

If we change how we handle personal data, we’ll update this page and the date at the top. If a change materially affects clubs, we’ll tell them directly.