Privacy Policy

Mind.Tennis ("we," "our," or "us") is a Canadian sports technology company operating a mental performance training platform for competitive tennis players. We are the data controller responsible for your personal information collected through our website and services at mind.tennis ("the Platform").

This Privacy Policy applies to all users of the Mind.Tennis Platform, including players, parents and guardians, coaches, and course creators. We are subject to the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, Quebec's Act Respecting the Protection of Personal Information in the Private Sector(Law 25 / Bill 64).

We collect only the personal information necessary to provide our services:

Account Information

• Full name and display name
• Email address
• Date of birth (to verify age and apply appropriate protections)
• Role on the platform (Player, Parent/Guardian, Coach, or Creator)
• Password (stored as a one-way encrypted hash — we never see your password)

Player Profile Data

• Tennis level and competitive goals
• Mental training progress and worksheet responses
• Course enrollment history
• Readiness scores (optional, shared with linked coaches only with your consent)
• Profile photo (optional)

Payment Information

• Payment is processed entirely by Stripe, Inc. Mind.Tennis does not store credit card numbers, CVVs, or full payment details.
• We retain transaction records (amounts, dates, course purchased) for accounting purposes.

Technical & Usage Data

• IP address and approximate geographic location (country/province)
• Browser type and device type
• Pages visited and features used within the Platform
• Date and time of access

This section is especially important if you are a parent, guardian, or a player under 18.

Children Under 13

• We do not knowingly collect personal information from children under the age of 13 without verified parental consent.
• Accounts for players under 13 must be created and managed by a parent or guardian.
• The parent/guardian email is the primary account holder and receives all communications.
• If we discover we have collected information from a child under 13 without proper consent, we will delete it promptly. Contact us at privacy@mind.tennis.

Players Age 13–17

• A parent or guardian must link their account to the player's account and acknowledge this Privacy Policy.
• Parents have full visibility into their child's course progress and mental training data through the Guardian Portal.
• We do not use minors' data for behavioural advertising or profiling.
• Minors cannot make purchases — payment requires a parent/guardian account.
• Coach messaging involving junior players automatically includes the parent/guardian account on communications (CC notice).
• Readiness and mental performance data is private by default and only shared with coaches when a parent/guardian explicitly enables sharing.

Parental Rights

• Parents/guardians may access, correct, or delete their child's personal information at any time.
• You may withdraw consent for data processing by contacting privacy@mind.tennis.
• Account deletion requests for minors will be processed within 30 days.

We use your personal information only for the purposes stated below, based on the legal basis of your consent or our legitimate interests in operating a lawful service:

• To create and manage your account
• To deliver mental training courses and track your progress
• To connect players with coaches (with appropriate safeguarding for juniors)
• To process payments through Stripe
• To send transactional emails (purchase confirmations, progress milestones, account alerts)
• To send optional marketing communications — only with your explicit consent, and you can unsubscribe at any time
• To improve Platform features based on aggregated, anonymized usage data
• To comply with legal obligations
• To prevent fraud, abuse, and unauthorized access

We do not sell your personal information. We do not use your data for third-party advertising. We do not build advertising profiles about you.

We share your information only with:

• Supabase, Inc. — our database and authentication provider (servers located in the United States; covered by standard contractual clauses)
• Stripe, Inc. — payment processing (PCI-DSS Level 1 certified)
• Resend, Inc. — transactional email delivery
• Your linked coach — only the data you have explicitly authorized to share
• Law enforcement or regulatory authorities — when required by applicable Canadian law or court order

We require all service providers to maintain equivalent privacy and security standards. Any cross-border transfer of data (to the United States) is covered by appropriate safeguards as required by PIPEDA and Quebec Law 25.

• Active accounts: data retained for the duration of your account
• Deleted accounts: personal data purged within 30 days, except financial records retained for 7 years as required by the Canada Revenue Agency
• Minor accounts: deleted immediately upon verified parent/guardian request, regardless of retention schedule
• Anonymized, aggregated analytics data may be retained indefinitely as it cannot identify individuals

We implement industry-standard technical and organizational measures to protect your data:

• All data transmitted using TLS 1.2+ encryption
• Passwords stored as bcrypt hashes — never in plaintext
• Row-level security policies in our database ensure users can only access their own data
• Authentication tokens are short-lived and automatically rotated
• Third-party services are vetted for security certifications (SOC 2, ISO 27001, PCI-DSS)
• Security incidents affecting your data will be reported to you and to the Privacy Commissioner of Canada within 72 hours as required by PIPEDA

You have the right to:

• Access — request a copy of all personal information we hold about you
• Correction — request correction of inaccurate or incomplete information
• Deletion — request deletion of your account and personal data
• Portability — receive your data in a structured, machine-readable format (Quebec residents)
• Withdraw consent — withdraw consent for non-essential data processing at any time
• Complaint — file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca
• Automated decision review — object to any automated processing that significantly affects you

To exercise any right, email privacy@mind.tennis. We will respond within 30 days (or 10 business days for urgent requests from Quebec residents).

We use minimal cookies necessary to operate the Platform:

• Session cookies — to keep you logged in (deleted when you close your browser)
• Authentication tokens — stored in secure, httpOnly cookies to protect your session
• We do NOT use third-party advertising cookies, tracking pixels, or analytics services that share data with ad networks
• We use server-side anonymized analytics only (no Google Analytics or Meta Pixel)

Mind.Tennis has a designated Privacy Officer responsible for compliance with this policy and Canadian privacy legislation.

If you are not satisfied with our response, you have the right to contact the Office of the Privacy Commissioner of Canada or, for Quebec residents, the Commission d'accès à l'information du Québec.