Data Retention Policies

Customer Data Retention Policy

PodPlay's data retention policy is strict and straightforward: If or when a Customer wants to delete their Profile or information from the system, they are in complete control to do so.

We are in full compliance with GDPR lawfulness, fairness, and transparency. The Customer is given complete control over their data and can delete it at any time.

Customers Deleting Data

If the Customer wants to delete their Profile, they can:

• Navigate to the More tab of the App
• Click on Account Info button (top)
• Click on the Account button (top)
• Click on Delete account button (bottom)

By clicking on the “Delete account” button, a pop-up will appear: “Are you sure you want to delete your account? If you delete your account, [Club name] will no longer keep your data on file.” The Customer can click on this button to delete their Profile and data.

Admins Deleting Data

If an Admin wants to delete a Customer Profile, they can:

• Navigate to the Customer page of the Dashboard
• Search for a Customer's Profile
• Open the Profile
• Click on the Delete account button

Deleting Customer Profiles

Once a Customer's Profile is deleted:

• All upcoming Reservations and Event signups are canceled
• Any held Credits are deleted
• Their email and name are redacted/edited

  • Admins cannot search for them in the Dashboard
  • PodPlay will not be able to search for them in the database

In the case where a Club is on the PodPlay Pro or Autonomous tier, there may be Replays in the system of when the Customer captured a Replay. The Video Retention Policy is below.

Video Data Retention Policy

PodPlay’s video retention policy applies to Replay camera footage and security camera footage.

What is the TL;DR of camera feed retention?

Video feed from Replay cameras = available 48 hours, then deleted forever.

Replays captured = retained in the Customer’s Profile until deletion (subject to change).

Replays captured and favorited by the Customer = retained in the Customer's Profile until deletion.

Security footage = 30 days, then deleted forever (this can be adjusted to fewer days).

For Replay Cameras

The Replay cameras are recording on the courts where there is a Reservation or Event. If there are no Reservations or Events on the courts, the Replay cameras are not recording and footage cannot be pulled through any backdoor.

Customers can create Replays any time they click on a Capture Replay button; these are called Quick Replays. If an Admin or the Customers wants to create a Custom Replay, they have 48 hours to do so before the Replay camera feed is deleted forever. Custom Replays can be up to an hour in length and are charged to the Customer separately from any Quick Replays the Customer captures during play-time. Any replays captured, whether Quick or Custom, are retained in the system for Customers to refer back to until their Profile is deleted (subject to change).

If a Customer generates a Replay (Quick or Custom) and favorites the Replay (saves it for rapid review with the Favorite Replay button in the More tab of the App), these Replays are retained until the Profile is deleted.

For Security Cameras

The security camera feed is stored for 30 days before deletion. PodPlay can adjust the quantity of days security camera feed is stored if you prefer to reduce this window of time. PodPlay will not increase past 30 days.

Pertaining to Attacks or Exploits

PodPlay prioritizes the security and protection of your Customer data and hosts with Google Cloud, which provides full data encryption and adheres to the highest industry standards for data protection including ISO/IEC 27001 for information security management, ISO/IEC 27017 for cloud security, and ISO/IEC 27018 for cloud privacy. More information is available here.

PodPlay leverages Stripe for Payment Processing, which uses best-in-class security practices to maintain a high level of security. It is also certified as PCI Service Provider Level. More information is available here.

What information is collected from Customers?

Information collected from Customers remains nominal to avoid potential hacker attacks or exploits. The information retained from any and all Customer Profiles is: first name, last name, email address, phone number, last four digits on the credit card on file, birthday (optional), gender (optional).

What information is not collected from Customers?

The information not collected, through a cyber security practice of reducing the value of attempted hacker attacks or exploits, is: passwords, home address, full credit card numbers.

Why use passwordless access?

The default setting on any Club's environment is passwordless access for the Customers. This means the Customer does not need to enter a password to log in to their Profile. For a Customer to login to your Club's App, they need only enter their email. Passwordless access is considered safer than traditional password-based authentication for several reasons:

1. Eliminates Weak Passwords: Customers often create passwords, reuse them across multiple sites, or choose easy-to-guess passwords
2. Protection Against Phishing: Phishing attacks trick users into revealing their passwords
3. Reduced Credential Stuffing: Attackers often use credentials obtained from data breaches on other platforms (credential stuffing)
4. No Passwords to Store: Storing passwords securely is a challenge for companies
5. Resistance to Brute Force Attacks: Without a password to guess, brute-force attempts become ineffective
6. Improved User Experience: Not needing to remember and frequently reset passwords enhances user experience, reducing the risk of weak or poorly managed credentials

Passwordless systems remove these vulnerabilities by replacing passwords with stronger authentication methods, like the PodPlay email access method.

System Architecture

PodPlay does not readily share it's infrastructure, coding language, or integration framework. This is purposeful. If you require more information about your Club's environment, please contact the Customer Success team to arrange an appropriate confidentiality agreement.

Reporting Vulnerabilities

If you or someone on your Club’s staff notice a vulnerability in the PodPlay system, immediately report this to the Customer Success team by email at [e-mail]. Our developers will build or remove aspects of the system to ensure the vulnerability is secured.

Spam in the System

Wherever you are located, your Customer base will always have bad apples. There will be instances when Customers sign up to visit your Club and attempt to take advantage of Club rules and configurations which are normally offered to only new Customers. The system attempts to minimize this by forcing each Profile to be uniquely connected to an email, and as such, a Customer will be unable to create multiple Profiles with the same email.

If you change a configuration in the Dashboard to allow for passwords or remove a verification of email address or credit card, you are opening your App up to possible attacks or exploits.