Privacy Policy

1. Introduction

Welcome to NextSet ("NextSet," "we," "us," or "our"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and mobile application (collectively, the "Services").

By using NextSet, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use our Services.

2. Information We Collect

2.1 Personal Information You Provide

We collect information that you voluntarily provide to us when you:

• Register for an account (name, email address, phone number, password)
• Complete your profile (date of birth, gender, and your location — city, region/state, and country; see Section 2.6)
• Maintain your tennis profile details
• Schedule lessons, clinics, or training sessions
• Communicate with coaches, club managers, or other players through in-app messaging
• Submit session notes, training goals, or match results
• Record training and physical-training/assessment data (for example fitness-test results such as speed, agility, or endurance measurements) so your coach can track your progress. This is athletic performance information — not medical data — and we process it to provide the coaching service you sign up for (see Section 13)
• If you are under 16, the email address of your parent or guardian and their consent (see Section 8)
• Contact our support team

2.2 Automatically Collected Information

When you access our Services, we automatically collect certain information, including:

• IP address and browser type
• Device information and operating system
• Pages visited and time spent on pages
• Referring website addresses
• Session cookies used to maintain your login state
• With your consent, analytics data collected through Google Analytics to understand how our website is used (see Section 7). Analytics is only loaded if you accept it in our cookie banner; you can decline and still use the Services fully
• With your consent, measurement data collected through the Meta (Facebook) pixel on our public website, so we can tell which of our adverts and posts bring people to NextSet. This tells Meta that a browser visited a page on our site and, on a small number of pages, that a specific step was reached (for example starting a sign-up or completing a purchase). Like analytics, the pixel sends nothing at all until you accept it in our cookie banner, and it is never active in our mobile app or inside the logged-in portals' private pages (see Section 7)

2.3 Mobile App — Push Notification Tokens

If you use the NextSet mobile application and grant permission for push notifications, we collect and store your device's Expo push notification token. This token is used solely to deliver in-app notifications (such as lesson reminders, messages, and task assignments). You may disable push notifications at any time through your device settings.

2.4 Google Calendar Integration

If you choose to connect your Google Calendar account, we collect and store OAuth access and refresh tokens to create and update calendar events on your behalf (lesson scheduling). We do not read, store, or share the contents of your Google Calendar. You may disconnect Google Calendar at any time from your account settings.

2.5 Payment Information

Payments are processed by Stripe, Inc. We do not store your full credit card number on our servers. We receive and store transaction metadata (subscription status, payment amounts, Stripe customer and subscription IDs) to manage your account. Court booking payments are routed directly to club Stripe Connect accounts, and coach lesson payments are routed directly to coaches' Stripe Connect accounts (NextSet retains a small platform fee on coach lesson payments). We store the related payment metadata (amounts, status, and Stripe payment identifiers) but not your card details.

2.6 Location Information

To help you find coaches, clubs, and hitting partners, and to display location on profiles and listings, we let you search for and select a location using the Google Places and Google Maps APIs. When you search for a location, your query is sent to Google to return matching places. For the location you select, we store a structured location label together with a Google place identifier and approximate map coordinates (latitude and longitude) for your account and, where applicable, for your club or partner listings. This coordinate data supports location display and future proximity ("near me") features. Your use of Google Maps/Places is also subject to Google's Privacy Policy.

2.7 Voice Messages

You can send a voice message in a NextSet conversation instead of typing. If you do, we store the audio recording so the people in that conversation can play it. A voice message is treated as private: the audio file cannot be opened directly over the web, and it is delivered only through a time-limited link that is issued to a specific recipient and checked against that conversation's membership each time it is played. We do not transcribe your voice messages, we do not analyse them, and we do not use them to train anything.

Deleting the message deletes the recording. If you delete your account, every recording you sent is deleted with it (see Section 9).

2.8 Health and Fitness Data From a Connected Watch or Phone

If you choose to connect Apple Health (on iPhone and Apple Watch) or Health Connect (on Android), NextSet can read completed workout sessions so that a session you have already played shows up in your training record without you logging it by hand. We read only workouts; we do not read anything else from your health account.

There are two different kinds of information here, and we treat them differently on purpose:

• The session itself — the sport, when it started and ended, and how long it lasted. This is athletic activity information and we use it to complete your training record, in the same way a session you typed in yourself would.
• Body measurements — average and maximum heart rate, calories, distance and step count. Under the GDPR this is health data (Article 9), and we store it only if you give separate, explicit consent in the app. Connecting a watch is not that consent: if you connect a watch and decline this, your sessions still appear and these measurements are simply never written to our servers.

You can withdraw that consent at any time, and withdrawing it deletes the measurements we already hold — not only future ones. We erase the heart rate, calorie, distance and step values from every session on your account at that moment, keeping the session itself. You can also disconnect the health integration entirely from your settings, or revoke our access from Apple Health or Health Connect directly.

These measurements are yours alone. They are shown only to you, in your own training log and on your own posts. They are not shown to your coach, your club, or anyone who can see your activity, and they are never used for advertising, profiling, or any automated decision about you, nor shared with any advertising or analytics provider.

2.9 Photos You Upload

If you add a photo — a profile picture, or a picture on a post you share — we store that image file and show it to the people who can see that profile or post. Photos on a post follow that post's audience; a private post's photo is visible only to you. Removing the photo or the post removes the file, and deleting your account deletes the photos you uploaded (see Section 9). We do not run facial recognition on your photos and we do not use them to train anything.

2.10 Training Programs You Buy

NextSet sells self-paced training programs. You can buy one without having a NextSet account, so a purchase is recorded against the email address you pay with, together with the amount, currency, the program, and the Stripe payment identifier. If you later create or log into an account with that same email address, the purchase is attached to your account so the program appears in your library. We also record how far through a program you are, so it can resume where you left off.

A purchase record is a payment record: we keep it for the period tax and accounting law requires, even if you later delete your account (see Section 9).

2.11 Reports You Submit, and Safety Checks

If you report a message, a post, or another person, we record what you reported, the reason you gave, and a copy of the content at the time you reported it, so we can act on it. We also run automatic checks on messages for obviously abusive content. See Section 14 for what we do with reports and what we tell the person concerned.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our Services
• Create and manage your account
• Process your bookings, clinic registrations, and subscription payments
• Connect you with coaches, clubs, and other players
• Facilitate partner-finding based on location and availability
• Track your training progress and performance over time
• Complete your training record from a connected watch or phone, where you have chosen to connect one (see Section 2.8)
• Deliver the training programs you have bought, and remember your progress through them
• Keep NextSet safe — reviewing reports, checking messages for abusive content, and acting on accounts that break our rules (see Section 14)
• Send push notifications for lessons, messages, tasks, and platform activity
• Sync lesson events to your connected Google Calendar
• Send you important account updates and administrative messages
• Respond to your inquiries and provide customer support
• Improve our Services and develop new features
• Ensure security and prevent fraud
• Comply with legal obligations

4. How We Share Your Information

4.1 With Your Consent

We share your information when you give us explicit permission to do so.

4.2 With Coaches and Club Managers

When you join a coach or a club, relevant profile information (name and contact details) is shared with your coach and club manager to facilitate your training and club membership.

4.3 With Other Players (Partner Finder)

When you participate in the partner-finding feature, limited profile information (first name, last initial, city, state) is visible to other players. Full contact details are only shared once you connect.

4.4 Public Coach Directory

Coaches who opt into the public directory make their name, city, state, bio, and profile photo visible to any visitor of the Find a Coach page, regardless of whether they have a NextSet account.

4.5 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Stripe — payment processing and subscription management
• Expo — mobile push notification delivery
• Google Maps / Places — location search, geocoding, and map coordinates
• Google Calendar — calendar integration (only when you connect your account)
• Google Analytics — website usage analytics (only if you accept analytics cookies)
• Meta Platforms — advertising measurement on our public website (only if you accept it in our cookie banner). Unlike the providers above, Meta does not act solely on our instructions: it also uses this data for its own purposes as described in its own policy, which is why we ask for your consent before loading it at all (see Section 7)
• Hostinger — website and database hosting
• SMTP / email providers — transactional email delivery
• MailerLite — our mailing list, and only that. It receives your email address, your first and last name, which list you chose and whether you are subscribed. It is only sent anything at all if you asked to join a list yourself: nothing from the app ever reaches it, and that means no lessons, messages, training data, photos or health data. You can leave at any time from the link in any email we send or from your notification settings, and deleting your account unsubscribes you too. When you opt out we keep a record of the opt-out itself, so that we do not add you back or email you again

4.6 Legal Requirements

We may disclose your information if required by law or in response to valid requests by public authorities.

4.7 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Bcrypt hashing of all passwords
• HTTPS encryption for all data in transit
• CSRF protection on all web forms
• JWT authentication for mobile API requests
• Limited access to personal information by authorized personnel only

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee absolute security.

6. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information
• Portability: Request a copy of your information in a structured, machine-readable format
• Objection: Object to the processing of your personal information
• Restriction: Request restriction of processing your personal information
• Withdraw Consent: Withdraw consent where we rely on consent to process your information

To exercise these rights, please contact us using the information provided at the end of this policy.

7. Cookies

Essential cookies. We use a session cookie to keep you logged in and a security (CSRF) token. These are strictly necessary for the Services to function and do not require consent.

Analytics (optional). With your consent, we use Google Analytics to understand how our website is used. Google Analytics is not loaded until you accept it in our cookie banner; you can decline and still use the Services fully. You can change or withdraw your choice at any time using the Cookie settings link in our website footer.

Advertising measurement (optional). With your consent, our public website also loads the Meta (Facebook) pixel, so we can measure which adverts and posts bring people to NextSet. This is an advertising technology and it does set cookies: Meta may use it to attribute a visit or a sign-up to an advert, and to build audiences for our future adverts. It is not loaded until you accept it in the same cookie banner, it is switched off again if you withdraw your choice, and declining it changes nothing about your use of NextSet. The pixel runs on our public website only — never in the mobile app, and never on the private pages inside your portal, so what you do in your own account is not reported to Meta. Your use of Meta's technology is also subject to Meta's Privacy Policy.

We do not sell your personal data. You can also control cookies through your browser settings; disabling the essential session cookie will prevent you from logging in.

8. Children's Privacy

You must be at least 13 years old to create your own NextSet account. We do not knowingly allow children under 13 to register; younger juniors can be added by their coach as managed players rather than holding their own account.

If you are between 13 and 15 years old — that is, under 16, the digital-consent age in several EU countries including Germany — you must provide a parent or guardian's email address and confirm that they consent to your use of NextSet when you sign up. We email the parent or guardian a notice so they are informed of the account and their rights. If a parent or guardian believes their child registered without their consent, please contact us and we will delete the account.

9. Data Retention

We keep your personal information for as long as your account is active. Specific retention periods:

• Account & profile data, lessons, notes, goals and training/assessment data: kept while your account is active and erased when you delete your account. You can delete your account yourself at any time — in the mobile app or on the web (see Section 6).
• Messages, including voice messages and their audio files: kept until the message is deleted or your account is deleted, whichever comes first. We do not run a timed clean-up of conversations, because a conversation with your coach is part of your coaching record. Deleting a message deletes it for you immediately; deleting a voice message deletes the audio file itself.
• Photos you upload: kept until you remove the photo or the post carrying it, or until you delete your account. The image file is deleted, not just hidden.
• Health measurements from a connected watch (heart rate, calories, distance, steps): kept only while your explicit consent stands. Withdrawing consent erases them immediately, and the underlying workout session is kept as ordinary activity data (see Section 2.8).
• Training program purchases and progress: your progress is erased with your account; the purchase record is kept as a payment record (see below).
• Reports and moderation records: kept for up to 24 months after the case is closed, so a pattern of behaviour can be recognised and a decision can be reviewed or appealed. A report you made stops being linked to you when you delete your account.
• Unverified or abandoned sign-ups: deleted automatically within 30 days.
• Payment records: retained by us and by Stripe for the period required by tax and accounting law (generally up to 10 years in France).
• Support correspondence: kept for up to 24 months after your last contact.
• Aggregated, anonymized statistics that no longer identify you may be retained indefinitely.

When you delete your account we permanently erase your personal data (a hard delete), except where we must keep limited records to comply with a legal obligation.

10. International Data Transfers

NextSet is operated from France and your data is processed on servers located in or accessible from the European Union and/or the United States. By using our Services, you consent to the transfer and processing of your information in these locations. We ensure that any such transfers comply with applicable data protection laws.

11. Third-Party Links

Our website may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

12. California Privacy Rights (CCPA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), including the right to:

• Know what personal information we collect, use, and disclose
• Request deletion of your personal information
• Opt-out of the sale of your personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

13. EU/EEA Data Protection (GDPR)

If you are located in the European Economic Area, our legal bases for processing your personal information include: performance of a contract (providing the Services, including recording your lessons, notes, goals and training/physical-assessment data so your coach can support you), compliance with legal obligations, our legitimate interest in keeping NextSet safe and in defending our rights (handling reports and acting on accounts that break our rules), and your consent where required (analytics cookies, the advertising pixel, health measurements from a connected watch, and — for members under 16 — parental consent).

Athletic performance data is not health data; body measurements are. Your lessons, notes, goals, fitness-test results and the fact that you played a session are athletic performance information, processed to deliver the coaching service you signed up for. We do not collect medical records or information about health conditions. However, if you connect a watch and separately consent to it, we store heart rate and calorie figures, and we treat those as special category health data under Article 9(1), processed on the basis of your explicit consent under Article 9(2)(a) and on no other basis. That consent is asked for on its own, it is not bundled into connecting the watch or into accepting these terms, refusing it leaves the rest of the feature working, and withdrawing it erases the data we already hold (see Section 2.8).

If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local supervisory authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL):

• Website: www.cnil.fr
• Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France

14. Content Moderation and Reporting

NextSet carries messages, posts and comments written by its users, so we have to be able to act when something is abusive. You can report any message, post, comment or person from inside the app and the website. We also run automatic checks on messages for obviously abusive content, which can flag a message for a person to look at.

A person makes the decision. Automated checks only flag content for review; they do not suspend accounts and they do not remove content on their own. You are therefore not subject to a decision based solely on automated processing in this area.

If we restrict your content or your account, we tell you why. Where we remove or restrict access to something you posted, or suspend or restrict your account, we will send you a statement of reasons that explains what was affected, what rule it broke, whether the decision came from a report or from our own checks, whether any automated tool was involved, and how to contest it. You can reply to that notice, or write to contact@nextset.us, and a person will review the decision. If we got it wrong we will reinstate what we removed.

We may decline to act on a report, and we may act without a report. We will not tell you who reported you. Serious cases — in particular anything involving a risk to a child or a credible threat to someone's safety — may be referred to the police or another competent authority, and we may preserve the relevant records for that purpose for longer than the periods in Section 9.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal or regulatory reasons. We will notify you of any material changes by posting the updated policy on this page and updating the "Last Updated" date. We encourage you to review this policy periodically.