This Privacy Policy (version 1.0, effective February 16, 2026) describes how StringLab Tecnologia Ltda ('StringLab', 'we', 'our') collects, uses, stores, and protects your personal information when you use our tennis racket stringing management platform. We are committed to protecting your privacy and complying with Brazil's General Data Protection Law (LGPD - Law 13.709/2018), the European Union's General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA).
Data Controller:
StringLab Tecnologia Ltda
Brazil
We collect different types of information depending on how you use our services:
| Category | Data Collected | Purpose |
|---|---|---|
| Account Data | Name, email, password (cryptographic hash), profile photo (URL), account type (player/shop), email verification date | Account creation and management, authentication |
| Racket and Setup Data | Brand, model, technical specifications (weight, balance, stiffness), serial number, nickname, strings used, tension, stringing history, performance feedback (power, control, comfort, spin), QR code token | Provide core service: history, versioning, and setup recommendations |
| Usage and Technical Data | IP address, browser type, user agent, pages visited, access times, error events (via Sentry), push notification data (endpoint, public keys) | Improve service, detect issues, ensure security, deliver push notifications |
| Payment Data | Stripe customer ID, subscription and invoice IDs, payment status, invoice URLs. We do not store credit card data - it is processed directly by Stripe | Process subscriptions, payments, and invoice generation |
We use your data to:
We process your data based on:
We retain your data according to the specific periods indicated in Section 2 for each category. In summary: account data is kept while the account is active; tax and payment data for 5 years per tax law; technical logs for 90 days; consent records for 5 years after revocation. Accounts inactive for more than 3 years will be notified, and if no response within 30 days, deleted. You can request account deletion at any time through settings or by contacting our DPO. Deletion follows the 30-day grace period process described in our Terms of Service.
You have the following rights regarding your personal data, guaranteed by LGPD and GDPR:
We share data with third parties only when necessary to operate our service. We do not sell your data. Third parties include:
Your data is stored on servers in Brazil. Some third-party services (Stripe, Sentry, Google, Cloudflare, Resend) may process data in the United States and other countries. These transfers are protected by: Standard Contractual Clauses (SCCs) approved by the European Commission; adequacy certifications where available; third-party privacy policies that meet LGPD and GDPR requirements. You may obtain copies of transfer safeguards by contacting our DPO.
Our services are not directed to children under 16 in the European Union (per GDPR Art. 8) or under 13 in other jurisdictions. We do not knowingly collect data from minors. If you are a parent or guardian and believe your child has provided data without parental consent, contact us at [email protected] so we can delete the data.
We may update this Privacy Policy periodically. We will notify you of significant changes by email or site notice at least 30 days in advance. The current version and version number are at the top of this document. Changes requiring new consent will only apply after your acceptance.
To exercise your rights, ask questions, or make privacy complaints, contact us:
Email: [email protected]
Data Protection Officer (DPO): [email protected]