Privacy Policy

This Privacy Policy explains how DrillBase (“DrillBase”, “we”, “us”) collects, uses, shares, and protects personal data when you use our pickleball coaching platform. DrillBase serves coaches and players around the world, and we hold ourselves to a high, international standard of privacy. We aim to comply with the major data-protection frameworks that may apply to our users, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the Personal Data Protection Acts of Thailand and Malaysia (PDPA), as well as widely recognised privacy best practices.

This document is provided for transparency and is not legal advice. Before relying on it, we recommend a qualified privacy lawyer reviews it against your final data practices and the laws of the markets you serve.

1. Who we are

DrillBase is the data controller (or “business”, under applicable laws) for the personal data described below. For privacy questions or to exercise your rights, contact us at privacy@drillbase.co.

2. What data we collect

• Account & identity: your name and email address; your role (coach, player/student, or academy admin).
• Coaching & progress data: drill logs, session history, goals, DUPR rating, and program enrolment.
• Payment records: invoices and the payment slips you upload as proof of payment. DrillBase records these only — we do not process card or bank transactions.
• Communications:drill notes, Q&A threads, and messages exchanged between coaches and players.
• Technical data: log data, device/browser information, and product-usage analytics collected automatically when you use the app.

3. How we use your data

• To operate the coaching platform and your account.
• To track training progress and surface schedules, programs, and stats.
• To let coaches manage their roster, record invoices, and review uploaded payment slips.
• To send transactional email (sign-in links and welcome emails).
• To diagnose errors, keep the service secure, and improve the product.

4. Legal bases & consent

Where a legal basis is required (for example under the GDPR or the Thailand/Malaysia PDPA), we rely on one or more of the following: your consent; performance of our contract with you (providing the service you signed up for); compliance with a legal obligation; and our legitimate interests in securing and improving the platform, balanced against your rights. Where we rely on consent, you may withdraw it at any time (see Section 6); withdrawal does not affect processing already carried out.

5. Who we share data with

We do not sell your personal data. We share it with the service providers (processors) below, only as needed to run DrillBase:

• Supabase — database, authentication, and file storage (your account, coaching data, and uploaded payment slips).
• Resend — sending transactional email (sign-in and welcome messages).
• PostHog — product analytics to understand and improve how the app is used.
• Sentry — error monitoring to detect and fix bugs.

We also share data between a coach and their linked players as necessary for coaching (e.g. a coach can see their player’s drill logs and invoices).

6. International data transfers

DrillBase operates globally, and our providers may process data in countries other than your own. Where we transfer personal data across borders, we use appropriate safeguards required by applicable law — such as the European Commission’s Standard Contractual Clauses for transfers out of the EU/EEA/UK, and equivalent mechanisms for transfers governed by other frameworks — to ensure your data remains protected.

7. Your rights

Subject to your local law, you generally have the right to:

• Access your personal data and request a copy.
• Rectify inaccurate or incomplete data.
• Request erasure or de-identification of your data.
• Restrict or object to certain processing.
• Request data portability.
• Withdraw consent where processing is based on consent.

To exercise any of these, email privacy@drillbase.co. We will respond within the timeframes required by the law that applies to you, and we will not discriminate against you for exercising your rights.

8. Additional rights by region

Depending on where you live, you may have additional rights under local law:

• European Union / EEA / UK (GDPR & UK GDPR): the rights above as data-subject rights, the right to object to processing based on legitimate interests, and the right to lodge a complaint with your national data-protection authority.
• California, USA (CCPA/CPRA):the right to know what personal information we collect and how it is used and shared, the right to delete and to correct it, and the right to opt out of any “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under the CCPA.
• Thailand & Malaysia (PDPA):data-subject rights including access, correction, erasure, restriction, objection, and data portability, the right to withdraw consent, and the right to lodge a complaint with the relevant national authority (e.g. Thailand’s Personal Data Protection Committee).

9. Data retention

We keep your personal data for as long as your account is active and as needed to provide the service. If you close your account, we will delete or de-identify your data within a reasonable period, except where we must retain certain records (e.g. invoices) to comply with legal, accounting, or tax obligations.

10. Security

We use industry-standard measures to protect your data, including encrypted connections, access controls, and row-level security so that users can only access data they are authorised to see. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of any breach as required by applicable law.

11. Children

DrillBase is intended for use by coaches and their players. Where a minor uses the platform, a parent or guardian should provide consent and supervise that use in line with the laws applicable to them.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above. Material changes will be communicated where appropriate.

13. Contact

Questions about this policy or your data? Email privacy@drillbase.co.