Privacy Policy

1. Who is responsible

For a court booking, the venue you book decides why the booking is made, while lapangan.club provides the system and stores the data on the venue's behalf. For venue owner accounts, login, security, and plan billing, lapangan.club is responsible directly.

Privacy questions can be sent to [email protected].

2. Data we collect from players

• The name and WhatsApp number you enter when booking. The number is stored in international format and is never shown in full on public pages.
• Booking details: booking code, venue, court, date and time, amount to pay (including the unique code), status, when you marked it as paid, and any cancellation or reschedule, with the refund amount.
• If you sign in with Google: your Google account ID, email address, and name. We only ask for basic identity (openid and email), not access to your Gmail, contacts, or files.
• Booking as a guest needs no account; the booking is tied only to its booking code.
• A client key: a one-way hash of your IP address mixed with a server secret. We do not store your raw IP address. The key is used only to limit abuse, such as too many held bookings or failed login attempts.

3. Data we collect from venue owners and staff

• Name, phone number (the login name), and password. Passwords and PINs are stored only as argon2id hashes; we cannot read them.
• If you link Google: your Google account ID and email.
• Venue data: name, address, map link, the venue's WhatsApp number, logo, colour and font, facilities, opening hours, prices, cancellation policy, and custom domain.
• The venue's static QRIS data (the QRIS code and merchant name), so players can pay the venue's account directly.
• Your device's push notification subscription (the endpoint and encryption keys from your browser), so we can tell you when a payment needs confirming.
• Plan and subscription expiry information.

4. Business data of prospective venues

To offer our service to venue operators, our team records business information already published on Google Maps or on the venue's website: business name, city, sport, business WhatsApp number, website, address, rating, and internal follow-up notes. This data is used only by the lapangan.club team to contact venue operators. If you want your business removed from this list, email us.

5. What we use data for

The legal bases are carrying out the booking you ask for, your consent (for example when signing in with Google or enabling notifications), our legitimate interest in keeping the service secure, and legal obligations. We do not sell personal data and do not use it for advertising.

• Processing and showing bookings, holding slots briefly, and preventing double bookings.
• Helping venues check QRIS payments and confirm or reject bookings.
• Letting players view, cancel, or reschedule a booking through the booking code or a Google account.
• Sending push notifications to venue owners and a reminder when a payment is still unconfirmed.
• Keeping the service secure: login, limiting sign-in attempts, and preventing abuse.
• Billing the Pro plan, giving support, and fixing errors.

6. Payments

lapangan.club does not receive, hold, or process players' money. Players pay the venue's own QRIS directly. We do not store card numbers, banking PINs, or e-wallet credentials. Any refund is settled between the venue and the player outside the app.

7. Who can see your data

We do not share your data with advertisers or data brokers.

• The venue you book with: your name, WhatsApp number, and booking details, including that venue's owner and staff. A venue cannot see bookings at other venues.
• Authorised lapangan.club staff who run the platform and give support.
• Google, if you choose to sign in with Google. Google handles that data under its own privacy policy.
• An error reporting service (Sentry), which receives server-side error reports. These may contain page addresses and technical traces, and we do not knowingly send personal data in them.
• Your browser's push notification service (for example Google, Apple, or Mozilla), to deliver notifications to venue owners.
• Hosting and infrastructure providers that store data on our behalf.
• Authorities, when the law requires it.

8. Cookies and browser storage

We use only the cookies the service needs to work. We do not use advertising cookies or third-party analytics.

• lc_user: keeps you signed in as a player (Google) at that venue. Only a hash of the token is stored on the server.
• lc_cnonce: lasts 10 minutes and ties the Google sign-in to your browser so it cannot be hijacked.
• lc_session: the venue owner or staff login session, shared across the admin and confirm subdomains.
• lang: remembers your language choice (one year).
• theme (browser local storage): remembers light or dark mode.
• Session cookies are HttpOnly and, in production, Secure.

9. How long we keep data

• Booking data is kept as long as needed for the venue's history, bookkeeping, and resolving disputes, then deleted or anonymised on a valid request.
• Login sessions end automatically at their expiry time. Players and owners can sign out at any time.
• Owner account data is kept while the venue uses the service and deleted after the venue closes its account, unless the law requires us to keep it.
• Failed login records are used only for short-term rate limiting.

10. Security

We protect data with HTTPS, hashed passwords and PINs, session tokens stored only as hashes, limits on sign-in attempts, and separation of access between venues. No system is fully secure; if a personal data breach occurs, we will notify affected people and the authorities as the regulations require.

11. Your rights

Under the PDP Law you may access, correct, and complete your data, ask for its deletion or for limits on how it is processed, withdraw consent, and object to processing. Send your request to [email protected] from the email or phone number you used to book so we can verify you. We aim to reply within 14 working days. Withdrawing consent or asking for deletion may mean some features, such as viewing your booking history, are no longer available.

12. Children

The service is not meant for children under 17 who book without a parent or guardian. If you believe we hold a child's data without permission, contact us and we will delete it.

13. Changes to this policy

We may update this policy. The date of the latest update is at the top of the page. For significant changes we will give reasonable notice, for example on the site or by email to venue owners.

14. Contact us

Email: [email protected]