Privacy Policy

This Privacy Policy explains how Sword Tech Labs LLC, which operates playdesk ("playdesk", "we", "us", "our"), collects, uses, shares, and protects personal information when you visit this website, start a free trial, or use the playdesk venue management platform (together, the "Service").

Sword Tech Labs LLC is the data controller for the personal information described in this policy, except for venue customer data, where we act as a processor (see Section 6). You can reach us about anything in this policy at [email protected].

• Website visitors: anyone browsing this marketing site.
• Account holders: venue owners, managers, and staff who sign up for or use playdesk.
• Venue customers: people who book a table, court, lane, pod, room, or station at a venue that uses playdesk. The venue decides how your data is used; see Section 6.

Information you give us:

• Account details: your name, email address, phone number, venue name, and role.
• Billing details: billing address, tax information, and subscription history. Card details are collected and stored by our payment processor; we never see or store full card numbers.
• Platform data: the bookings, spaces, sessions, POS transactions (including KOT and KDS routing), wallet and credit balances, staff records, and customer records you or your staff enter.
• Communications: messages you send us by email, WhatsApp, or in-app support, and details you provide when booking a demo.

Information collected automatically:

• Platform logs: sign-in times, IP address, device and browser information, and actions taken in your account, used to keep the Service secure and working.
• Website analytics: pages visited, referring site, approximate location, and device type, collected through Google Analytics only if you accept analytics cookies. See our Cookie Policy.

Where data protection laws such as the GDPR or UK GDPR apply, we rely on the following legal bases:

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only with:

• Service providers (sub-processors): cloud hosting, payment processing, email and WhatsApp messaging, customer support, and analytics providers who process data on our instructions under written data protection terms. A current list is available on request.
• Your venue's team: people you invite to your account can see the data their role permits.
• Authorities: law enforcement, regulators, or courts, where we're legally required to or need to protect rights and safety.
• A successor: a buyer or successor entity in a merger, acquisition, or sale of assets, subject to this policy, with notice to affected customers.

When a venue uses playdesk to take bookings, run POS, or manage customer accounts, it may enter personal data about its own customers, such as a name and phone number to hold a booking, or a wallet balance. For that data, the venue is the controller and playdesk is its processor: we handle it only to provide the Service to the venue and in line with its instructions.

Venues are responsible for having a lawful basis for the data they enter and for giving their customers any required privacy notice. A data processing agreement is available to venues on request.

If you're a venue customer and want to access, correct, or delete your information, please contact the venue directly. If you contact us instead, we'll pass your request to the venue and help them respond.

playdesk serves venues in many countries, so your information may be processed outside the country where you live, including in the United States. When we transfer personal data out of the EEA, UK, or Switzerland, we use recognized safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

• Account and platform data: for as long as your account is active. After you close your account, you have 30 days to export your data; we then delete or anonymize it within 90 days, apart from any backups, which are overwritten on a rolling basis.
• Billing and tax records: for as long as tax and accounting laws require, typically up to 7 years.
• Support communications: for up to 3 years after the conversation ends.
• Analytics data: up to 14 months in Google Analytics.

We may keep information longer where needed to resolve disputes, enforce our agreements, or comply with law.

We use technical and organizational safeguards appropriate to the data we handle, including encryption in transit, role-based access controls, restricted and logged access to production systems, and regular review of our security practices. Staff and sub-processors with access to personal data are bound by confidentiality obligations.

No system is completely secure. Please use a strong, unique password and give staff accounts only the permissions they need. If a breach affects your personal data, we'll notify you and the relevant authorities where the law requires.

Depending on where you live, you may have the right to:

• Access: get a copy of the personal information we hold about you.
• Correction: fix information that's inaccurate or incomplete.
• Deletion: ask us to delete your information, subject to records we must keep.
• Portability: receive your data in a structured, machine-readable format.
• Objection and restriction: object to processing based on legitimate interests, or ask us to limit how we use your data.
• Withdraw consent: where we rely on consent, such as for analytics cookies, withdraw it at any time without affecting earlier processing.

To exercise any of these rights, email [email protected]. We'll respond within 30 days (or sooner if local law requires) and may need to verify your identity first. We won't treat you differently for exercising your rights.

If you're in the EEA, UK, or Switzerland and are unhappy with how we've handled your data, you can complain to your local data protection authority. We'd appreciate the chance to put it right first, though.

Residents of California and other US states with comprehensive privacy laws may have the rights described in Section 10, as well as the right to know the categories of personal information we collect (listed in Section 3), the purposes we use it for (Section 4), and the categories of recipients (Section 5).

We do not sell personal information or share it for targeted advertising, and we don't knowingly do so for anyone under 16. We don't use or disclose sensitive personal information for purposes that would require offering a right to limit it.

playdesk is a business tool and isn't directed at children. We don't knowingly collect personal information from children under 16. Venues are responsible for any data about minors they choose to enter, such as a junior member's booking. If you believe a child has given us personal information directly, contact us and we'll delete it.

We may update this Privacy Policy as the Service or the law changes. The date at the top shows when it last changed. If a change is material, we'll tell active customers by email or in the platform before it takes effect.

Questions, requests, or complaints about this policy or your data can be sent to [email protected].