Privacy Policy

Last updated 2 August 2026

This explains what personal data BookMyPitch collects, why, and your rights over it.

1. Who we are

BookMyPitch is the data controller for the personal data described below. BookMyPitch is operated by Mohammed Rahman Masud, trading as a sole trader based in London. Contact us about privacy at masud@bookmypitch.uk.

We are not yet registered with the Information Commissioner's Office (ICO). BookMyPitch currently has no live venues and is not processing any real player or venue data. We will complete ICO registration before the first venue goes live and add the registration number here at that point.

2. What we collect

  • Account details: name, email address, and (for guest players) a phone number.
  • Payment details: handled entirely by our payment processor, Stripe. We never see or store your full card number; Stripe gives us a reference token (a payment method ID) so we can request an authorisation or charge, and a masked/summary description of the card.
  • Booking activity: games you've joined or organised, messages sent within a game's chat.
  • Technical data: IP address (used to rate-limit abuse of signup/booking endpoints), and error/crash reports via Sentry, our error-monitoring provider.
  • Venue owner details: for venue owners, your venue's name and address, and (via Stripe Connect) identity verification and bank account details handled directly by Stripe. We never see your bank details.

3. Why we collect it

We use your data to:

  • Coordinate group bookings and confirm games (contractual necessity: we can't run the service without this).
  • Process payments and payouts via Stripe (contractual necessity).
  • Send booking-related notifications (game confirmed, cancelled, a spot freed up, etc).
  • Prevent abuse and fraud, e.g. rate-limiting repeated signup or payment attempts (legitimate interest).
  • Diagnose and fix errors via Sentry crash reports (legitimate interest).

We do not sell your data, and we do not use it for advertising or marketing profiling.

4. Who we share it with

  • Stripe: processes all payments and (for venue owners) payouts. Stripe is its own independent data controller for the payment data it handles; see Stripe's own privacy policy.
  • Supabase: hosts our database and handles account authentication.
  • Sentry: receives error/crash reports to help us fix bugs; these can include technical context but not your payment details.
  • Other players in a game you join can see your name (and phone number, if you joined as a guest) as part of the game roster, which is necessary for group coordination.

We don't share your data with anyone else, including for marketing purposes.

5. How long we keep it

We keep account and booking data for as long as your account is active, and for up to 6 years afterward, in line with HMRC's record-keeping requirements for financial and accounting records. You can ask us to delete your account at any time (see your rights below), though we may need to retain limited transaction records for that period regardless, to meet our legal obligations.

6. Cookies and local storage

We only use cookies and browser storage that are necessary to run the service. We don't use any advertising, analytics, or cross-site tracking cookies, and we never sell or profile your browsing activity.

  • Sign-in cookies (set by Supabase, our authentication provider): keep you logged in between visits.
  • Payment cookies (set by Stripe when you enter card details): required by Stripe to detect card fraud during checkout. We don't control these directly; see Stripe's own cookie policy.
  • Local storage (kept in your browser, not sent to us as a cookie): if you book as a guest without an account, we store your name/phone and which games you've joined locally on your device so you can find “My Bookings” again without logging in, and it expires automatically after 7 days. If you're part-way through listing a venue, we also save your form progress locally so a closed tab doesn't lose your work.

Because none of these are used for advertising, analytics, or tracking, none require your consent under UK law, but we're telling you about them anyway. You can clear cookies/local storage at any time via your browser settings, though sign-in and guest-booking features won't work properly until you sign back in or rejoin.

7. Your rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Ask us to correct inaccurate data.
  • Ask us to delete your data (“right to be forgotten”), subject to any legal retention requirements.
  • Object to or restrict certain processing.
  • Request a portable copy of your data.
  • Complain to the UK Information Commissioner's Office (ICO) if you think we've mishandled your data: ico.org.uk.

To exercise any of these, email masud@bookmypitch.uk.

8. Children

BookMyPitch accounts and payment methods are for users aged 18 and over. We don't knowingly collect data from children.

9. Changes to this policy

We may update this policy from time to time; material changes will be flagged on this page with an updated date at the top.