Privacy
The short version
- Browsing asks nothing of you. We hold personal data only when you give it to us: an email address for the interest list, or a name, address and email when you buy a shirt.
- Payment happens on Stripe’s pages. Your card details never reach our servers, ever.
- Votes are anonymous. They are counted per browser, not per person.
- We set no cookies of our own, run no analytics, and use no advertising or tracking tags.
- A handful of other companies see parts of your visit or your order — each is named below, with what they get.
Who is responsible
Pala & Sfero Padel runs this site and decides what happens to the data described here. Questions, requests, and complaints go to palaandsferomerch@gmail.com.
To be added The legal entity name and postal address of the data controller have not been supplied yet, and are required here before launch. They are deliberately left blank rather than guessed at.
When you register interest in a shirt
A design that is not on sale yet offers a form instead of a buy button. If you submit it, we store exactly four things:
- your email address, lowercased;
- which design you asked about, and its name;
- the time you last submitted the form.
That record lives in a Firestore database on our own Google Cloud project — not in a mailing-list service, and not anywhere it can be cross-referenced with an advertising profile. We do not store your IP address, browser, or referring page alongside it. There is one record per email and design, so submitting the same form twice updates the timestamp rather than adding a second entry.
We use it for one thing: to email you once, when that design is actually buyable. That is the whole purpose, and your submitting the form is the consent it rests on. We do not sell, rent, share, or otherwise pass the list to anyone.
The form also carries a hidden field that only automated bots fill in. If it comes back filled, the submission is discarded and nothing is written at all.
We keep a signup until that design has launched and the email has gone out, or until you ask us to delete it — whichever comes first.
When you vote for a design
The vote button on each card needs some way to tell one voter from another without a login, so your browser generates a random identifier the first time you vote and keeps it in local storage. It is a random value. It is not derived from your email, your device, or anything else about you.
That identifier is sent to us with the design you voted for, and we store:
- the random identifier;
- which design it voted for;
- the time of the vote.
Its only job is to stop one browser voting for the same shirt twice. It is never linked to your email address, even if you also register interest in the same shirt from the same browser. No IP address is stored with a vote.
Because this is per-browser, clearing your site data deletes the identifier and a fresh one is made next time. That makes the tally an honest indication of interest rather than a verified poll, and we would rather say so than pretend otherwise.
What is stored in your browser
No cookies. We set none, which is why you are not being asked to dismiss a cookie banner. If you never vote and never add a shirt to the cart, this site writes nothing to your browser at all.
If you do, these local storage entries are written and stay on your device:
pala-sfero:voter-id— the random identifier described above.pala-sfero:votes— which designs you have already voted for, so the button can show it.pala-sfero:cart— what is in your cart — design, colour, size, quantity. It stays in your browser and is sent to us only when you press Checkout.
Clearing site data for this domain in your browser removes all of them. Note that the Instagram posts embedded on the home page are a separate matter — see below.
Prices and where you are
Pages are pre-built and ship with a default region's prices, then ask our pricing route for the numbers that apply where you are. That request reads a two-letter country code that the hosting network attaches at the edge, or one you have set yourself with a ?country= parameter in the URL.
The code is used to pick a price region for that single response and is then gone. It is not written to a database, not logged by us, and not combined with anything else. We deliberately do not use a third-party geo-IP service, because that would mean handing your address to a company that has no reason to have it. The response is marked private so that it is cached in your browser only, never in a shared cache.
Who else sees your visit
The site itself does not track you, but it does load code and files from other companies, and their servers necessarily see your IP address, your browser’s user agent, and which page requested them. Honestly listed:
- Google Fonts — every page loads one typeface from
fonts.googleapis.comandfonts.gstatic.com. Every other font on the site is served from this domain. Google's handling is covered by theirprivacy policy. - Instagram, part of Meta — the home page, and only the home page, embeds recent posts. That loads a script from
instagram.comand one cross-origin frame per post. Meta receives your IP address, user agent, and the fact that you were on our home page, and can read and write its own cookies and storage in those frames — including recognising you if you are signed in to Instagram. Their terms are in theInstagram privacy policy.Nothing is sent to Instagram from any other page on this site. - Google Cloud (Firebase) — Firebase hosts the site, runs the four routes described above, and holds the Firestore database with the interest list and the votes, all inside our own Google Cloud project. Like any web host it keeps standard server logs, which include IP addresses. Google processes all of it on our instructions as our provider, and does not get to use it for its own purposes. Their handling is covered by theirprivacy policy.
The Instagram, TikTok, and YouTube links in the footer and elsewhere are ordinary links. Nothing is sent to those sites until you click one.
What we do not do
No analytics, of any kind. No advertising pixels, no conversion tracking, no session recording, no heatmaps, no A/B testing tools, no data brokers. We do not build a profile of you, and we do not track you across sites. The only list we hold is the one you asked to be on, and it has one use.
Buying a shirt
Pressing Checkout takes you to a payment page hosted by Stripe, our payment processor. Your name, email, delivery address, and payment details are entered there, on their pages — card details go to Stripe and never touch our servers. Stripe’s handling is covered by theirprivacy policy.
What comes back to us is the order itself: your name, email, delivery address, and what you bought. We keep that order record in our own Firestore database for as long as we need it to handle the order, deal with any claim, and meet bookkeeping obligations.
To print and deliver the order, we pass your name, delivery address, email, and the items to Printful, who produce the shirt and hand it to a carrier. They process that data as our fulfilment provider, under theirprivacy policy. The tracking updates they send us back are attached to your order so we can answer "where is it".
Your rights
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it, and you can withdraw your consent to the interest list at any time. Email palaandsferomerch@gmail.com and we will act on it.
Since an interest signup is an email address and a shirt name, the only sensible way for us to check that a request is really yours is for it to come from the address in question — so please write from it, or tell us which address to look up. A vote cannot be looked up or deleted on request, because nothing connects the random identifier to you; clearing your browser storage is the equivalent, and it is entirely in your hands.
If you are in the UK or the EU, the GDPR gives you these rights and the right to complain to your national data protection authority.
Children
This site is not directed at children and we do not knowingly collect anything from anyone under 16. If a child has registered interest, email us and we will delete the record.
Changes to this policy
This page describes what the site does today. If what it does changes, this page changes at the same time, and the date at the top moves with it.