Privacy Policy
18 September 2026
Who we are
Ludi is a football pitch booking marketplace operated in Cyprus by Nikolas Neofytou (sole trader). We are the data controller for the personal data described below.
What we collect
- Name, and phone number or email address
- City, optional handle, skill level, playing positions, preferred foot
- Booking history — pitches, timestamps, totals
- Payment references (Stripe customer ID and PaymentIntent IDs). We never see or store your full card number — that is handled entirely by Stripe.
- IP address, retained by our infrastructure and payment providers for fraud analysis
Why we process it, and on what legal basis
- Contract performance — creating your account, processing bookings and payments, and communicating with you about them. This is necessary to provide the service.
- Consent — marketing messages and product-usage analytics. You opt in explicitly and can withdraw consent at any time in the app; analytics stop collecting data on revocation.
Who else processes your data
We share data only with these processors, each bound by a data processing agreement, and we do not sell your data to anyone, ever:
- Supabase — database, authentication, file storage (EU region)
- Stripe — payment processing and payouts to pitch owners
- Sentry — error monitoring (no personal data beyond an opaque user id)
- PostHog (EU) — product analytics, consent-gated, no personal data in event properties
- Resend — transactional email (booking confirmations)
- Vercel — hosting for this website and the venue dashboard (may process data in the United States)
- GitHub — storage for our encrypted database backups, kept for up to 90 days (United States)
Where your data lives
Our primary database and file storage run in the EU (Frankfurt), chosen for GDPR proximity. Some processors above operate their own EU regions independently.
Where a processor handles data outside the European Economic Area — the venue dashboard's servers and our encrypted backups can be in the United States — the transfer is covered by the safeguards of Chapter V of the GDPR: an adequacy decision or the European Commission's standard data protection clauses.
If you booked a venue directly
Venues that use Ludi can record the bookings they take by phone or at the counter, and keep a list of their regular customers — a name and a phone number — in their Ludi dashboard. For those records the venue is the data controller and Ludi only stores them on the venue's behalf, under a written data processing agreement with the venue.
We do not use that list for our own purposes: we do not contact you, market to you, match you to a Ludi account, or show your details to any other venue. When a venue leaves Ludi we delete its list within 30 days.
To see, correct or delete what a venue holds about you, ask the venue — or email nikiforialicht@gmail.com and we will pass your request on and help the venue answer it.
How long we keep it
- Profile data — until you request deletion, or after 3 years of inactivity
- Bookings, payments, and admin records — 7 years, per Cyprus tax record-keeping law
- Product analytics (PostHog) — 1 year
Your rights
Under GDPR, you can:
- Access your data — view it in-app, or request a full export
- Correct it — edit your profile directly in the app
- Delete it — request anonymization; we retain only the financial records the law requires us to keep, with all directly identifying fields removed
- Export it in a portable format
- Object to or restrict certain processing — contact us below
Contact
For any privacy question or to exercise your rights, email nikiforialicht@gmail.com. We aim to acknowledge requests within 72 hours.