Privacy policy
Last updated: 11 August 2026
This policy explains what personal data lisbon-tennis.com (“LisbonTennis”, “we”) collects, why we collect it and what rights you have. The data controller is Lachezar Gadzhev, Sofia, Bulgaria, who operates the site as a personal project — you can reach us at lachezar.gadzhev@gmail.com.
What data we collect
- Profile — email address, name, playing level, dominant hand, districts, a short description. Your password, if you set one, is stored only as a salted PBKDF2 hash — you can also sign in with a one-time code sent by email.
- Optional profile data — profile photo, age, gender, years of experience, preferred surface and phone number. All of these are optional and you can delete them at any time from your profile. Your profile photo, if you upload one, is public. Your phone number is hidden by default. It becomes visible to other logged-in players only if you turn on "show my phone to logged-in players" in your settings, and turning it back off hides it again immediately.
- Content — the listings you post and the messages you exchange with other players.
- Technical data — IP address and browser data on requests to the site (for security and abuse prevention), plus when you last used the site.
- Aggregate usage statistics — how many times each page was opened, from what kind of device and where the visit came from, summed up by day. No cookie is involved and nothing is stored on your device for this. The daily visitor count comes from a hash of IP address and browser that has the date built into it, so it changes every midnight and cannot be used to follow anyone from one day to the next.
- Cookies — see the “Cookies” section below.
What we use the data for
- To run the service — profile, listings and messages between players (performance of a contract).
- Email notifications — login codes and notifications about unread messages (performance of a contract / legitimate interest).
- Security — bot and abuse protection via Cloudflare Turnstile (legitimate interest).
- Improving the site — aggregate usage statistics, kept to ourselves and never shared (legitimate interest).
- Audience measurement — Google Analytics 4, only with your explicit consent. We record which pages are opened and which actions are completed (a listing posted, a message sent), never who did them: no name, email or account id is sent to Google.
- Measurement and advertising — Meta Pixel and Meta Conversions API, only with your explicit consent.
Who we share data with
We do not sell your personal data. We use the following service providers:
- Cloudflare — hosting, database, profile photo storage and bot protection.
- Resend — sending login and notification emails.
- Meta Platforms — advertising measurement (Pixel and Conversions API), only with consent. We send a hashed email address, IP address and browser data so ad performance can be measured.
- Google — audience measurement (Google Analytics 4), only with consent. Pages viewed, actions completed and IP-derived approximate location go there; your account is not identified to Google.
- Google Fonts — loading the site’s fonts (your browser makes a technical request to Google).
Transfers outside the EU
Some of the providers above are based in the United States and process data there. Where that happens, the transfer rests either on the EU–US Data Privacy Framework — which the European Commission has decided provides an adequate level of protection — or on the Commission’s standard contractual clauses. Nothing you write on this site is sold or handed to anyone outside the list above.
Cookies
- st_session — essential cookie for signing in to your account (up to 30 days).
- st_lang — remembers your chosen interface language (up to 1 year).
- st_theme — remembers the light or dark theme (up to 1 year).
- st_consent — stores your cookie choices (up to 1 year). Set by us, not by a third party.
- _ga, _ga_LCGLC0ZN49 (Google) — audience measurement, set only with consent (up to 2 years).
- _fbp, _fbc (Meta) and _fbcl (ours) — advertising and measurement, set only with consent.
You can change your choice at any time via “” at the bottom of the site.
How long we keep data
- Profile, listings and messages — for as long as your account exists. If you want them deleted, write to us.
- Login sessions — up to 30 days.
- Email login links — valid for 30 minutes.
Children
You need to be at least 13 to have an account here. Below that age the GDPR requires a parent’s consent, which a site like this has no reliable way to obtain, so we do not accept those registrations. If you believe someone younger has an account, write to us and we will delete it.
Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, portability and objection. To exercise them, write to us at lachezar.gadzhev@gmail.com. You also have the right to lodge a complaint with a supervisory authority — the Portuguese National Data Protection Commission (cnpd.pt), or the Bulgarian Commission for Personal Data Protection (cpdp.bg), where we are established.
Changes
If we make material changes we will update this page and the date at the top of it.