Privacy Policy

This Privacy Policy explains how HyperSprouts ("we", "us") collects, uses, stores and protects personal data when you use our platform to discover and book children's clubs, sports and activities in the Kingdom of Saudi Arabia. This policy is written to align with the principles of the Saudi Personal Data Protection Law (PDPL) issued by the Saudi Data & AI Authority (SDAIA) and its Implementing Regulation.

1. Who We Are (Data Controller)

HyperSprouts acts as the data controller for personal data collected through this platform. For any questions or requests regarding your personal data, contact us at support@playpass.sa or +966 507074192.

2. What Data We Collect

• Account data: name, email address, phone number, and — for club and administrator accounts — a password, stored as a one-way hash and never in plain text. Parents sign in with a one-time code sent to their mobile number and have no password.
• Child data (provided by a parent or guardian): the child's name, date of birth, and any notes you choose to share, such as allergies, so a club can safely run a session.
• Booking data: which activities and sessions you book, the booking status, and what is owed. HyperSprouts does not collect payment: you pay the club at the venue, so we hold no card numbers of any kind.
• Club data (for club accounts): business name, description, address, contact details, and the activities, schedules and pricing you publish.
• Usage data: basic technical data such as the session cookie required to keep you signed in.

3. Why We Process Your Data (Purpose & Legal Basis)

• To create and manage your account and authenticate you when you sign in.
• To let you search for and book children's activities, and to let clubs manage and fulfil those bookings.
• To communicate with you about your bookings — confirmations, reminders and changes.
• To maintain accurate booking and financial records as required by law.
• To keep the platform secure and prevent fraud or misuse.

Our processing is based on your consent, given when you create an account, and on what is necessary to perform our service to you — fulfilling a booking you requested.

4. Children's Data

HyperSprouts is used by parents and guardians on behalf of their children — children do not create their own accounts. By adding a child profile, you confirm you are that child's parent or legal guardian and consent, on the child's behalf, to the processing described in this policy for the sole purpose of booking and delivering activities.

5. Who We Share Data With

• Clubs you book with receive the booking and child details necessary to run the class: the child's name, age, any notes you shared, and your contact details.
• Service providers we rely on to run the platform, currently our hosting provider and our database provider. These providers process data strictly on our instructions to operate the service.
• We do not sell personal data to third parties, and we do not use it for third-party advertising.

6. International Data Transfers

Our database is currently hosted with our infrastructure provider in the European Union. This means your personal data may be processed and stored outside the Kingdom of Saudi Arabia. Our provider maintains industry-standard technical and organizational security measures. We are evaluating Saudi-based or regionally approved hosting to reduce cross-border transfer as the platform grows. If you have questions about this, contact us using the details in Section 1.

7. Data Retention

We keep your account data for as long as your account is active. If you delete your account, we anonymize your personal identifiers immediately; records of completed bookings tied to a club may be retained in anonymized form where a club or HyperSprouts has a legitimate legal, financial or accounting obligation to keep them. Records of consents and agreements you accepted are kept as evidence of what was agreed and when, and are not rewritten after the fact.

8. Your Rights

Under the PDPL, you have the right to:

• Be informed about how your data is collected and used — this policy.
• Access the personal data we hold about you.
• Request correction of inaccurate data, which you can edit directly in your account.
• Request destruction of your personal data, subject to the legitimate retention needs described in Section 7.
• Withdraw your consent at any time.
• Lodge a complaint with the Saudi Data & AI Authority (SDAIA) if you believe your rights have been violated.

You can access, export or delete your data directly from your Account page, or contact us for assistance.

9. Security

We use encryption in transit (HTTPS) for all traffic, one-way hashing for passwords, and role-based access controls so that parents, clubs and administrators can only reach data relevant to their role.

10. Changes to This Policy

We may update this policy from time to time. Material changes are reflected by updating the date at the top of this page.

11. Contact Us

Questions about this policy, or about the data we hold on you? Contact us at support@playpass.sa or +966 507074192. Our Terms of Service set out the rest of the agreement between us.