Privacy Policy

Version 2026-11-10.6 — effective 13 November 2026. Applies to the XSport app and getxsport.com.

1. Who we are and how to reach us

XSport is a platform for discovering sports venues in the UAE and booking their services. It is operated by DEPORTIVO GENERAL TRADING - L.L.C - S.P.C, licensed in the Emirate of Abu Dhabi under commercial licence No. CN-5420448 issued by the Department of Economic Development – Abu Dhabi, with its address at Abu Dhabi, United Arab Emirates. For any question about your data, to exercise your rights or to make a complaint, write to support@getxsport.com, use "My account → Contact us" in the app, or use the support page of the website.

XSport is the controller responsible for your data on the platform. The venue you buy a service from is its provider and the party to its contract; it receives from us what is needed to deliver it (section 5) and is responsible, as an independent controller, for its own processing of what it receives.

2. What we collect

We collect the minimum the service needs:

• Sign-in data: your email address (a six-digit code is sent to it), or the identifier of your Google or Apple account together with the name and email that account shares with us. We do not ask for a phone number or a password to sign in.
• Account data: your name (required at your first booking; the venue sees it when you check in) and a contact number; you may also add an email, gender and preferred area from the "My details" page, all optional.
• Contact number: asked once at your first booking. It is not verified (we do not confirm it with a code) and is never passed to the venue. We use it only to contact you about your booking, and never for marketing unless you consent to a text that names that channel explicitly.
• Booking and attendance data: venue, offer and time, booking status, check-in, and the outcome of the visit as reported by the venue and as you confirm it in the follow-ups after the visit.
• Payment and transaction data: the amount, the package, the payment reference, the receipt and any refund. Your card details never reach us; the payment provider processes them.
• Technical data at payment: the payment provider collects technical data directly from your device (such as network address and device type) to verify the transaction and prevent fraud.
• Membership data: the status and term of your membership, the status of your membership card and the visits recorded with it.
• Venue contract acceptance record: the version of the venue's contract you accepted before paying, and when.
• Data about a minor booked for by their guardian: the minor's name and age group — only the minimum needed for the booking.
• Device data for notifications: the push token, device type, notification permission status and language, when you allow notifications.
• Consent records: the version of the text you agreed to, its language, its source and the time of consent or withdrawal, for marketing messages. Your usage-measurement choice (allow or don't allow) is saved on your device only, and we keep no record of it on our servers.
• Pseudonymous usage events, only after you consent: viewing the venue list or a venue, starting, completing and cancelling a booking, opening the app, viewing public website pages and tapping the store button. They are sent under a random installation identifier that is not linked to your name, email or number, and carry no location.
• Crash reports: when the app or website fails, we receive a technical report (device type, operating system, app version and where the failure occurred), without your name, email or number.
• Ratings and saved venues: your one-to-five-star rating of a venue you actually attended — one rating per venue, of which the venue and the public see only the average once it reaches five ratings, without your name; and the venues you save to come back to — the venue does not see them, we do not use them for messages, and they are deleted with your account.
• Age confirmation: your confirmation that you are 18 or older, with its time and the version of its text.
• Invitations ("Invite a friend"): your invite code, which accounts joined with it — we do not show you their names — and the coupons issued to you and their use.
• Alert requests: the venues where you registered interest in booking, and the full time slots you asked us to alert you about if a spot opens — so that we send the alert once; the venue does not see them under your name, and they are deleted with your account.
• Support and account-deletion requests: what you write to us through "Contact us" (category, subject and details), your message number, its status and our reply; when you request deletion from the website we keep a one-way hashed fingerprint of your email and network address for rate limiting only.
• Wallet pass: if you add your pass or membership card to your phone's wallet, your name (or the minor's name) and the booking details are stored in it on your device.

We do not ask you for your sports interests or for health data — so do not write health details in your messages to us unless your request needs them — we do not store payment card data, and we do not record your screen or taps.

3. Why we collect it, and the legal basis

We process your data under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, on these bases:

• Performing our contract with you: creating the account, booking, the entry pass, the visit reminder, following up the visit outcome, support, handling refunds and payment disputes, rate limiting, preventing abuse and fraud, diagnosing failures, and platform security.
• Your consent: location permission, notification permission, marketing messages and pseudonymous usage measurement. We run usage measurement only if you agree when we ask you. You can withdraw any consent at any time without affecting your booking.
• Our legal obligations: required tax and commercial records, and requests from the competent authorities.

We do not use your data for any purpose other than those stated here, and we do not sell or rent it to anyone.

4. Location

Your location is used while you use the app only to sort venues by distance and show them on the map. We do not store it on our servers, we do not track it in the background, and the website never sends it. Declining location permission does not stop you from browsing or booking.

The map in the app is displayed by the maps service of your device's system: Apple Maps on iPhone and Google Maps on Android. To load the map, its provider receives directly from your device the network address and the area the map is showing, which may indicate your approximate location if it is around you, and processes them independently under its own policy. We do not send it your name, email, number or bookings. When you tap "Directions", the maps app on your device opens and receives only the venue's location. The map on the website home page is a static drawing that we host ourselves; it is not loaded from a map provider.

5. What the venue (partner) sees

A venue sees its own bookings only: your name (and, if you booked for a minor, the minor's name and your name as guardian), the offer type, the time, attendance status, the visit outcome, and the status of your membership card with that venue and the visits recorded with it. It does not see your phone number, your email or your bookings at other venues.

Because we issue the receipt or invoice on the venue's behalf, we keep a copy for the period required by tax and commercial law, and share with the venue the transaction data needed for its records and tax returns (document number, date, amount and tax), without your phone number or email.

6. Notifications and messages

• Service messages: the sign-in code and the account-deletion code reach you by email from the support address, and when our team replies to your "Contact us" message you get an email about it at your account email. The visit reminder is a local notification scheduled on your device and does not pass through our servers.
• Service notifications: if you allow notifications, we send to your device, through our servers and the notification provider, only what concerns your bookings, membership and requests: the venue changing or cancelling your booking, your membership being extended for a temporary closure, booking opening at a venue you registered interest in, a slot you waited for becoming available, and our team's reply to your message. These notifications need no marketing consent and carry no offers; the lock screen shows your message number, not its text or the reply.
• Marketing messages: we send offers only if you separately agree to marketing messages under "My account → Offers and messages". The box is off by default and withdrawal from the same place takes effect immediately. Our marketing channels are app notifications (which also need operating-system notification permission) and email only, and every marketing email carries a one-click unsubscribe link that needs no sign-in, withdraws your marketing consent at once and records the withdrawal with its time; service messages (codes, bookings, cancellations, refunds and support replies) do not carry it. We do not send WhatsApp or SMS messages or make marketing calls; if we add a new channel, we will ask for your consent to it again. We cap the number of marketing campaigns any user receives in a given period.

7. Retention

• Account and booking data: for as long as your account exists.
• Consent records: deleted with the account.
• Internal notes the XSport team keeps on your account: deleted with the account.
• Your "Contact us" messages and our replies: deleted with the account.
• Push tokens: deleted when you revoke permission or sign out; tokens of inactive devices are pruned periodically.
• Marketing campaign delivery logs: 30 days after the campaign ends; aggregate counts without identity are kept for 12 months.
• Account-deletion codes: valid for 10 minutes and removed within an hour; rate-limit fingerprints within 24 hours.
• After account deletion: operational records required by law are kept in anonymised form. Receipts, transaction records and accounting records — which may carry your name and the payment reference — are kept for the period required by the tax and commercial laws in force, which is at least five years, and are then deleted or anonymised.

8. Deletion and your rights

You can delete your account from inside the app ("My account → Delete account") or from the deletion page on the website with a code sent to your email, without signing in. On deletion, your upcoming bookings are cancelled and anything owed a refund from them or your memberships is refunded (section 14 of the Terms of Use), your session, profile and personal data are deleted, and required operational records remain anonymised, including the record of an ended membership and an undecided refund request, without your name.

You also have the right to access your data and obtain a copy, correct it from "My details", request its erasure, restrict or object to its processing, stop its use for direct marketing, withdraw any consent you gave, and receive your data in a machine-readable format on request. Exercising these rights is free of charge. We reply to your request within 30 days of receiving it, and you may complain to the competent personal data protection authority in the UAE (the UAE Data Office or the body that assumes its functions) if we do not resolve your request.

Automated decisions. The system takes some decisions automatically: suspending your ability to book after three consecutive no-shows (section 6 of the Terms), automatic refunds when their conditions are met (section 9 of the Terms), declining a payment or requesting extra verification (3D Secure) based on the payment provider's fraud screening, and temporarily pausing new paid bookings when you report a transaction you did not make or open a dispute with your bank. You may ask for a member of our staff to review any of these decisions from "My account → Contact us" or at support@getxsport.com.

9. Service providers and data transfers

Service providers that process data on our behalf and for our purposes, under each provider's data-processing terms, which oblige it to protect the data:

• Supabase: database, authentication and backend functions (servers in the AWS Asia Pacific region, Mumbai, India).
• Vercel (United States): website hosting.
• Resend (United States): sending service emails, and marketing emails to those who consented.
• Sentry (servers in the European Union, Germany): app and website error monitoring, without your name, email or number. The company is headquartered in the United States.
• Cloudflare (United States): domain management, and verifying that a request is not sent by an automated program (Turnstile).
• Expo (United States): delivering notifications to your device through Apple and Google services.
• PostHog (European Union): measuring pseudonymous usage events on servers in the European Union, only after you consent, with no session recording, no person profiles and no location from the network address.

Recipients that receive data and process it in their own independent capacity under their own policies:

• Stripe (Ireland and the United States): processing payments, refunds and disputes, preventing fraud and meeting its legal obligations, in the locations described in its documentation. To handle payment disputes and prevent fraud, we share the booking, attendance and device data for the transaction with Stripe, the bank that issued your card and the card network.
• Apple and Google (United States): if you choose to sign in with your account with them, when notifications are delivered to your device, when you add your pass to the wallet, and when the map is shown in the app or you open directions (section 4).
• The venue you book with: as set out in section 5.
• The competent government and judicial authorities: where the law requires us.

The location in brackets is each provider's headquarters, or the location of its servers where stated; a provider may process data in other locations set out in its own documentation.

This means some of your data is stored or processed outside the UAE, and some of those countries may not offer the same level of protection. We transfer what is needed to run the service (account, booking, payment, service email, notifications, hosting, security and failure diagnosis) because the transfer is necessary to perform our contract with you (Article 23(1)(d) of Federal Decree-Law No. 45 of 2021). For usage measurement, marketing messages and the waiting list, the basis for the transfer is your explicit consent (Article 23(1)(b)), and no transfer takes place before it.

10. Cookies and storage on your device

The website does not use cookies for tracking or advertising, and does not share your data with advertising networks. The app and website keep on your device what they need to work: your preferences (language and theme) and the sign-in session of the partner venue console. The random installation identifier used for usage measurement is created and sent only after you consent, and stops when you withdraw. Cloudflare Turnstile may store technical data on the account-deletion page and the venue sign-up page to prevent abuse.

11. Children

The account is for people aged 18 or over. A guardian (the father, the mother or the legal guardian) may book in the name of a minor in their care from their own account, as follows:

• At the first booking for the minor, the guardian expressly confirms that capacity and consents to the processing of the minor's data for the booking. This consent is recorded with its time and the version of its text.
• We collect only the minimum the booking needs about the minor: the name and age group. We do not ask the minor for an email, a phone number or a photo. Of the minor's data the venue sees only the name and that the booking is for a minor, together with the guardian's name.
• We send no marketing message about the minor, and we do not use the minor's data for advertising, marketing measurement or any commercial purpose other than carrying out the booking.
• The guardian exercises the minor's data rights on the minor's behalf, and may withdraw consent and delete the minor's profile from the account at any time.
• We are working to meet the requirements of Federal Decree-Law No. 26 of 2025 on Child Digital Safety to the extent it applies to us, within the period it sets.

If we learn that an account is held by a minor, we delete it.

12. Security

We protect your data with encryption in transit, row-level access rules in the database, rate limits and an audit log of administrative actions.

XSport team access. Authorised XSport staff can see your account, bookings, memberships and payments in order to provide the service and support, and they sign in to the admin console with mandatory two-factor authentication. Your phone number is shown to staff masked; it is revealed in full — on screen or in an export file — only with a written reason, which is recorded in the audit log together with who revealed it and when. Staff may keep internal notes on your account for support and service quality; venues cannot see them, and they are deleted with your account. No system is completely secure; if a breach affects your data we will notify you and the competent authorities as the law requires.

13. Website visitors and the waiting list

If you leave your email on the website waiting list without an account, we keep your email, the area and the sport if you chose them, the page language, the campaign source if you arrived from a campaign link (the utm_source and utm_campaign values in the link), the time of sign-up, and the time of your consent and the version of its text. We use them for three things only: to send you one email when XSport becomes available in your area, to plan the next areas and sports by demand, and to know which campaign brought the sign-ups. To prevent abuse of the form we keep a keyed hash of the network address for no more than 24 hours, not linked to your email; we do not keep the address itself. We send you no other offers and do not share your email with any venue. The basis is your explicit consent when you sign up, including your consent to its processing by service providers outside the UAE; you can withdraw it and ask us to delete your email at any time at support@getxsport.com. We delete your email after sending the availability email, and in any case within 12 months of your sign-up.

14. Partner venues, their representatives and staff

If you register a sports venue or use the partner console, we collect: your name, your role at the establishment, your email and your account sign-in data, the establishment's phone numbers, the establishment's details, logo and location, and its documents: the trade licence, the signatory's authorisation letter where the signatory is not the manager or owner, the tax registration number and certificate if any, proof of address, and an image of the establishment's stamp if uploaded. When you sign the Onboarding & Partnership Agreement or a package order form electronically, we also collect: the name you typed, the drawn signature, the time of signing, the network address, the browser type, the version of the text you accepted and the document fingerprint. We use them to conclude, perform and evidence the agreement, to verify the establishment and to manage its account. Identity-verification and bank-account data are entered by you directly with Stripe, and their details do not reach us.

When you set the establishment's location on the map, your browser loads the map directly from OpenStreetMap, which receives your browser's network address and the area shown. The address text you type, or your location coordinates if you choose "My current location", is sent through our servers to the address-search service Photon (Komoot). Both services are outside the UAE.

We keep the signing record, the agreement and its documents for its term and for the period the law requires afterwards. Venue representatives and staff have the rights set out in section 8.

15. Changes to this policy, and its language

We publish any change on this page with the version number and its effective date, and we inform you in the app of material changes at least seven days before they take effect. This policy is issued in Arabic and English; the Arabic text prevails in case of any difference.