HIT Privacy Policy

Last updated: 7 October 2026
Operator: HIT COURTS E-COMMERCE COMPLEX (مجمع هيت كورتس للتعامل الإلكتروني), a sole establishment
Licence: trade licence no. 65137, CBLS no. 4010000000000065137, commercial registry no. 69853, issued by the Ras Al Khaimah Department of Economic Development (RAK DED)
Address: Inside Street, Al Dhait, Unit 19 (Villa / House), Ras Al Khaimah, United Arab Emirates
Contact: support@hitcourts.com
Website: https://www.hitcourts.com

This policy explains what personal data HIT COURTS E-COMMERCE COMPLEX ("HIT", "we", "us") collects, why we use it, who receives it, how long we keep it and the choices you have. It applies to the HIT app ("HIT: Book Sports Courts" for iPhone and Android), the HIT customer website, the partner portal at hitcourts.com and our support channels (together, the "Platform").

This policy is issued in Arabic and English. If the two versions differ, the Arabic version prevails.

1. Who is responsible for your data

HIT COURTS E-COMMERCE COMPLEX is the controller of the personal data described in this policy. The sports venues listed on HIT ("venues") are independent businesses. When a venue receives your booking details, it is responsible for how it uses them at the venue, for example for check-in, safety and customer service, and it must follow the rules in Section 7.

2. In short

• We collect what we need to run your account, your bookings and your payments.
• We do not sell your personal data. We do not use advertising networks or your device's advertising ID, and we do not track you across other companies' apps or websites.
• Your card details go directly to our payment provider, Stripe. We never see or store your full card number or security code.
• Your location is used only for the search you make. It is not saved to your account.
• Reviews you post are public.
• You can delete your account in the app at any time (Profile, then Account, then Delete account permanently) or by email.

3. What we collect

3.1 Your account

• Your name, email address, mobile number, preferred language and account status.
• Your password, which we store only in a one-way protected form (a hash). We cannot read it.
• The fact and date that you accepted our Terms.
• Date of birth: HIT does not ask for it. Earlier versions of the app asked for it. We do not use it for anything, we will delete the dates already stored, and it is always deleted when you delete your account.

3.2 Verification codes and sign-ins

• One-time codes that we send by email, and by SMS when you verify your mobile number. We store codes only in a one-way protected form, with the number of attempts and their times, to stop abuse.
• Sign-in sessions: when you signed in, the IP address and a short description of your device or browser. You and we use this to see where your account is signed in and to sign out other devices.

3.3 Location (only if you allow it)

If you allow location access, the app reads your approximate position when you search for venues or open recommendations. It sends that position with the request so that venues can be sorted by distance and your nearest emirate can be suggested. We do not save your position to your account, and we do not use it for offers or advertising. You can refuse or withdraw this permission in your device settings and choose an emirate yourself. The app never reads your location in the background.

Maps in the app load map images from our map providers (CARTO, and Esri as a backup). Like any website, these providers receive your IP address and the area of the map being shown.

3.4 Bookings and activity

• The venue, court, sport, date, time, duration, price, discounts and rewards used, the type of payment and the status of each booking.
• Cancellations, refunds, late-cancellation warnings, no-shows, check-ins and your "I played" confirmations.
• Your favourite venues and the "Notify me" alerts you set for times you are waiting for.
• Your HIT Rewards points, progress and rewards.

3.5 Payments

• Online payments (card, Apple Pay and Google Pay) are processed by Stripe. Stripe collects your card details directly. We receive payment references, amounts, payment status and refund details. Stripe may also collect information about your device to prevent fraud, under its own privacy policy.
• When a booking is split with a payment link or QR code, we record each share, its amount and status, and the name the payer enters. Anyone who opens the same payment link can see the names entered and which shares have been paid.
• When you pay at the venue, the payment and its status are recorded with the booking.

3.6 Photos and videos for court reports

If a court is not ready to play on, you can report it with photos or videos that you take or choose. Videos keep their sound. The app uses the camera and microphone only while you take them, and uses the camera to scan venue QR codes. We store these files with our media storage provider (Cloudinary) and share them with the venue and our staff so that the report can be reviewed.

3.7 Reviews, reports and blocks

• Reviews you post (star rating, comment and date) are public. Anyone viewing the venue, including people without an account, can see them with your name. We may show your name in a shortened form, such as your first name and the first letter of your last name.
• Reports you make about reviews or advertisements, and the players you choose to block.

3.8 Messages to us

The emails you send to support, the details of any dispute you raise and any other information you choose to give us.

3.9 Crash reports

When the app or our servers fail, a crash report is sent to Sentry, our crash-reporting provider. It contains technical details (the error, the app version, the device model and operating system) and your HIT account ID. It does not include your name, email address or mobile number, and we set it up to leave out passwords, codes and payment details.

3.10 Devices and notifications

• The push notification token of your device (so that we can send you notifications), the app version, the operating system and the language of your device.
• An installation identifier used by our app update service (Expo) to deliver updates to the app.

3.11 Venue partners and their staff

If you use the partner portal for a venue, we also collect your name, email address, mobile number and role, the details of your organisation and venues, the actions you take in the portal (for security and audit), and the sign-in links and sessions you use. The bank and identity details needed for payouts are collected by Stripe (Stripe Connect) under its own terms. We receive the account status and payout records.

3.12 What we do not collect

We do not access your contacts, your messages, photos you have not chosen, your browsing history or health data. We do not use product-analytics or advertising tools in the app.

4. How we use your data and our legal grounds

To provide the service you asked for (our contract with you):

• to create and run your account, verify your email address and mobile number, and keep one account per mobile number;
• to show venues, availability and prices, sort them by distance and recommend venues;
• to process bookings, payments, split payments, cancellations and refunds, and to send receipts;
• to send verification codes, booking confirmations, reminders, changes, cancellations and refund updates;
• to run HIT Rewards: confirm attendance, add progress and apply rewards;
• to handle court reports, disputes and support requests.

For our legitimate interests, which we balance against your rights:

• to keep the Platform safe: prevent fraud, abuse, duplicate accounts and payment misuse, limit repeated attempts, moderate reviews and act on reports;
• to fix errors and improve the Platform using crash reports and service records;
• to choose which HIT offers and labelled sponsored offers you see (Section 5).

With your consent, which you can withdraw at any time:

• to use your location for a search;
• to send promotional notifications if you turn on "Offers & news".

To meet our legal obligations:

• to keep accounting, tax and payment records and to answer lawful requests from authorities.

We process personal data in line with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and other applicable UAE law.

5. Offers and sponsored content

HIT shows its own offers and labelled sponsored content in the app, for example a pop-up on the Home screen or a card marked "Advertisement" or "Sponsored offer". We choose which ones you see on our own servers, using only your activity on HIT: your number of bookings, total spend, the sports you have booked, your points, how long you have had an account, the time since your last booking and your recent cancellations. Guests see only offers that are shown to everyone.

• Sponsors never receive your personal data. We do not use advertising networks or your device's advertising ID, and we do not track you across other companies' apps or websites.
• If you tap a sponsor's button, the sponsor's link opens in your browser and the sponsor's own privacy policy applies to that visit.
• In the app you can see why an advertisement is shown to you and report it.
• The "Offers & news" switch (Profile, then Notifications) stops the pop-up offers on the Home screen and promotional notifications. Labelled sponsored placements inside the app can still appear.
• You can object to our use of your booking activity to choose offers by emailing support@hitcourts.com.

6. Notifications, emails and SMS

• Service messages (codes, receipts, booking changes, refunds and security notices) are always sent, because your account cannot work without them.
• "Match notifications" and "Offers & news" are separate switches in Profile, then Notifications. Promotional messages stay off until you turn them on.
• Push notifications are delivered through Expo and Apple or Google. SMS codes are sent by Twilio, and emails by our email delivery provider.
• You can also turn notifications off in your device settings.

7. Who receives your data

We share personal data only as described here. We never sell it.

• The venue you book. Your name, the booking details, payment status, check-in and attendance, any court report about that booking and, where needed on the day, your mobile number. Venues may use these details only to provide your booking and to handle check-in, safety, refunds and disputes. They may not use them for marketing unless you have agreed to it separately.
• Other players. People who open a payment link that you share see the names entered and which shares have been paid. Reviews are public.
• Authorities and advisers. Courts, regulators, police, tax and consumer-protection authorities when the law requires it, and our lawyers, accountants and auditors, who must keep it confidential.
• A buyer or successor if the business is sold or reorganised. They must protect your data as this policy describes.

Service providers that work for us:

• Stripe: payments, Apple Pay and Google Pay, refunds and venue payouts;
• Twilio: SMS verification codes;
• our email delivery provider: emails;
• Expo, Apple and Google: push notifications and app updates;
• Cloudinary: storage of court-report photos and videos and of venue images;
• Sentry: crash reports;
• Vercel and Railway: hosting of our websites, servers, database and encrypted backups;
• CARTO and Esri: map images;
• Google ML Kit on Android devices: reading QR codes on your device.

Every service provider that receives your data may use it only to provide its service to us, and must protect it to the same or an equal standard as this policy. Some providers, such as Stripe, also act as independent controllers for limited purposes such as fraud prevention and legal compliance, under their own privacy policies.

8. International transfers

Several of our providers store or process data outside the UAE, for example in the United States or the European Union. We transfer only what is needed to run the Platform, under the providers' contractual data-protection commitments and security measures, and as permitted by UAE law.

9. How long we keep data

• Account details: while your account is open. When you delete your account, we delete or anonymise them as described in Section 12.
• Booking, payment, refund, rewards and invoice records: 5 years from the end of the financial year in which the booking took place, because UAE commercial and tax law requires it. After you delete your account, they are kept under the name "Deleted User".
• Court reports, including their photos and videos: kept with the booking record for refunds and disputes. If you delete your account, the photos and videos are deleted 90 days later.
• Reviews: while your account is open. When you delete your account, the comment is deleted and the star rating stays in the venue's rating without your name.
• Verification codes: they expire within minutes and cannot be used after that.
• Sign-in sessions: while your account is open. The IP address and device details are removed when you delete your account.
• Crash reports: up to 90 days.
• Support emails: as long as needed to deal with your request and any follow-up, and no longer than 2 years after it is closed, unless they form part of a booking or payment record.
• Backups: our encrypted backups are kept for a limited time and replaced on a rolling basis.
• Email fingerprint (Section 12): until you ask us to release it.

10. Security

We protect personal data with encryption in transit (HTTPS), passwords and codes stored only in a one-way protected form, access limited to the staff who need it, audit logs of staff actions, limits on repeated attempts and encrypted backups. Card details are handled by Stripe, which is certified to the PCI DSS card-security standard. No system is perfectly secure, so keep your device, password and codes to yourself, and tell us straight away at support@hitcourts.com if you think your account has been misused.

11. Your rights

Subject to UAE law and to checking your identity, you can ask us to:

• give you a copy of your personal data;
• correct it;
• delete it;
• restrict or object to some uses, including the use of your booking activity to choose offers;
• withdraw a consent you gave;
• give you your data in a portable format where the law provides for it.

You can change your name, email address, mobile number and notification choices in the app (Profile). For anything else, email support@hitcourts.com from the email address on your account. We reply within 30 days. If you are not satisfied with our answer, you can complain to the UAE Data Office.

12. Deleting your account

• In the app: Profile, then Account, then Delete account permanently. Deletion is immediate and signs you out on every device.
• By email: write to support@hitcourts.com from the email address on your account, with the subject "Delete my HIT account". We check that the account is yours and complete the deletion within 30 days.
• Full details: https://www.hitcourts.com/delete-account.html

What we delete: your name, date of birth, email address, mobile number, username and password; your notification settings and push tokens; your favourite venues and "Notify me" alerts; the players you blocked; the IP addresses and device details stored with your sign-ins; the text of your reviews, of any dispute you raised and of your court reports that have been decided; and the link between your account and our usage records. Your rewards account is closed and unused points are forfeited.

What we keep:

• booking, payment, refund, rewards and invoice records, under the name "Deleted User", for the period in Section 9;
• the star ratings you gave, without your name or comment, as part of each venue's rating;
• dispute records, without your description, for the same period as booking records;
• the photos and videos of your court reports, for 90 days so that a refund or venue dispute can still be settled, and the text of a report that is still being decided, with the booking record;
• reports you made about reviews or advertisements, without your name;
• a one-way fingerprint of your email address, which cannot be turned back into your address. It stops the address from being used to open a new account without contacting us, which prevents abuse of welcome offers and of account bans. We release it when you ask.

Venue owner accounts cannot be deleted in the app; email us and we will close the business account with you. Deleting your account does not cancel upcoming bookings, so cancel the ones you no longer need first.

13. Children

You must be 18 or older to create a HIT account. We do not knowingly collect personal data from children under 18 through accounts. Players under 18 may take part in a booking made by an adult, who is responsible for them. If you believe a child has given us personal data, email support@hitcourts.com and we will delete it.

14. Websites, cookies and browser storage

Our websites use your browser's storage only for what you need: keeping you signed in, remembering your language and keeping the service secure. We do not use advertising or tracking cookies. Stripe may set its own cookies on payment pages to prevent fraud.

15. Changes to this policy

We will post any update here and in the app with a new date. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.

16. Contact

HIT COURTS E-COMMERCE COMPLEX, Inside Street, Al Dhait, Unit 19 (Villa / House), Ras Al Khaimah, United Arab Emirates.
Email: support@hitcourts.com