Privacy notice

Last updated: October 11, 2026

GoSmash (gosmash.cc) is booking software for courts and ball machines in the Philippines. This notice explains, in plain words, what personal information we handle, why, who else sees it, how long we keep it, and your rights under the Data Privacy Act of 2012 (Republic Act No. 10173). The short version: we collect what we need to run bookings, we don't sell it, and we don't use it for advertising.

Who is responsible

• If you book at a venue, that venue decides how your booking information is used. GoSmash processes it on the venue's behalf, under its instructions.
• If you run a venue on GoSmash, or you contact us, sign up for our guide or chat with us on gosmash.cc, GoSmash is responsible for your information.

What we collect

From players booking at a venue

• Contact details: your name, mobile number and email address.
• Your messages to the venue on its venue page chat, Facebook Messenger or Instagram, and your public profile name on those apps.
• Booking details: court or machine, date and time, amount, payment status and notes such as a coaching request.
• Payment receipts you send as proof of payment. We never receive your card number or e-wallet login; online payments are handled by PayMongo.
• Technical information: your IP address when you use a booking page, only to stop abuse such as mass fake bookings.

From venue owners and their staff

• Account details: name, email, mobile number and password (stored only as a secure hash, never readable).
• Venue details you enter: address, photos, prices, hours, rules and payment details such as your QR code.
• Billing: your plan, invoices and payments to GoSmash.
• How the service is used: logins, which features are used and when, and the browser and IP address of each login session. We use this to keep accounts secure, to give support and to improve GoSmash.

From people who contact GoSmash

• What you give us in the website forms or our website chat (name, venue, email, mobile, your questions), and your chat messages.

How we use it

• To take, hold and confirm bookings, and to send payment details, confirmations and reminders.
• To let venues check payments, contact their players and handle cancellations or changes.
• To let the AI agent answer messages and book slots for the venue.
• To run venue accounts: logins, billing, support and service emails.
• To answer people who contact us. If you sign up for our guide, we send it and one follow-up; every such email has an unsubscribe link.
• To keep the service secure, prevent abuse and fix problems.

We don't sell personal information, we don't use it for advertising, and our website has no advertising or tracking pixels.

Who we share it with

• The venue you book with. Venues see only their own players and bookings.
• Service providers that help us run GoSmash, each only for its part: Hostinger (our servers); OpenAI (processes chat messages so the AI agent can reply; under OpenAI's API terms it does not train its models on this data); Brevo and Google (sending emails); Google Drive (storing our daily backups); PayMongo (online payments); and Meta, when you message a venue on Messenger or Instagram.
• GoSmash support, when a venue asks for help. Support actions on a venue's schedule are recorded in that venue's history.
• Authorities, only when the law requires it.

Some of these providers process data outside the Philippines (for example in the United States or the European Union). We choose providers that protect data to a standard comparable to Philippine law.

How long we keep it

• The AI agent's copy of chat text is deleted after 90 days. The conversation itself stays in the venue's chat inbox until the venue deletes it or closes its account.
• Bookings and payment receipts are kept while the venue's account is open, because venues need them for their records.
• Venue accounts: when a venue closes its account, we delete its data within 30 days, except payment records the law requires us to keep.
• Backups are taken every day and kept for up to 12 months, then deleted. A deleted item disappears from backups as they expire.
• Website enquiries and guide signups are kept until we no longer need them to follow up with you, or until you ask us to delete them.

Cookies and browser storage

We use only what the service needs: a login cookie to keep owners and staff signed in, your light or dark theme choice, an unfinished onboarding form saved in your own browser, and the chat window's cookie so your conversation continues when you come back. No advertising or analytics cookies.

How we protect it

• Everything travels over HTTPS. Passwords are stored as secure hashes.
• Each venue can see only its own data. Owner and staff logins use secure, http-only cookies, and each person has their own login and role.
• Links to your booking status and receipts are long random links that aren't listed anywhere.
• Booking data is backed up every day, so it can be restored after a mistake or a failure.

If a breach ever puts your personal information at risk, we will tell the affected venues and people, and the National Privacy Commission when the law requires it.

Your rights

You have the right to be informed, to access your information, to have it corrected, to object to its processing, to have it erased or blocked, to data portability, and to claim damages. If you booked at a venue, you can ask the venue directly or email us and we will pass your request on and help. We aim to answer within 15 days. You can also file a complaint with the National Privacy Commission (privacy.gov.ph).

Changes to this notice

When we change this notice, we update the date at the top. If a change matters to venue owners, we email them before it applies.

Contact us

Privacy questions and requests, including for our Data Protection Officer: privacy@gosmash.cc. Everything else: support@gosmash.cc. Our terms for venues are in the terms of service.