Privacy.

1. Who is responsible

Squadroom is an application for running futsal and football clubs. For questions about personal data, write to the address at the end of this page. We have no data protection officer, as the law does not require one at our size; questions go to that address.

2. Two different roles

On the website, in the contact form and in managing accounts, we are the controller: we decide what happens to the data.

Inside the application, each club's data belongs to the club. The club decides whom it invites, what it records and when it asks for deletion, and it is the controller of that data. We process it on the club's behalf and only to provide the service, as a processor (Article 28 of the GDPR). We do not use clubs' data for commercial purposes, advertising or sale.

3. What data we handle

On the website:

• The contact form: name, club, email and message.
• Technical request data, such as IP address and browser, kept by the hosting to run and protect itself.

In the application, depending on what the club uses:

• The account: name, email, role in the club and, if you sign in with Google, what Google shares to sign you in. We also keep which version of the terms you accepted and when.
• The squad and its activity: name, shirt number, position, date of birth, photo (if the club adds one), attendance, effort, call-ups, match records and statistics.
• Health: availability, measurements, clinical notes and recovery plans. These are health data, a special category under the GDPR, and are kept apart from the rest.
• Club management, if the club uses it: identity, tax number and identity document, guardians of minors, the sports medical exam, association registration, fees and payments.
• The access log: who viewed or changed personal data in club management, and when.
• Conversations with Squady, if the club has it switched on.

4. Why, and on what basis

Where we are the controller:

• Replying to a contact request and preparing the club to join: steps taken at the request of whoever writes, before a contract (Article 6(1)(b)).
• Creating and managing accounts, giving support and keeping the service secure: performance of the contract with the club and our legitimate interest in a secure service (points b and f).
• Keeping the acceptance of the terms: legitimate interest in proving what was accepted (point f).
• Meeting legal obligations, such as invoicing when it applies (point c).

Where we process data on a club's behalf, we do so only to provide the contracted service. The legal basis for handling each player's data, including health data and data about minors, is set by the club, which is answerable for it and must have the guardians' authorisation where required.

5. Minors

Many players are minors. Accounts for minors are created on the club's invitation, and the club is responsible for having the guardian's authorisation. A player sees their own call-up, their own numbers and published tactics, and does not see clinical notes or other players' data.

6. Squady and artificial intelligence

When a club has Squady switched on, what you write to the assistant, the files you send it and the data it looks up to answer are processed by artificial intelligence model providers (OpenAI, Anthropic and Z.ai), through the Vercel AI Gateway. These providers may process the data outside the European Economic Area, including in the United States and China. Do not write to Squady anything you would not want to leave the club.

Squady makes no decisions for anybody: it proposes, and nothing is saved without a confirmation from whoever asked. There is no automated decision-making with effects on people.

7. Who receives the data

We do not sell or hand over data. We use these providers to run the service, each with only what it needs:

• Supabase: database, files and authentication, in Ireland (European Union).
• Vercel: hosting for the website, the application and Squady, and routing to the artificial intelligence models. A United States company with servers in several countries.
• Google: signing in with Google, for those who choose it. United States.
• OpenAI and Anthropic (United States) and Z.ai (China): Squady's models, only when the club has it switched on.

8. Transfers outside the European Union

When data leaves the European Economic Area, the transfers rely on the Chapter V GDPR mechanisms available for each provider, such as the standard contractual clauses approved by the European Commission or the EU-US Data Privacy Framework. You can ask us which mechanism applies in each case.

9. How long

A sports season lasts a year, and a club needs its history. So a club's data is kept until the club asks for it to be deleted, and an account's data until that account asks, without prejudice to what the club must keep. When a request arrives, we delete the data within 30 days, except what the law requires us to keep. Contact form requests are kept until they are no longer needed to reply and follow up, and for two years at most.

10. Who sees the data and how we protect it

• Each club is closed on itself: a request made from one club returns no data from another.
• Within the club, each role sees its own part. Clinical notes stay with whoever wrote them until they decide to share.
• In club management, signing in asks for an authenticator code, every look at personal data goes into the access log, and tax and document numbers are hidden on screen.
• Connections are encrypted. We only look at a club's data when it is needed for support or to keep the service running.

11. Cookies and browser storage

The website uses no advertising or statistics cookies and no analytics tools. The browser remembers the chosen language. In the application, the browser keeps your signed-in session and preferences such as the open club and team; without them the application does not work.

12. Your rights

You can ask for access to your data, correction, erasure, restriction of processing and portability, and object to processing based on legitimate interest. If you gave consent for anything, you can withdraw it at any time. If the data belongs to a club, speak to the club first, since it decides; we help the club respond. About the website, the form and your account, write to us. We reply within one month.

You can also complain to the Portuguese data protection authority (CNPD), at www.cnpd.pt.

13. Do you have to give this data?

In the form, name, club and email are needed to reply. In the application, name and email are needed for an account; the rest depends on what the club decides to record.

14. Changes

If this policy changes, the version and date at the top change with it. When the change matters, we ask you to read it the next time you sign in.