ClubStatr — including RivalFindr by ClubStatr

1. Who we are

ClubStatr ("ClubStatr", "we", "us") runs the ClubStatr app and website at clubstatr.com, including the free RivalFindr match-finding feature. We are based in British Columbia, Canada.

• Privacy Officer: Patrick Hughes
• Email: info@clubstatr.com
• Mailing address: PO Box 99154, Vancouver RPO Davie, Vancouver, BC V6G 0B7, Canada

The Privacy Officer is responsible for how we handle personal information and for answering your privacy questions and requests.

Our representative in the EU and EEA. We are based in Canada. If you are in the European Union or the European Economic Area, we have appointed Stephen Hughes as our representative under Article 27 of the GDPR. You can contact our representative, in addition to or instead of us, about how we handle your personal data or to use your rights:

• Representative: Stephen Hughes
• Address: 25 Poynton Place, Ballivor, Co. Meath, C15 WPA0, Ireland
• Email: stephenhughes0105@gmail.com

We have not appointed a data protection officer. Our Privacy Officer is the contact for data protection matters.

2. Who this policy covers

• Club owners: the person who registers a club.
• Team managers: the person who runs a team account.
• Adult players (18+): people who create a player account to join an adult team or to find, host and join pickup games.
• Underage players and their parents or guardians: a manager can add an underage player's name, and optionally a parent or guardian's name and phone number. Underage players never have their own accounts.
• Visitors to our website.

3. What we collect

Club accounts

• Club name, crest/logo, club bio, club shop link, and a link to the club's existing public presence (website, social page or league listing).
• The club owner's email address and password (the password is stored hashed; we can't see it).

Team accounts

• Sport, level, gender category and league name.
• Pitch address and its map coordinates, travel radius and time zone.
• Available match dates.
• Manager name, manager phone number and login email.
• Vetting reference (underage teams only): a self-declared background-check reference, e.g. Criminal Record Check (Vulnerable Sector), Garda vetting or DBS/AccessNI.
• Swipes (left or right on other teams), matches, agreed fixtures, results and result confirmations.
• Training sessions (date, time, location), events, sponsors, league table entries, announcements, formations and tactics notes.
• Tactics voice notes: audio recordings the manager chooses to make.

Adult player accounts (18+ only)

• Name, age, position, email address, phone number and an optional photo.
• Join requests, the teams you belong to, training attendance replies, and messages between you and your manager.
• Match stats a manager logs for you, and your appearance on team sheets.

Pickup games (adult player accounts)

• Games you host: sport, players per team, date and time, the venue's map pin and optional place name, the venue's time zone, and the cost you enter (shown for information only; we don't take payment).
• Games you join, leave or pass on, and a short-lived count of your recent joins that we use to limit abuse.
• Reports you file about a game or host, and our moderation decisions.

Underage players (entered by a manager)

• The player's name, and optionally one parent or guardian's name and phone number.
• Stats and team-sheet entries the manager logs for that player.
• We never collect an underage player's age, photo, email address or phone number, and underage players can't create accounts.

Messages and safety

• Messages between matched teams, and between players and their manager.
• Reports and blocks you file, and our moderation decisions.
• Messages flagged by our automatic abusive-language filter.

Billing (paid plans)

• Plan, subscription status, billing dates and Stripe customer and subscription IDs.
• Card details are handled entirely by Stripe. We never see or store your card number.
• Purchases are sold through Link, Stripe's reseller service (the "merchant of record"). Link collects your payment details and billing location, calculates and collects sales tax, sends your receipts and handles payment support under its own terms and privacy policy.

Referrals

• Which team referred which, and the status of any referral reward.

Technical

• Login session data kept in your browser.
• Basic server and error logs (for example, time, page and error message) used to keep the service working.
• We don't use advertising or analytics trackers.

4. How we use it and our legal bases

Giving us the information in section 3 is needed to create your account and use the service. Without it we can't provide the service. We don't make decisions about you based only on automated processing that have legal or similarly significant effects. Our abusive-language filter blocks or flags messages, and a person reviews flagged messages.

We don't sell personal information, don't use it for advertising, and don't send marketing emails unless you've separately opted in.

5. Who can see what

Nothing about players, squads, training or events is visible to logged-out visitors.

6. Contact sharing after a match

When you tap Match agreed, we ask you to confirm first. When both clubs have agreed, each club can see the other's manager name, manager phone number and pitch location for 30 days. After that the details are hidden again. We keep the underlying team record, but no longer show it to the other club.

7. Service providers and where your data is stored

We use these providers, under contracts that require them to protect your information and use it only to provide their service to us:

Your information may therefore be stored or processed outside your province or country, including in the United States, where it may be accessible to authorities under local law. For EU and UK users, we rely on adequacy decisions or Standard Contractual Clauses for these transfers. You can ask us for details of these safeguards at info@clubstatr.com.

AI assistant connector (optional). ClubStatr offers a connector ("Club Connect") that lets an AI assistant you choose read your teams, matches, messages and squad, and create training sessions or set availability for you. It works only if you sign in and approve it, and only with your own account's data. You can revoke access at any time. Once you connect an assistant, its provider's privacy policy applies to what it receives.

8. How long we keep it

Deletion runs automatically every night.

9. Children and underage teams

• A team is treated as underage based on its level (for example U7–U21, Junior, Minor, Colts). Underage teams have no player accounts.
• The manager can record a player's name and, optionally, one parent or guardian's name and phone number. Before adding a player, the manager must confirm that the parent or guardian has agreed. We record that confirmation.
• Underage players' names appear on team sheets seen by the opposing club for that fixture. They are never shown publicly.
• Underage teams' training sessions and events are visible only to the manager and club owner.
• For underage roster data, the club is responsible for it (the "controller"). ClubStatr stores and processes it on the club's behalf (as "processor"). Parents or guardians can contact the club, or us at info@clubstatr.com, to see, correct or remove a child's information.
• ClubStatr accounts are only for people aged 18 or over. If we learn that someone under 18 has created an account, we delete it.

10. Your rights and choices

You can:

• Delete your account at any time: Settings → Delete my account, or visit clubstatr.com/delete-account. This cancels any subscription and deletes or anonymises your data as described in section 11.
• Download your data as a file: Settings → Download my data.
• Correct your information by editing it in the app, or by asking us.
• Withdraw consent (for example, remove your photo), or object to or ask us to limit certain uses.
• Ask us for access to the information we hold about you and how we've used it.
• If you are in the EU, EEA or UK, you also have the right to erasure, to restrict processing, to data portability (Download my data gives you your information in a portable file), and to object to processing we carry out on the basis of legitimate interests.

Email info@clubstatr.com with any request. If you are in the EU or EEA you can also contact our representative (section 1). We reply within 30 days (30 business days under BC law), and may need to confirm your identity first.

Complaints: please contact our Privacy Officer first. You can also complain to:

• the Office of the Information and Privacy Commissioner for British Columbia (oipc.bc.ca);
• the Office of the Privacy Commissioner of Canada (priv.gc.ca);
• in Ireland, the Data Protection Commission (dataprotection.ie);
• in the UK, the Information Commissioner's Office (ico.org.uk);
• or the data protection authority in your EU country.

11. What happens when a team or account is deleted

Removing one team. A club owner can remove any team in their club, and a team manager can remove their own team, without affecting the rest of the club. Deleting a club account removes every team under it. In both cases:

• Permanently deleted:
  • the team manager's name, phone number, vetting reference and (if their login is deleted) email address;
  • all player information for that team: adult players' link to the team, underage players' names, and parent/guardian names and phone numbers;
  • the team's training sessions and attendance replies, announcements, player–manager messages, events, sponsors, league table, formations and voice notes;
  • availability, swipes and invite links.
• Kept as a record so other clubs' history still makes sense:
  • the club name and crest;
  • the team's sport, level and gender category;
  • the team's home ground location;
  • past fixtures and results.

  Player names on past stats and team sheets become "Former player". Messages with other clubs stay in their conversation until they're deleted under our normal 12-month rule. If you want the club name, crest or ground location removed as well, email info@clubstatr.com and we'll replace them with "Deleted club".

• Deleting your own login also deletes your player profile, photos, notifications and pickup game history. Games you host are cancelled and removed, and the players are told; you are removed from games you joined.
• Kept for legal reasons: billing records for 6 years, and reports and moderation records for 2 years.

12. Security

• Data is encrypted in transit.
• Access to every table is limited by database security rules.
• Files are stored privately, and staff access is limited.
• Card data is handled by Stripe.

No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the relevant regulators as the law requires. That includes the Office of the Privacy Commissioner of Canada and, for EU/UK users, the relevant authority within 72 hours where required.

13. Cookies and local storage

We store only what is needed to keep you signed in and to remember a referral code during signup. We don't use advertising or analytics cookies, so there's nothing to opt out of. If that changes, we'll ask for your consent first where the law requires it.

14. Changes to this policy

When we make an important change, we'll tell you in the app and by email at least 30 days before it takes effect where possible, and ask you to review it. The version and date at the top show which version applies.

15. Contact

Patrick Hughes, Privacy Officer, ClubStatr

info@clubstatr.com · PO Box 99154, Vancouver RPO Davie, Vancouver, BC V6G 0B7, Canada

EU/EEA representative: Stephen Hughes, 25 Poynton Place, Ballivor, Co. Meath, C15 WPA0, Ireland · stephenhughes0105@gmail.com