This policy explains, in plain language, what personal data Football Hub collects, why we collect it, how we protect it, and what rights you have under the General Data Protection Regulation (GDPR — EU 2016/679) and applicable national data-protection laws.

1. Who is responsible for your data (Data Controller)

The data controller is Football Hub, operated at footballhub.pro.
Contact: contact@footballhub.pro

For all privacy requests — access, deletion, objection, or complaints — use this email address. We will respond within 30 days as required by GDPR Art. 12.

2. What data we collect and why

We only collect data that is necessary to provide the service. The table below lists each category together with the legal basis under GDPR Art. 6.

Account data — name, email address, hashed password, club name, role.
Legal basis: performance of a contract (Art. 6.1.b) — required to create and operate your account.
Coaching data you enter — player profiles, teams, training sessions, match records, evaluations, injuries, scouting notes, video metadata, season plans.
Legal basis: performance of a contract (Art. 6.1.b) — this is the core service you signed up for.
Billing information — subscription plan, billing dates, Stripe customer ID. Your card number is handled exclusively by Stripe; we never receive or store it.
Legal basis: performance of a contract (Art. 6.1.b) and legal obligation for invoicing (Art. 6.1.c).
Branding assets (paid plans) — custom logo, colors, app name.
Legal basis: performance of a contract (Art. 6.1.b).
Analytics data — page views, navigation events, approximate location (country/city derived from IP), browser type. This data is anonymous and aggregated.
Legal basis: your consent (Art. 6.1.a) — collected only if you click "Accept all" in the cookie banner. You may withdraw consent at any time by clearing your browser localStorage or via our contact page.
Security & abuse data — IP address, failed login attempts, rate-limit counters.
Legal basis: legitimate interests (Art. 6.1.f) — to protect the platform and other users from unauthorized access and abuse.

3. Youth player data (children under 16)

Football Hub is a professional tool for coaches and is not directed at children under 16. Coaches using the platform may enter data about youth players (names, dates of birth, performance statistics). As the coach and club using this data, you are the data controller for that player data under GDPR. You are responsible for:

Obtaining appropriate parental or guardian consent where required by local law.
Limiting data to what is necessary for coaching purposes.
Handling deletion requests from parents or guardians.

Football Hub acts as a data processor for this youth player data and processes it solely on your instructions. A Data Processing Agreement (DPA) is available on request at contact@footballhub.pro.

4. Third-party processors we use

We share data with the following processors only to the extent needed to deliver the service. All processors are bound by data-processing agreements.

Supabase (US/EU) — database, authentication, file storage. SOC 2 Type II certified. Data stored in EU region where available.
Stripe (US) — payment processing. PCI-DSS Level 1 certified. Stripe acts as an independent controller for cardholder data.
Vercel (US) — application hosting and global CDN. ISO 27001 certified.
Google Analytics (US) — anonymous usage analytics. Loaded only with your consent. IP anonymization is enabled.
Google Gemini / Anthropic Claude (US) — AI analysis (Elite plan). Match notes and coaching context you submit are sent to these providers to generate the AI response. We do not send names or personal contact data of players to AI providers. Data is not used to train these models under our enterprise agreements.

We do not sell your data. We do not share your data with advertisers.

5. International data transfers

Some of our processors operate outside the European Economic Area (EEA), including in the United States. We ensure adequate protection through:

Standard Contractual Clauses (SCCs) approved by the European Commission (2021/914), where applicable.
EU–US Data Privacy Framework certification, for processors that are certified (including Google and Stripe).

You may request a copy of the applicable transfer safeguards by contacting us.

6. Data retention

Account and coaching data: retained while your account is active. If you delete your account, personal data is permanently deleted within 30 days, except where legal retention is required.
Billing records and invoices: retained for 7 years as required by EU tax and accounting law (even after account deletion).
Analytics data: retained by Google Analytics for 14 months in anonymized form. We do not have access to individual user records.
Security logs: retained for up to 90 days for fraud detection and abuse prevention.

7. Cookies and tracking

We use two categories of cookies:

Essential cookies — required for the platform to function. These keep you signed in and maintain your session. They are set automatically and cannot be disabled without breaking the service. No consent is required for essential cookies under GDPR Recital 47.
Analytics cookies (Google Analytics) — used to understand how coaches navigate Football Hub so we can improve it. These are only loaded after you click "Accept all" in the cookie consent banner. You may withdraw consent at any time by clearing your browser's local storage or contacting us.

We do not use advertising, retargeting, or social-media tracking cookies.

8. Your rights under GDPR

As a data subject, you have the following rights (GDPR Chapter III). To exercise any of them, email us at contact@footballhub.pro. We will respond within 30 days.

Right of access (Art. 15) — request a copy of the personal data we hold about you and information on how it is processed.
Right to rectification (Art. 16) — ask us to correct inaccurate or incomplete data.
Right to erasure / "right to be forgotten" (Art. 17) — request deletion of your personal data. We will comply unless retention is required by law.
Right to restriction of processing (Art. 18) — ask us to pause processing of your data in certain circumstances (e.g., while a dispute is resolved).
Right to data portability (Art. 20) — receive your personal data in a structured, machine-readable format (JSON or CSV). You can export player lists, sessions, and reports directly from the dashboard at any time.
Right to object (Art. 21) — object to processing based on legitimate interests (Art. 6.1.f). We will stop unless we can demonstrate compelling legitimate grounds.
Right to withdraw consent (Art. 7.3) — withdraw consent for analytics cookies at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Right not to be subject to automated decisions (Art. 22) — Football Hub does not make automated decisions with legal or significant effects on individuals.

9. Right to lodge a complaint

If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority.

France (CNIL): www.cnil.fr/fr/plaintes
Other EU countries: contact your national data-protection authority. A full list is available at edpb.europa.eu.
UK (ICO): ico.org.uk

We encourage you to contact us first — most issues can be resolved directly and quickly.

10. Security

We apply appropriate technical and organizational security measures (GDPR Art. 32):

All communications encrypted in transit using HTTPS/TLS 1.2+.
Data at rest encrypted in Supabase (AES-256).
Row-Level Security (RLS) in PostgreSQL — each coach can only access their own data.
Passwords hashed with bcrypt (never stored in plain text).
Rate limiting and brute-force protection on authentication endpoints.
Access to production systems restricted to authorized personnel only.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay as required by GDPR Art. 34.

11. Changes to this policy

We may update this policy to reflect changes in our practices or applicable law. For material changes, we will notify you by email or prominent in-app notice at least 14 days before the change takes effect. Continued use of the service after that date constitutes acceptance of the updated policy.

12. Contact

For any privacy questions, to exercise your rights, or to request a Data Processing Agreement, please contact us at: contact@footballhub.pro

We are committed to resolving privacy concerns fairly and transparently.

Privacy Policy