Privacy policy
At TactiCourt we process personal data in two different ways, and it is worth telling them apart:
- Your account data (so you can sign in and use the app): here the controller is the owner of TactiCourt.
- Your team's data (players, coaching staff, injuries, reports, videos…): here you are the controller (the club or coach who enters them) and TactiCourt is your processor, under the data processing agreement.
1. Controller of account data processing
| Controller | TactiCourt |
|---|---|
| Tax ID (NIF/CIF) | [TO COMPLETE: tax ID] |
| Address | [TO COMPLETE: address] |
| Privacy contact | [email protected] |
2. What data we process, for what purpose and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Creating and maintaining your account and providing the Service | Email, name, password (only its encrypted hash), plan, app version, device and session identifier, access dates | Performance of the contract (Art. 6.1.b GDPR) | For as long as you have an account and, afterward, for the statutory limitation periods |
| Security and prevention of fraud and abuse | IP address and technical access logs | Legitimate interest in protecting the Service (Art. 6.1.f) | Technical logs: short periods, as set by our providers |
| Handling your inquiries and requests | Whatever you send us by email | Legitimate interest / performance of the contract | For as long as needed to assist you and, afterward, for the limitation period |
| Payment and invoicing (when payment is enabled) | Billing data; payment is handled by Lemon Squeezy as the authorized seller | Performance of the contract and legal obligation (Art. 6.1.b and 6.1.c) | As required by commercial and tax regulations |
| Diagnosing application errors | Version, type of failure and device, without the content of your team | Your consent (Art. 6.1.a); you can withdraw it at any time | Until you withdraw it and, at the provider, the short period that applies |
| News and offers by email | Your email and name | Your express consent, given separately and with no pre-checked box (Art. 6.1.a and Art. 21 LSSI) | Until you unsubscribe |
| AI-powered features that you choose to use (reading a stats sheet, drafting an analysis) | The document or text you upload, which may include players' names, jersey numbers and stats | Performance of the contract (you request it) | The time needed to process your request and the period the provider sets for its own security* |
*Under the terms of the paid plan we have with the provider, your content is not used to train its models. If you don't want a document to leave TactiCourt, don't use these features with it: the rest of the program works the same.
We do not use data for automated decisions with legal effects on you or to build advertising profiles, and we do not sell it.
3. Your team's data (we are your processor)
What you enter about players and coaching staff, including, if you record them, health data (injuries, allergies, medication), images and videos, we process solely to provide you with the Service and following your instructions, as a data processor. You, as the controller, must have a legal basis to do so and must inform the people concerned:
- For health data you need the person's explicit consent (Art. 9.2.a GDPR).
- For children under 14 you need the authorization of their parents or legal guardians (Art. 7 of Spain's LOPDGDD and Art. 8 GDPR). The program lets you record it on the player card, and the forms you send to players ask for it.
If you are a player, a family member or a member of the coaching staff and you want to exercise your rights over this data, please contact your club or coach (the controller) first; we will help them respond to you.
4. Recipients and processors we use
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, accounts, files and server functions | European Union (Ireland) |
| Netlify | Hosting of the website and of the web version of the app | US (global content delivery network) |
| GitHub | Download of the installers and updates of the desktop program | US |
| Cloudflare | Domain and DNS resolution | US/EU |
| Resend | Sending of the service's emails (invitations, password recovery, post-practice alerts) | US |
| Sentry | Error reporting, only if you accept it | European Union (Germany) |
| Google (Gemini API) | AI features, only when you use them | As set out in the provider's contract |
| Lemon Squeezy | Payment for the paid plans (when activated) | US |
We only disclose data to other recipients when the law requires it (for example, to authorities or courts).
5. International transfers
The data of your account and your teams is hosted in the European Union. Some providers are in the US: in those cases, transfers rely on the adequacy decision for the EU–US Data Privacy Framework for certified providers or, failing that, on the European Commission's standard contractual clauses, with any additional safeguards that apply.
6. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent at any time (without affecting processing carried out before), by writing to [email protected]. We will reply within a maximum of one month. We may ask you to prove your identity.
If you believe your rights have not been respected, you may file a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es).
7. Minors
The Service is intended for coaching staffs and you must be of legal age to create an account. Data of minor players is entered by the club or the coach, who must have the authorization of their parents or legal guardians if they are under 14.
8. Security
We apply appropriate technical and organizational measures: encrypted connections, access control by team and by role (each person sees only what they are granted), a single active session per account, backups and access logging. If a security breach affecting personal data were to occur, we will notify the authorities and the affected controllers within the legal deadlines.
9. Changes to this policy
If we make material changes to this policy, we will let you know and, where necessary, ask you to accept it again. It will always be available at this address.