Legal
Data protection
Processing terms under UK GDPR Article 28. They are part of the customer terms (version 2026-10-21.2).
Who we are
SquadPilot OS, registered in Scotland, Glasgow. Notices: billing@squadpilot.app. In this document we act as the processor. Your club is the controller of the club data described below.
Subject matter and duration
We host and process the club's data so you can use SquadPilot OS for as long as your subscription runs, plus the retention periods described in our privacy notice.
Purpose and nature of processing
We process data to run the modules you subscribe to: memberships, pitch allocation, tactics, governance, holiday camps, and the other features documented in the product. Processing includes storing, retrieving, backing up, displaying, and transmitting data as needed to provide those features.
Types of people and data
The club adds adults and children to the system. Data types include membership and contact details, children's records the club enters, Gift Aid declarations, payment and mandate metadata, medical notes the club stores, wellbeing, discipline, and match-day medical incident records held for the club's wellbeing officer, photos members share on the club photo wall (which may show children; each photo is visible to coaches of that team, parents of children on that team, and owners and admins, and stays until the uploader or an owner or admin removes it or the club's data is erased; social reuse only when the photo is marked suitable and the team's consents allow it, and that mark comes off if those consents change), and reimbursement or supplier bank details the club uploads.
Your instructions
We process club data only on your documented instructions. The primary instruction is to operate SquadPilot OS as described in the product and help materials. If you need something outside that scope, contact us in writing at billing@squadpilot.app.
Our obligations
We will keep club data confidential, apply appropriate security measures, and only use subprocessors that meet the same standard. We will help you respond to data-subject rights requests where we can, and notify you without undue delay if we become aware of a personal-data breach affecting club data we process for you.
When your subscription ends, we will delete or return club data as set out in the customer terms, except where we must keep financial records for about six years for tax law.
On reasonable notice, we will provide information needed for you to demonstrate compliance, and allow audits that are not more than once per year unless required by a regulator or after a breach.
Subprocessors
For club data we use Supabase (database, sign-in, storage, edge functions), Vercel (hosting the web application), and Resend (transactional email). Stripe charges the SquadPilot subscription on our own account. That is our billing relationship, not a subprocessor of club data. Each club connects its own GoCardless account and its own Stripe account for camp card payments — those are your relationships, not our subprocessors for that payment data. Payee bank details for a reimbursement or a supplier invoice are club data we store. Payer Direct Debit account numbers and holiday-camp card numbers are not: GoCardless and Stripe hold those.
We will tell the club before we add a new subprocessor that processes club data.
International transfers
Where a subprocessor stores data outside the UK, we rely on the UK International Data Transfer Agreement or the UK addendum to the EU standard contractual clauses, as described in the privacy notice.