Privacy

Data we hold as controller

Identity and contact data: the name and email of the person who signs the club up, and the club’s name. Billing data: the plan, invoices, and a customer identifier from our payment provider. Technical data: the sign-in session, and the address and browser details our host logs to keep the service up. We do not run advertising or analytics cookies, and we do not build marketing profiles.

We use that data to perform the contract with the club, to keep tax records (about six years), and for the legitimate interest of securing and supporting the service. If the club does not give us a billing contact, we cannot open the subscription.

Children

The public site does not sign children up. Where a club stores a child’s record, a photo, a medical note, or a wellbeing note, we process it as processor, on the club’s instruction, and not for our own marketing. We do not send marketing to children.

Records the club asks us to hold

On the club’s instruction the app can hold membership and guardian details, children’s records, Gift Aid declarations, team photos, medical and wellbeing notes the club chooses to store, and bank details for a reimbursement or a supplier. Direct Debit account numbers stay with the club’s payment provider. We keep the last two digits. Reimbursement bank details are encrypted. The person who submitted the claim, an owner or admin, and the treasurer can see them. Other coaches and parents cannot.

Those bank details are kept while the account is in use and for six years after the later of the account ending or the last linked claim being paid, rejected, or void. The ciphertext is then destroyed. A mask may remain on the cashbook. We will not erase them while a claim is still open and unpaid. A parent who wants a record or a photo corrected or removed should ask the club first. The club is the controller.

Who we use

These providers process personal data for the product. Card numbers and Direct Debit account numbers are entered on their pages. We store an identifier, not the full number.

• Supabase hosts the database, sign-in, file storage, and server-side jobs.
• Vercel hosts the website and the app.
• Stripe charges the SquadPilot subscription by card when that is how the club pays us.
• Adfin collects the SquadPilot subscription by Direct Debit when that is how the club pays us. A membership collection uses Adfin only on the club’s own Adfin account, when that club collects that way.
• GoCardless collects membership Direct Debit on the GoCardless account the club connects.
• Stripe Connect is the club’s connected Stripe account. Holiday camps, festivals, ticketed events, and public donations are charged there.

Resend sends transactional email. Invoice scanning runs on our hosting. We do not send documents to a third-party recognition or language-model service. Where a supplier stores data outside the UK, we use the UK International Data Transfer Agreement or the UK addendum to the EU standard clauses.

Cookies

Sign-in uses strictly necessary session cookies. Details are on the cookies page. There is no cookie banner, because we do not set optional cookies.

Security and support access

Access to production data is limited to people who need it. A named member of SquadPilot staff may open one club for 15–60 minutes, with a reason, read-only unless the session is limited to resending a staff invitation or correcting a primary guardian’s email or phone. Money, memberships, medical notes, and bank details cannot be changed in that session. Owners and admins are told when a session can make a change. We will tell the club and, where the law requires it, the ICO if a breach meets that threshold.

How long we keep our own records

Subscription and invoice records are kept for about six years for tax, then deleted. Club data is kept for the life of the subscription and then for the retention periods in the product, including the six-year period for bank details above. We do not keep it for our own marketing.

Your rights

You can ask for access, correction, erasure, restriction, or a copy of personal data, and you can object to processing based on legitimate interests. Where we rely on consent, you can withdraw it. We aim to answer within one month. We may ask you to confirm who you are. We may refuse a request that is manifestly unfounded or excessive, or that we must keep for tax or because a claim is still open.

For a membership, a child, a photo, Gift Aid, or a payment to the club, contact the club. They are the controller. For the SquadPilot subscription, contact billing@squadpilot.app. You can complain to the Information Commissioner’s Office at ico.org.uk. Please contact us first so we can try to put it right.

Related notices

Terms & Conditions, Data protection, Cookies.