Privacy Policy

1. Who we are

Club Portal (“Club Portal”, “we”, “us”, “our”) provides an online platform that helps amateur and grassroots football clubs manage availability, team selection, match-day administration, membership, and payments. This policy explains what personal data we handle, why, and the rights you have over it.

Club Portal is operated from the United Kingdom. For any privacy question or to exercise your rights, contact us at privacy@clubportal.football.

2. Clubs and Club Portal — who controls your data

When you use Club Portal as a player or member, the football club you belong to decides what data to collect about you and why — that club is the data controller of your membership information, and Club Portal acts as a data processor handling that data on the club's behalf and under our agreement with them.

For account, security, billing, and platform-operation data (for example login records and information we use to run and improve the service), Club Portal is the data controller. If you are unsure who to contact about your data, contact us and we will point you to the right place.

3. Data we collect

• Account details — name, email address, mobile number, and password (stored only in hashed form), or the basic profile from your Google account if you sign in with Google.
• Registration details — date of birth and address, used to confirm eligibility (including youth and veterans age groups) and for league/FA registration.
• Football activity — availability responses, team selections, match appearances, attendance, scores, and related statistics.
• Payment information— match fees, membership and pass purchases, and payment status. Card and bank details are handled directly by Stripe; we do not store full card numbers (see “Payments” below).
• Communications — messages sent to you (for example WhatsApp or SMS availability reminders) and your responses.
• Technical data — login and session records, and limited technical information needed to keep the service secure and working.

4. How we use your data

• To provide the platform — your login, profile, availability, selection, and stats.
• To take and reconcile payments for match fees, memberships, and passes.
• To send you club communications you would reasonably expect, such as availability requests and payment reminders.
• To support league and FA registration where your club requires it.
• To keep the service secure, prevent abuse, and meet our legal obligations.
• To provide optional AI-assisted features (such as recruitment shortlisting or page-building tools) when a club chooses to use them.

5. Legal bases

Under UK GDPR we rely on: performance of a contract (running your account and processing payments you make); legitimate interests (operating, securing, and improving the platform, and clubs administering their teams); legal obligation (accounting and tax records); and consent where required (for example certain communications, or a parent/guardian's consent for members under 18). You can withdraw consent at any time.

6. Who we share data with

We share data only as needed to run the service, with providers acting on our instructions:

• Stripe — payment processing and, for clubs, payouts.
• Supabase — secure database and authentication hosting.
• Vercel — application hosting and delivery.
• Twilio — WhatsApp and SMS messaging.
• Google — sign-in, if you choose to sign in with Google.
• AI providers (such as Anthropic and OpenAI) — only for the optional AI features a club enables, and only for the data submitted to those features.
• Your club and its authorised staff, who administer your membership.

We do not sell your personal data. We may disclose data if required by law or to protect the rights and safety of users.

7. Payments

Payments are processed by Stripe. When you pay a club through Club Portal, your card or bank details are collected and stored by Stripe under its own privacy policy. We receive confirmation of payment and a limited reference (such as the last digits of a saved card) but not your full card number.

8. International transfers

We aim to store data in the UK or EEA. Where a provider processes data outside the UK, we rely on appropriate safeguards such as UK adequacy regulations or standard contractual clauses.

9. How long we keep it

We keep personal data for as long as your account or your club's account is active, and afterwards only as long as needed for legitimate or legal purposes (for example, retaining payment records for the period required by tax law). When data is no longer needed we delete or anonymise it.

10. Your rights

Subject to UK data protection law, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. To exercise these rights, contact your club or us at privacy@clubportal.football. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

11. Under-18s and safeguarding

Clubs may register members under 18. Where they do, the club is responsible for obtaining any necessary parental or guardian consent and for following its safeguarding obligations. When a member indicates they are under 18, a club manager may be notified so appropriate safeguarding steps can be taken.

12. Cookies

We use only the cookies necessary to keep you signed in and to keep the service secure. We do not use advertising or third-party tracking cookies.

13. Changes to this policy

We may update this policy from time to time. When we do, we will change the “last updated” date above, and where changes are significant we will take reasonable steps to let you know.

14. Contact

Questions about this policy or your data? Email privacy@clubportal.football.