Privacy Notice

SquadBase is provided by Goals for Growth Ltd, a company registered in England and Wales. Company number: 16444768. Registered office: Suite A, 82 James Carter Road, Mildenhall, IP28 7DE. This notice explains what personal data SquadBase handles, who is responsible for it, why it is used and what rights you have under UK GDPR and the Data Protection Act 2018.

Who is responsible for which data

• Team data — squad lists, player names and numbers, availability, fixtures, line-ups, stats, lift requests, match votes and emergency contacts. The team or club using SquadBase decides what is collected and why, and is the controller. Goals for Growth Ltd processes it on the team's behalf as a processor, under the Data Processing Schedule in our Terms.
• Our own data — account sign-in details, team subscriptions, support messages, security logs and early-access waitlist sign-ups. Goals for Growth Ltd is the controller.
• Payments — Paddle.com is the Merchant of Record and handles card details, billing addresses, tax and invoices as its own controller under its own privacy notice. We never see full card details.

What is collected

• Account: name, email address, password (stored hashed) or Google sign-in identifier.
• Team: team name, sport, age group, logo, kit design, venues and fixtures.
• Players (added by coaches): name, squad number, availability, line-ups, stats and awards.
• Emergency contacts (added by parents): contact name, relationship to the player, phone number.
• Lifts: pickup notes a parent writes when asking for a lift.
• Waitlist: name, email, team name, sport and role.
• Technical: IP address, device and browser type, and security/usage logs.

Why it is used and the lawful basis

• Running your account and the service you or your team signed up for — contract.
• Keeping the service secure and preventing misuse — legitimate interests.
• Answering support requests and improving the service — legitimate interests.
• Tax, accounting and legal duties — legal obligation.
• Launch and product updates to waitlist sign-ups — consent, which you can withdraw at any time.
• Team data: each team, as controller, decides and documents its own lawful basis. For most teams this is likely to be legitimate interests in organising matches and being able to reach a parent or guardian. In a genuine emergency, contact details may be shared with emergency services to protect a player's vital interests.

Children's data

Children do not hold SquadBase accounts. A coach adds the player, and a parent links to their own child with a one-time code from the team. A child's details are visible only to that team's coaches and staff and, for private details, only to the child's linked parent. Parents cannot see other children's private details. Children's data is never sold and never used for advertising or profiling.

No health records

SquadBase does not collect medical conditions, allergies, medication or other health information. Essential medical needs and action plans (for example inhalers or EpiPens) must be agreed directly between parents and coaches outside the app.

Who can see emergency contacts

• Only that team's coaches and staff, and the player's linked parent.
• Coaches can print a confidential pitchside sheet and must store and destroy it securely.
• Parents can change or delete the contact at any time.

Service providers

We use these providers to run SquadBase:

• Lovable (with Supabase) — app hosting, database, sign-in and email sending.
• Cloudflare — hosting network and security.
• Paddle.com — checkout, subscriptions, tax and invoicing (Merchant of Record).
• Google — only if you choose "Continue with Google" to sign in.
• Professional advisers and authorities where the law requires it.

WhatsApp sharing buttons only open WhatsApp on your own device with a pre-filled message; we do not send data to WhatsApp.

International transfers

Some providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or approved safeguards such as the UK International Data Transfer Addendum.

How long data is kept

• Account data: while your account is active, then deleted when you ask us to close it.
• Team data: while the team is active. When an owner deletes a team it is held for 30 days so the deletion can be cancelled, then permanently erased with its players, fixtures, availability and emergency contacts.
• Deleting a player removes their details, line-up places and emergency contact from the team.
• Waitlist sign-ups: until launch updates end or you ask to be removed.
• Billing records: kept by Paddle and us as long as tax law requires (usually up to 6 years).
• Backups are overwritten on a rolling basis and may hold deleted data for a short time.

Security

Data is encrypted in transit, and the database enforces strict separation between teams and role-based access for coaches and parents.

Cookies

We only use essential browser storage needed to keep you signed in and remember settings such as light or dark mode. We do not use advertising or analytics cookies, so no cookie banner is needed.

Your rights

You can ask to:

• see a copy of your data (access);
• correct inaccurate data;
• delete your data, where there is no legal reason we or your team must keep it;
• receive data you gave us in a portable format, where the law gives that right;
• restrict or object to processing, and withdraw consent at any time.

For team data, we will usually pass your request to the team, which as controller decides how to respond, and we help it do so. We may need to check your identity first. We aim to respond within one month; complex requests can take longer, and we will tell you if so. Some rights have legal limits, so not every request can be met in full.

You can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to help first.

Contact

Privacy questions and requests: support@squadbase.org. This is our current monitored contact; a dedicated privacy address will be added here once it is live.

ICO data protection fee: Goals for Growth Ltd has completed the ICO self-assessment, which indicated no fee is currently payable. We will review this when commercial trading begins.