Privacy Policy

Sporit is a product of Stride - F.Z.E, a Free Zone Establishment with limited liability licensed by the Free Zones Authority of Ajman under licence number 56922 ("Sporit", "we", "us"), which operates the Sporit club and academy management system: this website, the admin panel clubs use, the websites we host for clubs, and the mobile apps for parents, players and coaches. Our registered office and contact details are on the Contact page.

Data protection law distinguishes the organisation that decides why and how personal data is used (the controller) from one that handles it on that organisation's behalf (the processor). We are both, depending on who you are:

When you visit sporit.app our hosting provider records the technical data every web server records: your IP address, the pages requested, the time, and your browser type. We keep these logs for security and to keep the site running, for no longer than ninety days.

We use Google Analytics to understand which pages are read and where visitors come from, only if you accept analytics cookies in the banner. Until you do, no analytics script loads and no analytics cookie is set. You can change your choice at any time from the Cookies link in the footer. Our Cookie Policy lists every cookie.

Your language choice is remembered in your browser's local storage. That is not sent to us.

Legal basis: our legitimate interest in running and securing the site (logs), and your consent (analytics).

When you book a demo we collect what you enter: your name, work email, phone number, role, the club's name, country, approximate number of players, preferred language, what you use today, the club's website or social page, and how you heard of us. We use it to contact you, prepare and run the demo, set up a sandbox carrying your club's name if you ask for one, and follow up on that conversation. We do not add you to a newsletter and we do not share your details with anyone for their own marketing.

Demo requests are stored in our own database and mirrored to HubSpot, the customer relationship system our sales team works in (hosted in HubSpot's European data centre). If you go on to subscribe, the record becomes part of your customer account. If you do not, we delete the request and the HubSpot record eighteen months after our last contact with you, or sooner if you ask.

Legal basis: taking steps at your request before entering into a contract, and our legitimate interest in following up a request you made.

For each club we hold the details needed to run its account: the club's name, country, currency, time zone, branding and settings; the names, email addresses, roles and permissions of its staff; the sign-in records for those accounts; billing details for the subscription; and the emails we exchange for support.

We use this to provide, secure and bill the service, to tell administrators about changes that affect them (section 16 of the Terms of Service), and to support them. We keep it for the life of the subscription and then as section 13 of the Terms describes.

Legal basis: performance of our contract with the club, and our legitimate interest in securing the service.

Your club decides what it collects. Depending on the modules it has switched on, the service can hold the following about you or your child, entered by you or by the club's staff:

• Identity and contact: names, date of birth, relationship to the child, email, phone, preferred language, and the sign-in details for each account.
• Football: program, age group, training group, team, position, shirt name and number, attendance, tryout results, coach ratings on the club's own metrics, the Player Card, goals and assists, development summaries and notes the coach shares with the family.
• Money: the plan chosen, bills, payments and their method, receipts you upload for bank transfers, refunds, discounts and promotions applied, and orders from the store. Card details themselves are held by Stripe, not by us.
• Documents and photos: the identity document your club's country requires, a player photo and the passport number and expiry date, as far as the club has switched each on. The photo's background is removed for cards and squad lists; that processing happens inside our own systems and the photo is not sent to any third party for it.
• Messages: group chats for your child's group and team, direct messages between a parent and a coach, announcements, and any report you make about a message.
• Device: the push notification token of the phone you signed in on, so the club's notifications reach it, and the app version.

We process all of this only to run the service for your club: to show you what the club has decided you should see, to send the notifications the club's settings trigger, to take the payments the club has set up, and to keep the club's records straight. We do not use it to profile you, to advertise to you, or to train any model.

How long it is kept is the club's decision within our Terms: while you are with the club, and after that until the club removes you or its subscription ends (section 13 of the Terms). You can delete your own account at any time; section 9 explains what that does.

Most players on the service are children. Their data is entered by a parent or guardian or by the club, never by a child registering on our public site, and the club is responsible for having the consent its law requires. A child's own login, where the club allows one, is created by the club or the parent.

The service enforces, for every club, that a player under eighteen cannot receive private messages and uses group chats only; that a parent can switch messaging off for their child; that the club's staff can moderate every group; and that a child's identity documents and photos are visible only to the child's family and the club's staff. These are not settings a club can turn off.

If you believe a child's data has been entered into the service without the required authority, write to us at the address on the Contact page and we will work with the club to remove it.

• Your club's staff, according to the roles and permissions the club sets. Staff of one club can never see another club's data: every record is tagged with its club and every request is checked against it.
• Other families in the same group or team, in the group chats the club creates, see the names of the group's members and what is posted there.
• Providers that run parts of the service for us, listed with their purpose and location on our Security page: hosting, card payments, email delivery, push notifications, our sales system and, on this site only and with consent, analytics. Each is bound by a contract that limits them to our instructions.
• Apple and Google, when a notification is delivered to a phone through their systems, and when the app is downloaded from their stores under their own privacy terms.
• Authorities, where the law requires us to disclose, and professional advisers under confidentiality. We will tell the club first where we are allowed to.
• A successor to our business, if Sporit is sold or merged, under this policy.

We never sell personal data and never share it for anyone else's marketing.

The service runs on Amazon Web Services in Ireland. Databases are encrypted at rest and every connection is encrypted in transit. Uploaded files sit in private storage and are served through short-lived signed links. Automated database backups are kept for seven days.

Some providers act from outside the European Union, notably in the United States. Where personal data leaves the European Economic Area, the United Kingdom or the United Arab Emirates, we rely on the European Commission's standard contractual clauses or an adequacy decision, and on the provider's own certifications, as listed on the Security page. Clubs in other jurisdictions may ask us for the transfer terms their law requires.

A parent, guardian or player can delete their own account from the app. This is what happens, in order:

1. Every open enrolment of a child being deleted ends that day, the way a withdrawal does: a card subscription stops, unpaid bills for time not trained are cancelled, and the child leaves teams and chats. The month in progress stays owed to the club. If any of this fails, nothing else happens, so an account cannot vanish while a card keeps being charged.
2. Files are deleted: profile photos, identity documents, registration photos and the receipts you uploaded, with their backups.
3. Personal records that are not money are deleted: push tokens, language preferences, invitation codes, documents, tryout applications, favourites and the family links.
4. The account itself becomes an anonymised record with no name, email, phone, username, password or photo. The club's payments, bills, match results and group messages keep pointing at that record, so the club's accounts and other people's conversations still add up.

Deleting a parent's account takes each child who has no other parent linked. A child with another linked parent stays with that parent and is only unlinked from the deleted account. A player deleting their own account takes only that account.

Otherwise we keep personal data for as long as the purpose in this policy needs it: club data for the life of the club's subscription and then as section 13 of the Terms describes; demo requests for eighteen months after last contact; server logs for ninety days; database backups for seven days. Records we must keep by law, or that are needed to establish or defend legal claims, are kept only for that purpose.

Depending on where you live, you may have the right to access the personal data held about you, to have it corrected or deleted, to restrict or object to its processing, to receive a copy in a portable form, to withdraw consent where processing is based on it, and to complain to a data-protection authority. In the European Economic Area and the United Kingdom these rights come from the GDPR and the UK GDPR; in the United Arab Emirates from Federal Decree-Law No. 45 of 2021; in California from the CCPA; and other laws grant similar rights.

If your club is the controller, send your request to the club; it can see and change most of your data itself, and we help it with the rest. If Sporit is the controller, write to us at the address on the Contact page. We answer within one month, and tell you if we need longer. We may ask you to confirm your identity first. We never charge for a request unless the law allows it and the request is clearly excessive.

Our Security page describes how we protect personal data: encryption, isolation between clubs, access control, backups, how we develop the software and how we handle a security report or an incident. If we learn of a breach affecting your data we tell your club without undue delay and within seventy-two hours, and your club tells you where the law requires; where Sporit is the controller we tell you directly.

We update this policy when the service or the law changes. The date and version at the top of this page say when. For a change that affects how we use data already collected, we tell clubs' administrators by email and in the admin panel at least thirty days before it takes effect, and clubs tell their families where their own notices require it.

Questions about this policy, or a request about your data where Sporit is the controller, go to the email address on the Contact page, with "Privacy" in the subject. If you are in the European Union or the United Kingdom you may also complain to your local data-protection authority; in the United Arab Emirates, to the UAE Data Office.