Privacy Policy

1. Who We Are

InsideFooty is a player development platform operated by Global Talent Leaders LTD ("we", "us", "our"). We are registered in England and Wales and are the data controller for personal data collected through our platform.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address
• Password (stored in encrypted form)
• Role (club admin, coach, or parent)
• Club name and logo (for club accounts)

2.2 Player Information

For players registered on the platform, we collect:

• Player name (first name and last initial only displayed to parents)
• Age group and team assignment
• Development ratings across four categories (Technical, Tactical, Physical, Psychological)
• Session attendance and performance notes
• Badges and achievements earned
• Player photos (if uploaded by parents or coaches)

2.3 Usage Information

We automatically collect:

• Device information and browser type
• IP address and approximate location
• Pages visited and features used
• Date and time of access

3. Children's Data Protection

We take the protection of children's data extremely seriously:

• Parental Consent: Parent/guardian accounts must be linked to view their child's data. This link is initiated by the club and requires parent verification.
• Minimal Data: We only collect data necessary for player development tracking. We do not collect sensitive categories of data unless essential (e.g., medical notes relevant to training).
• Access Controls: Player data is only visible to authorised club staff and the player's linked parents.
• Data Retention: Player data is retained only while the player is active at the club. Upon request, all data can be deleted.
• No Marketing: We never use children's data for marketing purposes or share it with third parties for advertising.

4. How We Use Your Information

We use personal data for the following purposes:

• Providing the Service: To enable clubs to track player development and share progress with parents.
• Account Management: To create and manage your account, process payments, and provide customer support.
• Communications: To send essential service updates, session notifications, and progress reports (if enabled).
• Improvement: To analyse usage patterns and improve the platform (using anonymised, aggregated data).
• Legal Compliance: To comply with legal obligations and protect our rights.

5. Legal Basis for Processing

Under UK GDPR, we process personal data on the following legal bases:

• Contract: Processing necessary to provide the services you've signed up for.
• Legitimate Interests: For platform improvement, security, and fraud prevention, where our interests don't override your rights.
• Consent: For marketing communications (you can withdraw consent at any time).
• Legal Obligation: Where required by law.

6. Data Sharing

We share personal data only in limited circumstances:

• Within the Club: Player data is shared with authorised club staff (coaches, administrators) and linked parents.
• Service Providers: We use trusted third parties for hosting (Vercel), database (Supabase), payments (Stripe), and email (Resend). These providers are contractually bound to protect your data.
• Legal Requirements: If required by law, regulation, or legal process.

We never sell personal data to third parties or share it for advertising purposes.

7. Data Security

We implement appropriate technical and organisational measures to protect your data:

• Encryption in transit (TLS/SSL) and at rest
• Secure authentication with hashed passwords
• Role-based access controls
• Regular security reviews and updates
• Secure cloud infrastructure with industry-standard certifications

8. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy. Specifically:

• Account data: Retained while your account is active, plus 30 days after deletion.
• Player data: Retained while the player is registered with the club. Deleted upon request or when the player leaves.
• Payment records: Retained for 7 years for tax and legal compliance.
• Usage logs: Retained for 12 months for security and analytics.

9. Your Rights

Under UK GDPR, you have the following rights:

• Access: Request a copy of your personal data.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your data ("right to be forgotten").
• Restriction: Request limited processing of your data.
• Portability: Receive your data in a portable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw consent for marketing at any time.

To exercise these rights, contact us at privacy@insidefooty.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Cookies

We use essential cookies to enable core functionality (authentication, preferences). We do not use tracking or advertising cookies. For more details, see our cookie banner when you first visit the site.

11. International Transfers

Our service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions) to protect your data in accordance with UK GDPR.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by email or through the platform. The "Last updated" date at the top of this page indicates when this policy was last revised.

13. Contact Us

If you have any questions about this privacy policy or our data practices, please contact us: