Privacy policy

1. Overview & roles

SquadForm is a platform that football clubs license for the individual development of their youth players. In data protection terms there are two levels:

• The club is the controller for the personal data of its players and coaches. It decides on the purposes and means of the processing.
• The platform operator (see below) provides the technical infrastructure and processes the data exclusively on behalf of and on the instructions of the club (processing on behalf of the controller pursuant to Art. 28 GDPR).

2. Controller / operator

Operator of the platform and contact for this policy:

2builders studio (owner: Mila Otto-Bickl)
Rue d’Oultremont 45
1040 Etterbeek, Belgium
Email: squadform@2builders-studio.eu

For the processing of player data, the respective club is the controller; you can obtain its contact details from your club or coach.

3. Purpose of the processing

SquadForm supports the individual sporting development of youth players: coaches record observations, from which weighted development focuses and individual weekly training plans are derived out of a curated exercise library. No weight, body fat or goals relating to them are recorded. Nutrition guidance consists exclusively of performance-oriented recommendations, not of diet or restriction requirements.

4. Data processed

• Master data of the player: name, position, stronger foot, year of birth, height (optional), available equipment
• Performance data: benchmarks (e.g. sprint time, juggling) and their progression, training progress (completed exercises, self-assessment of effort and difficulty)
• Coach notes, derived development focuses, coach ratings and feedback after sessions
• Player wishes and reflections (voluntary entries)
• Team events (training/matches) and season goals
• Account/login data (name, email; password only as a hash)
• Proof of parental consent (time and method)

Coach notes can be viewed only by the responsible coach and are technically not visible to the player (access control at database level, Row Level Security).

5. Parental consent (minors)

As the users are minors, the processing is tied to demonstrable consent from a parent or legal guardian. Without confirmed consent, no function of the application can be used by the player. Consent is recorded through the club or the coach on the basis of a signed parental consent form and confirmed in the application; optionally, an additional confirmation is sent to the parents by link. Consent can be withdrawn at any time with effect for the future, either with the club or at squadform@2builders-studio.eu.

The applicable digital age of consent may differ from country to country (in Germany and Belgium, for example, 16 and 13 years respectively). The club ensures that the consent complies with the law applicable at its location.

6. Legal basis

The legal basis for the processing is consent pursuant to Art. 6(1)(a) in conjunction with Art. 8 GDPR (consent of the holder of parental responsibility). Where data is processed to perform the licence agreement between the operator and the club, Art. 6(1)(b) GDPR applies.

7. Hosting & storage location (EU)

The database, authentication and file storage are run at Supabase in the EU region Frankfurt (Germany). The application is delivered via Vercel. No personal player data is stored outside the EU.

8. AI-assisted processing & processors

In order to derive the development focuses, to create the training plans and for team briefings, selected text content (coach notes, wishes, reflections, profile data) is transmitted server-side to Anthropic's Claude API and processed there. No automated decision with legal effect takes place — every training plan only becomes visible to the player after explicit approval by the coach.

Processors used:

• Supabase (database, auth, storage) — EU, Frankfurt
• Vercel (hosting/delivery of the application)
• Anthropic (Claude API, AI text processing)

Agreements on processing on behalf of the controller (Art. 28 GDPR) are in place or are being concluded with these providers. Where processing takes place outside the EU, it is safeguarded by appropriate guarantees (e.g. EU standard contractual clauses). Clubs conclude a data processing agreement (DPA) with the operator.

9. Retention period

Personal data is deleted as soon as it is no longer required for the purposes stated, at the latest:

• when a player leaves the team or on request, the player profile and all data linked to it (plans, notes, benchmarks, reflections, ratings) are deleted;
• when the user account is deleted, the associated personal data is removed;
• when the licence agreement with the club ends, that club's data is deleted after a transitional period.

10. Your rights

Data subjects and their legal guardians have the right to access, rectification, erasure, restriction of processing, data portability and objection, and may withdraw consent they have given at any time. There is also a right to lodge a complaint with a data protection supervisory authority.

Access and data export as well as the deletion of a profile can be initiated directly in the application via the coach or the club (the “Export data” / “Delete profile” functions); alternatively, an informal message to squadform@2builders-studio.eu is sufficient.