Legal
Draft: pending review by legal counsel. Do not publish as-is. Items marked [to complete] require legal decisions (controller identity, legal bases, retention periods). The rest reflects what the app actually processes.
Legal notice
Owner: [legal entity / name and tax ID to complete]. Domain: appsquadra.com. Contact: [email protected].
Site terms of use, intellectual property of brand and content, and limitation of liability: [to complete with counsel].
Terms of use
Outline pending drafting by legal counsel. The sections are listed so whoever drafts them knows what has to be covered, and so the app can already link here; the wording itself is not written.
1. Who provides the service, and to whom
[Legal entity, and what relationship is established: Squadra provides the service to the CLUB, and the club decides who joins it. That distinction governs everything else. To complete with counsel.]
2. Accounts and minimum age
[Requirements for holding an account, and minimum age. Still undecided: the GDPR (art. 8) allows anywhere from 13 to 16, and the Spanish LOPDGDD sets 14. The app currently treats anyone under 18 as a minor, which is a sporting criterion, not a data-protection one. To complete with counsel.]
3. What the club may do with its members' data
[The club is the controller for its squad's data and Squadra acts as processor. Split of responsibilities, and what happens when someone leaves the club. To complete with counsel.]
4. Acceptable use
[What may not be done with chat, playbook and uploaded files. To complete with counsel.]
5. Content uploaded by the club
[Ownership of photos, plays and documents; minimum licence needed to provide the service. To complete with counsel.]
6. Pricing
Squadra is a paid service. There is no free public beta, and this site does not sign anyone up: what you find here is the product and a way to tell us you are interested. The billing unit and what it includes are set out on the pricing page. [Price, date and final commercial terms to be completed with legal advice.]
7. Cancellation, suspension and end of service
[How an account or a club is closed, what is kept and for how long, and when access may be suspended. Ties in with the retention periods in the privacy policy. To complete with counsel.]
8. Liability
[Limits of liability. Important given what the app records: wellness and injuries are a club tracking tool, NOT a medical diagnosis, and the app does not replace a healthcare professional. To complete with counsel.]
9. Changes to these terms
Every version of this text carries an identifier, and each person's acceptance is stored alongside it. When a new version is published, the app asks for acceptance again. [Notice period and how it is communicated, to complete.]
10. Governing law and jurisdiction
[To complete with counsel.]
Privacy policy
1. Data controller
[Controller identity, postal address and contact to complete. If a Data Protection Officer (DPO) is appointed, provide their contact.] For privacy matters and to exercise your rights: [email protected].
2. What data we process
- Account: email address and name.
- Athlete profile: photo, jersey number, positions, category/team and contact details.
- Health and wellness data (special category, GDPR art. 9): wellness diary (sleep, fatigue, soreness, mood, weight…), injuries and clinical data (diagnosis, treatment, medical notes) and physiotherapy sessions.
- Minors' data: athletes may be minors; we collect data about their legal guardians and their consents (image, data, medical, travel).
- Financial management: tracking of fees and payments (payment status; the app does not process money nor store card data).
- Service usage: device push notification token and minimal technical operating data.
3. Purposes and legal basis
Provide the club management service (call-ups, routines, wellness, payments, chat…). Anticipated legal bases: performance of the contract/service, explicit consent for health data and minors' data (granted by their guardians), and the club's legitimate interest for sports management. [Final legal-basis mapping per purpose to complete with counsel.]
4. Minors
Processing of minors' data is carried out with the consent of their legal guardians, managed in the app itself (typed consents per guardian). [Minimum age, consent verification and detail to complete with counsel.]
5. Health data (special category)
Wellness, injury and clinical data are processed with explicit consent and access is restricted by role and capability in the database (RLS policies; clinical data is only visible to those with the relevant medical capability in that club). [Legal detail to complete.]
6. Retention
[Retention periods by data type to complete with counsel; e.g. while the club membership exists and the applicable legal periods after leaving.]
7. Processors and third parties
To operate the service we use providers acting as data processors:
- Supabase: database, authentication and storage (EU region).
- Resend: transactional email delivery (confirmation, password recovery, notices).
- Cloudflare: website hosting, DNS and CDN.
- Expo / EAS: app builds and push notifications.
- Zoho Mail: project email.
- Sentry: application error reporting (EU region, Germany). Receives the internal account identifier, the technical error message, and the app version and platform. It does not receive names, emails or health data.
[Confirm data-processing agreements (GDPR art. 28) with each provider.]
8. International transfers
Data is hosted in the European Union (Supabase project in EU region). [If any provider processes data outside the EEA, state the safeguards (standard contractual clauses, etc.); to complete with counsel.]
9. Your rights
You may exercise the rights of access, rectification, erasure, objection, restriction, portability and to withdraw consent at any time by writing to [email protected]. You can also delete your account from within the app. You have the right to lodge a complaint with the supervisory authority (in Spain, the AEPD).
10. Security
We apply role- and capability-based access control in the database (RLS), encryption in transit and separation of sensitive data. [Technical and organisational measures to detail.]
11. Changes to this policy
[How changes are communicated; to complete.]