Security and data protection

Where the data lives

The database and sign-in run on Supabase in the European Union (Ireland).
The app runs on Cloudflare’s servers in the EU region.
Players’ photos and documents are kept in private Cloudflare R2 storage under EU jurisdiction.
Connections are encrypted (HTTPS) and the database is encrypted at rest.
We make a backup every day. It is encrypted with AES-256 before it leaves the server and kept for 30 days on GitHub (Microsoft, USA), under the EU’s safeguards for transfers (the EU-US Data Privacy Framework or standard contractual clauses). Without the key, a backup cannot be read.

Each club sees only its own data. The database itself enforces this separation, and automated tests check every part of the app to make sure one club cannot see another’s data.
Inside the club, each person sees what their role allows: the owner sees everything, managers run the day-to-day and coaches work with their teams. The club can limit coaches to the players of their own teams.
Parents, in their portal, see only their own children’s data.
A player’s photo is added only with the family’s consent, which they can withdraw at any time. Players’ photos and documents are never public: only the staff who can see that player and the player’s family can see them.

The data can only be reached through the app, which checks on every request who you are and what you may see. Direct access to the database from outside is switched off.
Every user can turn on two-step sign-in (a code from an authenticator app). The app reminds owners who have not turned it on yet.
The club’s online payment keys (monobank, LiqPay) are stored encrypted. Card details are entered on Stripe’s or the bank’s page and never reach us.
The change log shows who changed what and when (30 days).
If the platform administrator enters a club to give support, it is recorded in the club’s log and the owner sees who entered and when. Without entering, the administrator sees only the club’s figures, with no names or contacts.
If a security breach happened, we would notify the affected clubs without undue delay; our procedure aims to do it within 24 hours.

A club’s data is kept while the club uses it. When a club is deleted, its data is removed from the database at once and from the backups within 30 days. Before that, the club can export everything (Excel, and ZIP files with photos and documents).
An inactive club (on the free plan, or with a paid plan that ended more than 30 days ago) is archived after 120 days without any activity from its staff and deleted with its data after 180 days. We warn the owner by email at 90, 120 and 173 days.
An account that belongs to no club and has not been signed into for 12 months is deleted, with an email warning 30 days before. To keep it, just sign in.
Archived players: after 3 years we suggest that the club anonymises them.

The club is the controller of its athletes’, families’, children’s and staff’s data: it decides what data to keep and why. Stanio Sport is the processor: we store and process that data on the club’s behalf, as the club uses the service, and never for our own purposes.
Health data (medical certificate, insurance, fields such as “allergies”) is a special category: the club processes it with the families’ explicit consent, which is recorded.
The terms of use already include a data processing section (Art. 28 GDPR). A full data processing agreement (DPA) for clubs is being prepared with our lawyer.
For user accounts, notifications, the change log and backups, we are the controller.

Parents see their children’s data in the portal and can correct the name and date of birth. Every user can download their data and delete their account in the settings.
For data a club keeps (including a child’s), contact the club or write to us at privacy@stanio.app. We reply within one month.
You can also complain to the Spanish Data Protection Agency (aepd.es) or to the authority in your country.
All the details, with the list of providers: privacy policy.