Privacy Policy

This policy explains what personal data we process on the SoccerLink website and mobile app, for what purpose, for how long, who we share it with and what rights you have. It is written in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish data protection law (LOPDGDD), and it takes users in the United States into account.

1. Data controller

• Controller: SoccerLink, [RAZÓN SOCIAL Y DOMICILIO PENDIENTES]
• Tax ID: [NIF / CIF]
• Privacy contact email: [EMAIL DE CONTACTO LEGAL]
• Website: https://soccerlink.app

If we later appoint a Data Protection Officer, we will publish their contact details on this page.

2. What data we process on the website

Depending on your relationship with SoccerLink, we may process:

• Contact and identification data: first name, surname, email, phone or WhatsApp, country and city.
• Sporting profile data: position, club, division, honours, statistics, career history and contract status.
• Images and audiovisual material: photos and videos you provide or that come from verified public sources.
• Social media accounts you choose to link to your profile.
• Browsing data: basic technical information and aggregated, anonymous usage analytics, without cookies (see our Cookie Policy).

Your website dashboard includes optional questionnaires and sections about health and physical condition, and you can upload reports or device data. If you use them, we process health data, which is a special category of data. [SECCIÓN DE DATOS DE SALUD Y FÍSICOS PENDIENTE: base jurídica, qué se publica y qué queda privado, y plazos]

3. What data we process in the app

• Account: your name, your email, your role and, if you have one, your player profile. The app does not store passwords: you sign in on the SoccerLink website.
• Year of birth: only the year, not the full date. It is used to check that you are at least 16.
• Acceptance of the Terms and Guidelines: which version you accepted and when.
• Profile role and description: your football role (player, coach, assistant coach, team delegate, retired player or football professional) and a short description. The SoccerLink team sets them based on what you tell us. They are public: they appear on your app profile and on your web profile.
• Status: whether you are active or retired. You choose it in the app settings and it is public: it appears on your profile and is taken into account by search and by clubs.
• Account status: whether it is active, has posting suspended, is suspended or is pending deletion and, if a suspension is temporary, until when.
• Posts: the photos and videos you upload, the caption, the publication date, the size and duration of each file, and whether the post is public or private. A private post can only be seen by you and the SoccerLink team, who use it as material to build your web profile (see section 3a).
• Connections: who you follow and who follows you, the likes you give and the comments you write.
• Blocks: who you have blocked.
• Private messages: the text of the messages you send and receive, with whom, when, and how far you have read each conversation. Only the two people in the conversation can see them. We do not read or automatically scan them: the moderation team only sees a specific message if one of the two reports it. The exception is the official chat with "SoccerLink." (see section 3a).
• Notifications: who follows you, who likes and who comments on your posts, and whether you have seen them. If you turn on alerts on your phone, we store your device's push identifier (a code Apple or Google give us so we can send you alerts) and its system (iOS or Android).
• Reports: the ones you make and the ones your content receives, with the reason and any details written. The reporter is not visible to the person reported.
• Moderation actions on your content or your account, with their reason.
• Minimal technical data: server logs (which request was made, when, with what result and how long it took) and per-minute counters to limit abuse. We never log your access credentials.
• Basic usage events, for example that a video was played. They do not include the content of your posts or comments.
• App error log: when the app closes unexpectedly, a technical report of the failure (device model, system and app version, and where it failed), without your personal data or credentials. This will work once we turn on the error logging service.

3a. Your SoccerLink file and the official chat

At SoccerLink our team builds your web profile. To do it properly we keep a file for each player we manage, which only SoccerLink administrators and our internal tools can see:

• The official "SoccerLink." chat is pinned in your messages. It is a conversation between you and the SoccerLink team, not between two people: administrators read and answer it. Whatever you write there (for example, asking us to change something on your profile) is added to your file for the team to review. We also send you questionnaires through that chat; your answers are stored in your file.
• Activity log: when you post, delete a post, change its visibility or caption, change your photo, change your status or write to us in the official chat, a note is added to your file. It tells the team what to review on your web profile and what they did about it.
• Private posts: the team can see them and use them to build and update your web profile, just like the material you send us in other ways.
• Questionnaires by link: we send you links (usually through Instagram) with questions you answer by speaking. We keep the recording of your voice, its text transcription and your multiple-choice answers, each with its date. Some questions may be about your health, your injuries or your contract situation: you only answer them if you want to.
• Material link: through a fixed link you can send us photos, videos, GPS screenshots, reports (medical ones too) and texts. They are stored in private storage, only the team sees them, and we use them for your file and your profile.
• Artificial intelligence tools: to transcribe your audio, sort the material and help write your profile we use AI services (see section 9). A person on the team always reviews their output before it appears on your profile, and it is not used to make automated decisions about you.
• Your profile history: we record, with dates, what you add, remove or hide from your profile, so that we never put back something you have taken down.

This file is based on performance of the contract (building and maintaining your profile, which is the service you ask us for) and on our legitimate interest in the profile being accurate. It is kept while your account or your profile exists.

If you send us a notice about illegal content or copyright through the contact and takedown form without an account, we process your name, your email and what you tell us in the notice.

4. What we do not collect

• Your location. The app does not ask for location permission, and when you upload a photo we remove its metadata (EXIF), including GPS coordinates.
• Your contacts.
• Tracking across third-party apps or websites. There is no advertising in the app and we do not use advertising identifiers.
• The content of your posts in analytics.

We do not sell your data or share it with third parties for advertising.

5. Minors

• The app and SoccerLink accounts are for people aged 16 and over only. The rule is the same in Spain and in the United States.
• The first time you open the app we ask for your year of birth. If you are under 16 you cannot use it, and there is no exception with parental consent.
• We do not knowingly collect data from anyone under 16 through the app. If we find that an account belongs to someone under 16, we close it and delete their data.
• If a website profile belongs to someone under 16, we only publish it with the express authorisation of their parents or guardians. If you are a parent or guardian and wish to exercise rights over a minor's profile, write to us at [EMAIL DE CONTACTO LEGAL].

6. Purposes and legal basis

• Providing the app and website service (your account, posting, following, liking, commenting, blocking): performance of the contract you accept with the Terms.
• Checking that you meet the minimum age: compliance with legal obligations and performance of the contract.
• Recording which version of the Terms and Guidelines you accepted: legitimate interest in being able to prove it and compliance with legal obligations.
• Handling reports, moderating content and reporting illegal content to the relevant authorities: compliance with legal obligations (including the EU Digital Services Act) and legitimate interest in keeping the platform safe.
• Technical data, usage limits and error logging: legitimate interest in the service working and being secure.
• Handling your profile request and communicating with you: your consent or pre-contractual measures.
• Creating and publishing your professional profile on the website: your consent and legitimate interest in giving visibility to football talent.
• Connecting players with clubs, coaches and agents: legitimate interest and your consent when you enable contact.
• Building profiles from verified public information: legitimate interest, with the right to object and erase.
• Measuring website usage and improving it: legitimate interest (aggregated, anonymous, cookieless analytics).

7. Curated model and public sources

On the website, our team builds every profile. Some information may come from verified public sources (sports media, official club websites, federations). If you appear on SoccerLink and want to review, correct or remove your profile, you can do so at any time (see sections 11 and 12).

If you did not give us the data yourself

We reach some players before they have written to us: a SoccerLink partner (recruiter) gives us your name and Instagram username, or we find you in public sports sources. In that case we keep your name, Instagram username, club and position and, if already published, your stats, with the source of each figure. We do this on the basis of our legitimate interest in offering you a profile, and we message you on Instagram to tell you. If you are not interested, tell us in that chat or by email and we delete your data. If you do not create your account, we delete it automatically two months after our first message; if you want your profile later, just ask for it again. The recruiter only sees the status of the players they brought us, never your private data.

8. How long we keep data

• Account, year of birth, acceptance of the Terms, profile, followers, likes and blocks: while your account exists.
• Private messages: until you delete the message or either person deletes their account; the whole conversation is then deleted. "Delete conversation" only removes it from your inbox: the other person keeps it.
• Posts and comments: until you delete them or delete your account. When you delete a post it stops being visible to everyone straight away, but its files are kept for 30 days in an internal bin that only the SoccerLink team can see, in case that material also has to come off your web profile. After 30 days they are removed from storage. The internal record, without the files, stays marked as deleted while your account exists.
• Notifications: while your account exists; if the action behind one is undone (removing a like, unfollowing, deleting a comment), it is deleted too.
• Device push identifiers: until you sign out on that device, Apple or Google tell us it is no longer valid, or you delete your account.
• File, activity log, voice recordings and material-link files (section 3a): while your account or your profile exists. If you never create your account: see section 7.
• Reports and moderation actions: up to 2 years after they are closed. If your account is deleted, reports that concern you are kept without the reporter's data.
• Server logs: 30 days.
• Abuse-limiting counters: deleted every day.
• Usage events: 13 months.
• App error log: [PLAZO DE CONSERVACIÓN DEL REGISTRO DE ERRORES PENDIENTE].

After these periods, data is deleted or anonymised, unless the law requires us to keep it, in which case it is blocked and used only for that purpose.

9. Processors

To provide the service we rely on providers who process data on our behalf under contract:

• Neon: database.
• Vercel: hosting of the website and the app's API, server logs, and file storage for website profiles.
• Cloudflare: storage and delivery of the photos and videos posted in the app.
• Resend: sending emails, once we turn it on.
• Sentry: app error logging, once we turn it on.
• Cloudflare R2 (private storage): the audio, reports and files you send us through the questionnaire and material links.
• Anthropic (Claude): the AI assistant that helps the team sort your material, check your stats and write your profile. It receives the parts of your file that each task needs.
• ElevenLabs or OpenAI: transcription of your voice answers into text, once we turn it on. They only receive the recording.
• Expo (650 Industries), Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging): delivering alerts to your phone, once we turn them on. They receive your device's push identifier and the text of the alert (for example, "Ana liked your post"), nothing else.

If a verified club, coach or agent expresses interest in your profile, we will only share your contact details with your express authorisation. We may also disclose data to the authorities where the law requires it, for example in the case of content that puts a minor at risk.

International transfers

Some of these providers may process data outside the European Economic Area, in particular in the United States. In those cases we rely on the safeguards provided by the GDPR, such as the European Commission's Standard Contractual Clauses or the EU-U.S. Data Privacy Framework where the provider is certified.

10. Your rights

You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw your consent where it is the basis of the processing. Write to us at [EMAIL DE CONTACTO LEGAL] stating which right you wish to exercise. We will reply within the legal time limit of one month.

Access and portability: how we give you your data

If you ask for a copy of your data, write to us from your account email. We will check that the request comes from you and send you a JSON file (a standard format you can open with any editor and take to another service) with your account, your profile, your posts (public and private), your comments, your likes, who you follow and who follows you, the messages you have written, your notifications and the activity log of your file. Photos, videos and files are included as download links that expire after 7 days. It is free.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

If you live in the United States

• You can ask us what data we hold about you, and ask us to correct or delete it, by writing to [EMAIL DE CONTACTO LEGAL].
• We do not sell your personal data or share it for advertising based on your activity on other services.
• We will not treat you differently for exercising these rights.
• The app is not directed at children under 13 and we do not collect their data: the minimum age is 16.

11. Deleting your account

You can delete your account from the app settings. There will also be a web page to do it. Deleting is different from marking your profile as inactive, which only changes how it is shown.

When you ask to delete your account:

1. The account is locked and all your sessions are closed.
2. Your profile and your content stop being visible straight away.
3. Your photos and videos are removed from storage, including private ones and those in the 30-day bin: deleting the account does not wait for that period.
4. Your follows, likes and blocks are deleted.
5. Your account is deleted and, with it, your professional profile on the website, your posts and your comments.
6. Your conversations, including the official chat with SoccerLink, and your notifications are deleted.
7. Reports you made or that concern your content are kept without data identifying you as the reporter, for the period in section 8.
8. Your public address (your profile name on the website, for example /p/your-name) stays reserved and is not given to anyone else, so nobody can use it to impersonate you. It holds no data about you beyond that name.

If the process is interrupted, it resumes until it finishes. We only keep what the law requires us to keep.

[PENDIENTE DE DECIDIR: qué se hace con la ficha editorial interna del perfil web tras el borrado de la cuenta y durante cuánto tiempo se conserva, si se conserva]

12. How to correct or remove your website profile

Write to us at [EMAIL DE CONTACTO LEGAL] from the email linked to your profile (or, if you are a minor's guardian, proving your status) and we will process the correction or removal. Removing a published profile is free.

13. Security

We apply reasonable technical and organisational measures to protect your data: the app does not store passwords, access expires and is revoked when you sign out, and every change is checked on the server against the owner of the content. No system is foolproof, but we work to reduce the risks.

14. Changes to this policy

We may update this policy to reflect legal or service changes. Each version has a date that identifies it and the current one is always on this page. If the changes are substantial, we will let you know through the official chat in the app or by email, and the app will show you the change the next time you open it.

15. Contact

For any privacy matter: [EMAIL DE CONTACTO LEGAL].