Privacy Policy

1. Data Controller

Gilla Läget
Business ID: 3531498-2
Ulvilantie 8 C 41, 00350 Helsinki, Finland
Email: info@pitchlog.app

The data controller is responsible for the lawful processing of personal data within the Pitchlog application.

2. Data We Collect

Pitchlog collects and processes the following personal data:

User accounts (coaches and head coaches)

• Email address (registration and sign-in)
• Name (optional display name)
• Club name and role within the application

Player data (entered by the coach)

• Player first and last name
• Playing time entries per match (minutes, substitutions)

Technical data

• Login timestamps and session tokens (Firebase Authentication)
• Application usage and error logs (Google Cloud)

We do not collect players' dates of birth, addresses, phone numbers or any other contact details.

3. Purposes of Processing

Data	Purpose
Email address	Account creation, sign-in and service communications
Player name	Linking playing time entries to the correct player
Playing time entries	Tracking, statistics and reporting
Technical logs	Application reliability and bug fixing

4. Legal Basis (GDPR)

Performance of a contract (Article 6(1)(b))

The coach's email address and basic account information are processed because it is necessary to provide the service under the agreement concluded with the user.

Legitimate interests (Article 6(1)(f))

Player names are processed on the basis of the legitimate interests of the coach and club. Tracking playing time requires that entries can be linked to named players. The coach or club is responsible for ensuring that players (or, in the case of minors, their guardians) have been appropriately informed.

Legal obligation (Article 6(1)(c))

Data may be processed where required by law or a regulatory authority.

5. Third Parties and Sub-processors

Pitchlog uses the following Google services to process personal data. Google acts as a data processor on behalf of the controller under Article 28 GDPR.

Service	Purpose	Location
Firebase Authentication	User account management and sign-in	EU (Belgium)
Cloud Firestore	Database storage (accounts, players, entries)	EU (Belgium)
Google Cloud Run	Application server (request processing)	USA (us-west1)
Stripe, Inc.	Payment processing (paid plans)	USA

User account data and player data are stored in the EU (Firebase Authentication and Cloud Firestore, Belgium). The application server runs on Google Cloud Run in the United States (us-west1), meaning that request data is processed in the USA. Payment data is processed by Stripe, Inc. in the USA.

Transfers to the United States are based on the EU–US Data Privacy Framework (DPF) and EU Standard Contractual Clauses (SCC). Both Google LLC and Stripe, Inc. are certified under the EU–US DPF. More information: firebase.google.com/support/privacy  ·  stripe.com/privacy.

We do not sell, rent or share personal data with other third parties for marketing purposes.

6. Data Security

Personal data is protected by appropriate technical and organisational measures:

• All data in transit is encrypted with TLS (HTTPS)
• Firebase Security Rules restrict access so users only see their own club's data
• Firebase Authentication handles secure identity management
• Access to production systems is restricted to technical staff

7. Data Retention

Data	Retention period
User account and email	For the duration of the account + 12 months after deletion
Player data and playing time entries	For as long as the coach keeps the data in the application
Technical logs	Maximum 90 days

After account deletion, data is permanently removed from Google Cloud infrastructure within 90 days.

8. Minors' Personal Data

Pitchlog is intended for use by football coaches. Player names entered into the application often belong to minors. We wish to emphasise the following:

• A player's name is the only data point stored about a minor.
• Pitchlog does not collect email addresses, dates of birth or contact details for minors.
• The coach or club (acting as data controller) is responsible for ensuring that the guardians of minor players have been duly informed about the playing time tracking and that any required consents have been obtained under applicable local law.
• Minors do not have their own user account in Pitchlog.

9. Your Rights

Under the GDPR you have the following rights regarding your personal data:

• Right of access — you may request a copy of the data we hold about you.
• Right to rectification — you may request correction of inaccurate data.
• Right to erasure — you may request deletion of your data ("right to be forgotten").
• Right to restriction — in certain circumstances you may request that processing be restricted.
• Right to data portability — you may request your data in a machine-readable format.
• Right to object — you may object to processing based on legitimate interests.

To exercise your rights, contact us at info@pitchlog.app. We will respond within 30 days.

You also have the right to lodge a complaint with your national supervisory authority. In Finland: Office of the Data Protection Ombudsman — tietosuoja.fi/en. In Sweden: IMY — imy.se.

10. Changes to This Policy

We may update this Privacy Policy from time to time as the service evolves or legislation changes. We will notify you of material changes via the application or by email. The effective date at the top of this page will be updated accordingly.

11. Contact

For any privacy-related questions or requests:

Gilla Läget
Email: info@pitchlog.app