Privacy Policy

Last updated: August 25, 2026 · Version 1.0

1. Controller and roles

This Policy describes how ClavaMetrics, operated by Joaquín Reiris Olsen Boje (reiris.joaquin@gmail.com), processes personal data.

In most cases, the club or sports organization that contracts the Service is the data controller of its players' and staff's data, and ClavaMetrics acts as data processor, processing them on behalf of and under the instructions of the club to provide the Service. Regarding the Customer's own account data (billing, administrator users), ClavaMetrics acts as controller.

2. Data we process

Category	Examples
Account and staff	Name, email, role, club, preferences, time zone.
Players	Name, date of birth, nationality, position, height, weight, photo, shirt number.
Health data (sensitive)	Injuries, clinical records, physiotherapy treatments, rehabilitation, wellness, RPE, physical assessments.
Performance	GPS data, training loads, match reports, video.
Nutrition	Calorie targets, macros, meal plans.
Technical usage	Access logs, device, IP address, in-app activity.
Payment	Handled by Paddle. We do not store card numbers; we receive subscription status data.

3. Health data and minors

The Service processes special-category data (health) and data of minors (youth categories). The responsible club must have a legal basis and the explicit consent of the data subjects and, for minors, of their parents or guardians, before uploading this data. ClavaMetrics processes it only under the club's instructions and with enhanced safeguards.

4. Purposes and legal basis

Providing the Service (sports management, analytics, rehabilitation): performance of the contract / controller's instructions.
Billing and tax compliance (via Paddle): legal obligation / performance of the contract.
Security, fraud prevention and support: legitimate interest.
Health data: explicit consent obtained by the club, or another applicable legal basis.

5. Processors and sub-processors

To operate the Service we use providers that process data on our behalf, under confidentiality and security obligations, including:

Supabase — database, authentication and storage.
Vercel — hosting of the web application.
Paddle — payment processing and billing (Merchant of Record).
GPS/performance providers the club chooses to connect (e.g. Catapult, StatSports), per its configuration.

6. International transfers

Some providers may process data outside your country. In such cases, appropriate safeguards apply (e.g. standard contractual clauses) in accordance with applicable law.

7. Retention

We retain data while the account is active and as instructed by the responsible club. After termination, data is deleted or anonymized within a reasonable period, unless a legal retention obligation applies (e.g. billing).

8. Security

We apply technical and organizational measures: encryption in transit, role-based access control, per-club data isolation (multi-tenant with row-level security policies) and audit logs. No system is 100% infallible; we will notify incidents as required by law.

9. Data subject rights

Data subjects may exercise their rights of access, rectification, erasure, objection, restriction and portability. As player data is usually managed by the club (controller), requests are channeled through it; ClavaMetrics cooperates to address them. Contact: reiris.joaquin@gmail.com.

10. Cookies and local storage

We use local storage and technical cookies necessary for login and app functionality (e.g. session, preferences, language). We do not use third-party advertising cookies.

11. Changes to this Policy

We may update this Policy. We will publish the current version with its date and notify material changes.

12. Contact

For privacy or data protection inquiries: reiris.joaquin@gmail.com.