Privacy Policy

1. Data Controller

The data controller is Stefano Pesce, a natural person, at Via Salvatore Tommasi snc, 80135 Naples, Italy, reachable at [email protected]. PlaySportMate is the name under which the controller provides the service.

2. Data collected

We collect the following personal data:

• Registration data: first name, last name, email address, password (hashed), date of birth
• Profile data: sports practised, skill level, city of residence (no precise GPS coordinates), profile photo (optional)
• Tournament registration data: name, email, phone (optional), message (optional)
• Navigation data: access logs, IP address, browser type (for security and aggregate statistics)

We do not collect precise GPS coordinates. Geolocation is limited to city/area.

3. Purposes of processing

Your data is used to:

• Provide the athlete matching service
• Manage amateur tournament registrations
• Send notifications related to platform activity
• Ensure security and prevent abuse
• Improve the service through anonymous aggregate statistics

4. Legal basis

Processing is based on the contract (service provision, Art. 6(1)(b) GDPR) and the legitimate interest of the controller for platform security (Art. 6(1)(f) GDPR). For marketing communications, the legal basis is explicit consent (Art. 6(1)(a) GDPR).

5. Data retention

Account data is retained until the profile is deleted. Navigation data (logs) is deleted within 90 days. Tournament registration data is retained for 2 years for accounting and security obligations.

6. Data sharing

Your data is shared only with:

• Supabase (database and authentication) — servers in Europe (Frankfurt, eu-central-1)
• Vercel (hosting) — with GDPR compliance guarantees
• Sports clubs — only the registration data for their tournaments, explicitly provided by you
• Google (Google Analytics 4, via Google Tag Manager) — anonymous usage statistics, enabled only with your prior consent (Consent Mode v2). Details in the Cookie Policy
• Sentry (error and crash monitoring for the application) — Functional Software Inc., United States
• Resend (transactional email delivery, e.g. registration confirmation) — United States
• Microsoft Clarity (anonymous session analytics) — Microsoft, United States

We never sell your data to third parties.

International data transfers

Some of the providers listed above (Sentry, Resend, Microsoft Clarity) are based in the United States. In these cases, data transfers outside the European Economic Area rely on an adequacy decision of the European Commission or, where one is not in place, on Standard Contractual Clauses (SCCs) approved by the European Commission under Articles 44-49 of the GDPR, which require safeguards equivalent to those under European law.

Use of artificial intelligence

PlaySportMate uses third-party language models (LLMs), such as Anthropic's Claude, for two distinct things. First: assisting with drafting editorial and marketing content, always reviewed by a person before publication; no profile data goes into that work. Second: interpreting free-text search. Interpretation happens on our own servers with our own parser; when language-model assistance is switched on, only the text of the question you typed is sent to the model provider, never your profile or anyone else's. We do not use fully automated decision-making that produces legal effects or similarly significantly affects users, and user data is not used to train third-party models.

Connecting an external assistant (MCP)

PlaySportMate can be connected as a connector (MCP server) to an external assistant, for example Anthropic's Claude or OpenAI's ChatGPT. It is your choice: until you connect your account, nothing leaves. Once connected, the answer PlaySportMate returns to your request reaches that assistant and therefore its provider's servers. That answer can contain other members' data — name, city, bio, level and distance — because that is exactly what you asked to search for. From that moment those data are processed by the assistant's provider under its terms, not ours. Without a connected account, public access returns numbers only: how many athletes practise a sport in an area, never who they are. You can disconnect at any time from your assistant's settings.

7. Minors

PlaySportMate is for people aged 18 and over. We ask for your date of birth when you register, use it to check that requirement and keep it with the rest of your account: it does not appear on your public profile and is not shared with other members or with connected external assistants. Anyone under age cannot create an account. If we learn that an account belongs to a minor we close it and delete the associated data. If you are a parent or guardian and believe a minor has created an account, write to [email protected]: we act without asking for anything else.

8. Your rights (GDPR)

You have the right to:

• Access: request a copy of your data
• Rectification: correct inaccurate data
• Erasure (right to be forgotten): delete your account and all associated data
• Portability: receive your data in a machine-readable format
• Objection: object to processing for marketing purposes
• Restriction: request suspension of processing in certain cases

To exercise these rights, write to [email protected]. We will respond within 30 days.

9. Cookies

We use technical cookies necessary for the operation of the site (authentication, session). For full details, see our Cookie Policy.

10. Security

We adopt appropriate technical and organisational measures to protect your data: encryption in transit (HTTPS), secure authentication, Row Level Security on all data, limited access to authorised personnel.

11. Complaints

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

12. Changes

We may update this policy. In case of material changes, we will notify you by email or via a notice on the platform.