Privacy Policy — SportanPlay
Last updated: 09 Jul 2026
1. Data Controller
The controller of your personal data is:
- Owner: Pablo Gandul Romero
- Tax ID (NIF): 14324239T
- Address: Calle Rioja 13, 1 C, 41001 Sevilla
- Contact email: privacy@sportanplay.com
SportanPlay (the "Platform") is a sports matchmaking service available at sportanplay.com and app.sportanplay.com.
2. Data We Collect
2.1 Account data
When you sign up: email address, username, name, and password (stored encrypted and irreversibly hashed; never in plain text).
2.2 Profile data
Information you choose to add to your profile: bio, and data derived from your sports activity on the Platform (player statistics, match history).
2.3 Location data
To enable nearby match discovery, the Platform processes location data:
- Match locations: coordinates of the venue for each match (provided by the match creator).
- Your approximate location: if you grant geolocation permission in your browser or device, it is used to show you nearby matches. You may deny or revoke this permission at any time in your browser/device; you can still use the Platform by setting a search area manually.
2.4 Content you generate
- Messages: those you send in match conversations.
- Feedback: ratings and comments you leave about other players and those others leave about you.
- Matches: the details of matches you create or join.
2.5 Technical data
IP address, connection and browsing data required for security and service operation (e.g., request rate limits to prevent abuse), and technical error data (via our error monitoring tool) to diagnose and fix failures.
2.6 Contact form data
If you write to us through the contact form, we collect your name, email address, the reason for your enquiry and the message content, for the sole purpose of handling and responding to your request. You do not need to be registered to use this form. We keep these messages only for as long as necessary to handle your enquiry and any related ones; they are deleted afterwards.
3. Purposes and Legal Bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and managing your account; providing the service (discovering matches, joining, chatting, rating) | Performance of a contract (Art. 6(1)(b)) |
| Sending transactional communications (account verification, password reset, match and request notifications) | Performance of a contract (Art. 6(1)(b)) |
| Showing you nearby matches using your location | Consent (Art. 6(1)(a)), given when you grant geolocation permission; you may withdraw it at any time |
| Handling the enquiries you send us via the contact form | Consent (Art. 6(1)(a)), given when you submit the form |
| Service security: abuse and fraud prevention, rate limiting, error logging | Legitimate interest (Art. 6(1)(f)) in keeping the service secure |
| Usage analytics to improve the service | Consent (Art. 6(1)(a)) where cookies or identifiers are involved; legitimate interest where performed with cookieless technology and aggregated data |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
We do not make automated decisions with legal effects about you, nor profile you to that extent.
4. Visibility of Your Information Within the Platform
Part of your information is visible to other users, as it is the essence of the service:
- Public profile: your username, name, player statistics and received feedback are publicly visible on your profile.
- Matches: when you create or join a match, other participants can see your user identity.
- Feedback: ratings you leave are shown together with your username.
- Messages: messages in a match conversation are visible to that match's participants.
Think before you post: do not include personal data you do not wish to share (phone number, home address, etc.) in your bio, messages or feedback.
5. Recipients: Who Processes Data on Our Behalf
We do not sell your data or share it with third parties for commercial purposes. To provide the service we rely on providers acting as data processors:
| Provider | Service | Processing location |
|---|---|---|
| Railway Corp. | Application and database hosting | US — US West (California) |
| Cloudflare, Inc. | DNS, content delivery network and security | EU/US (certified under the EU-US Data Privacy Framework) |
| Resend, Inc. | Transactional email delivery (account verification, notifications) | US (certified under the EU-US Data Privacy Framework) |
| Functional Software, Inc. (Sentry) | Technical error monitoring | US (certified under the EU-US Data Privacy Framework) |
| Umami Software, Inc. | Cookieless usage analytics (no identifiable personal data collected: no IPs, no persistent identifiers) | US (no personal data transferred) |
| Zoho Corporation | Corporate contact email | EU (European data centre) |
6. International Transfers
Some of our providers process data outside the European Economic Area (US). In those cases, transfers rely on a European Commission adequacy decision (EU-US Data Privacy Framework) or on Standard Contractual Clauses approved by the Commission, depending on the provider. You may request further information about the safeguards applied at privacy@sportanplay.com.
7. Retention Periods
- Account and profile data: for as long as your account remains active. When you request account deletion, the account becomes inaccessible immediately and you have a 30-day grace period during which you can recover it; after that period, your personal data is irreversibly anonymised.
- Record of the relationship (blocked data): after anonymisation, we keep a minimal record blocked (an identifier, email, name, sign-up and deletion dates, and the record of your acceptance of the terms) for the sole purpose of handling potential requests from authorities or courts, or defending against claims. This data is not used for any other purpose and is not accessible during the normal operation of the Platform, and it is permanently deleted after a maximum of 6 years (or the applicable limitation period).
- Messages and feedback: retained while the account is active. Upon account deletion, your feedback may be kept in anonymised form (unlinked from your identity) to preserve the integrity of other players' reputation system.
- Technical data and security logs: up to 12 months.
- Contact form messages: kept while your enquiry and any related ones are being handled; deleted when no longer needed, up to a maximum of 12 months.
- Error data (Sentry): per the tool's retention policy, up to 90 days.
8. Your Rights
You may at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent given, by writing to privacy@sportanplay.com from the email associated with your account (or otherwise proving your identity).
Many of these actions are also available directly in the Platform: editing your profile, managing notification preferences, or deleting your account.
If you believe we have not properly handled your rights, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) (www.aepd.es) or your local supervisory authority.
9. Security
We apply appropriate technical and organisational measures: encrypted communications (HTTPS), irreversible password hashing, session tokens protected from script access (HttpOnly cookies), defences against common attacks (CSRF, rate limiting), system access controls and error logging. No system is infallible; should a security breach affecting your data occur, we will notify it in accordance with the GDPR.
10. Minors
SportanPlay is intended for users aged 18 or over. We do not allow minors to register and do not knowingly collect data from minors. If we detect an account belonging to a minor, we will delete it. If you are a parent or guardian and believe a minor has provided us with data, contact us at privacy@sportanplay.com.
11. Changes to This Policy
We may update this policy to reflect changes in the service or in applicable law. The current version will be published on this page with its update date; if changes are substantial, we will notify you by email or through a notice in the Platform.
12. Contact
For any questions about this policy or the processing of your data: privacy@sportanplay.com.