Playnder Privacy Policy

Effective from: 15 October 2026

Last updated: 16 October 2026

1. Who is responsible for your information

Alessandro Poggio is the controller of personal information processed to operate Playnder. Address: Calle Aaron Vidal Lopez Soldat 6, 4F, 46026, Valencia, Spain. For privacy questions or requests, email hola@playnder.com.

This notice covers the Playnder website and any Playnder application offered in the beta, including account registration, profiles, content, messaging, support and moderation. The initial beta is free and intended only for people aged 18 or over.

2. Information we collect and where it comes from

We collect information you submit, information generated when you use the service, and relevant information other users provide about you:

• Account information: email address, username, account role, sign-in and verification records, language preference and account status. Our authentication provider processes your password and stores authentication credentials; you should never send us your password by email.
• Waitlist information: if you join the waitlist on our homepage: your email address, first name and surname, whether you are a player, club or scout, country and city, your club or organisation (the club's name is required if you apply as a club and optional for players and scouts), your interface language, your confirmation that you are 18 or over, the time you joined, and the version of this notice that was shown to you. Joining the waitlist does not create an account.
• Optional expectations: the answer you choose to share after joining, your selected role, interface language, the date you sent it (the day only, not the time) and notice version. We do not link this answer to your email address, account or waitlist entry. We use it to understand what people need from Playnder; please leave out contact details.
• Player information: name, date of birth, nationality, position, preferred foot, football category, height, biography, profile image, club history, match updates and season statistics, according to the fields you complete. We use your date of birth to check adult eligibility and display your age; we do not show your exact birth date to other ordinary users.
• Club and scout information: club details, representative's role, organisation, professional profile, interests, region and information submitted for approval or verification. This may include public proof links you provide.
• Content and activity: posts, images, videos, comments, likes, follows, notifications, saved players, saved search criteria and alerts, and referral attribution where used. We process messages and associated participant, delivery and read-status information.
• Support and moderation: enquiries, feedback, reports, reported content, relevant evidence, verification decisions and correspondence.
• Technical information: IP address, browser/device information, request times, security events and error information processed by us and the infrastructure providers that deliver the service. Our website also records page-view statistics (pages visited, referring site, approximate location, browser, operating system and device type) with a cookieless analytics tool; as described by its provider, it sets no cookies and cannot follow a visitor across days or websites.

Other users may supply information about you through club confirmations, match updates, statistics, tags, messages and reports. Verification material may come from the public sources linked by a user. We use this information only for the relevant service, verification or safety purpose and provide further notice where legally required.

Required registration fields are identified in the signup flow. Without the information necessary to create and secure an account or check eligibility, we cannot provide an account. Optional profile fields and uploads are your choice. Please do not submit identity-document copies, medical records or other sensitive information unless we specifically explain a lawful need and a secure method first.

3. Why we use information and our legal bases

When we rely on legitimate interests, we consider the necessity of the processing and its effect on your rights. You can object as explained below. This is not a blanket basis for every possible future use.

We do not sell personal information or use the beta for targeted advertising. We send account, verification, security and other necessary service emails. We do not send promotional email during this initial beta. Any future optional marketing or non-essential tracking will require a separate legal assessment, updated notice and consent where required; agreeing to the Terms does not provide that consent.

4. What other people can see

Public player preview: visitors without an account can see your name, username, profile image, position, nationality, height, current club/verification indicator and follower count where available. Public pages may be linked or indexed by search engines.

Member features: admitted members can access the fuller profiles, career information, age, football statistics and shared content available through Playnder's features. Club representatives receive the information needed to consider claims and statistics submitted to their club. Scouts can find players using profile filters and save players or searches.

Media links: uploaded images and videos may be accessible to anyone who obtains their public media link, even where the surrounding page requires an account. Removing a link from a page does not by itself erase the underlying media. Avoid uploading confidential content.

Private information: email addresses and exact birth dates are not ordinary profile display fields. Direct messages are available to their participants. Authorised administrators and service providers can process private information where needed to deliver the service, provide support, investigate specific reports or meet legal obligations. Messages are not end-to-end encrypted.

Other users can copy information they see. We cannot retrieve copies, screenshots or independently posted content they hold outside Playnder. If a club or scout uses your information for its own recruitment or recordkeeping, it is responsible for that independent processing and its own privacy information.

5. Providers and other recipients

We use providers for authentication, databases, media, hosting, email and backups. They receive only the information relevant to their service, subject to applicable contractual and legal arrangements.

We may disclose necessary information to professional advisers or competent authorities where lawful, or to establish or defend legal claims. We do not make all account information available to clubs or scouts merely because they use Playnder.

The beta does not collect payment-card details or process paid subscriptions. If billing is introduced, we will update this notice before that processing begins.

6. International processing

Some providers or their subprocessors may process information outside the European Economic Area, including through support access and global infrastructure. We do not promise that every copy remains in Spain or the EU.

For transfers covered by the GDPR, we have not signed separate agreements with these providers: we rely on their general terms. We are reviewing whether those terms include appropriate safeguards, such as the European Commission's Standard Contractual Clauses, and any supplementary measures needed. You can ask hola@playnder.com for information about relevant safeguards and a copy, with confidential information redacted where appropriate.

Beta hosting and transfer details:

• Supabase (database, authentication and storage): London, United Kingdom (eu-west-2).
• Fly.io (API): London, United Kingdom (lhr).
• Vercel (website and visit analytics): United States (region iad1).
• Resend (email): Ireland (eu-west-1).
• Mux (video): mainly the United States.
• Sentry (error tracking): Germany.
• Cloudflare R2 (backups): Western Europe.
• GitHub (backup runs): United States by default. During each backup, the database dump is written unencrypted to a temporary directory on the runner before it is encrypted.
• ImprovMX (forwarding of hola@) and Google (Gmail): United States and Europe, under their terms. Google does not fix a region for free accounts.
• UptimeRobot (availability checks): may process data outside the European Economic Area, under its terms.

7. How long we keep information

• Accounts, profiles, posts and activity: while your account is active and the information remains necessary for the features you use. You can edit or remove supported content and request account deletion. Deactivation preserves information so the account can be reactivated; it is not deletion. We review whether inactive-account information remains necessary rather than retaining it indefinitely by default.
• Messages: while needed to provide the conversation. Account deletion removes messages sent by the deleted account from the active service. Other participants' messages, independently held copies and evidence lawfully retained for a report may remain.
• Waitlist information: until you are invited and create an account (after which it is kept only as long as needed to record that the invitation was used), or until you ask us to remove it, and in any case no longer than four weeks after you joined. The waitlist will be open for two to three weeks; after that we keep entries for one more week to email everyone on it, and then delete them. You can ask us to remove your entry at any time by emailing hola@playnder.com.
• Optional expectations: until the beta waitlist closes, after which they are deleted.
• Support and moderation records: for the time needed to resolve the matter, consider review requests, prevent relevant repeat abuse and meet any applicable legal or claim-preservation need. The scope and duration depend on the matter's seriousness, whether it remains unresolved and applicable limitation periods. We delete or anonymise records when those reasons end.
• Technical logs: for the provider's configured operational/security period. We restrict extended retention to a documented incident or other justified need. Provider default retention: Sentry (errors), 30 days on its free plan; Fly.io (application logs in its search), 7 days; Vercel (visit statistics), a one-month reporting window; GitHub Actions (backup run logs), 90 days. Supabase and Resend: retention to be confirmed before publication.
• Recovery backups: database snapshots follow a 30-day rotation schedule. Deleted or replaced image copies may remain in the off-site mirror until the next successful synchronisation, then in its recovery area for up to 30 days. These are separate backup processes. Backup copies are restricted to recovery use and rotate out under that schedule; if a backup is restored, relevant deletion requests must be reapplied.
• Legal preservation: where required by law or needed for a specific claim, we may retain a limited record for the applicable legal period, with access restricted and without continuing normal profile use.

Deletion from the active service and cleanup at media providers are separate steps. If cleanup fails, we need to follow it up. You can contact us about content that remains accessible after deletion. Independent providers may retain limited records under their own legal duties.

8. Your GDPR rights

Depending on the circumstances, you can ask to access your personal information and receive a copy; correct inaccurate information; erase information; restrict processing; and receive information you supplied in a portable format where processing is automated and based on consent or contract.

You can object to processing based on legitimate interests on grounds relating to your particular situation. If we ever process your information for direct marketing, you can object to that at any time. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

Email hola@playnder.com with your request. You can also use the available Settings controls. We may need proportionate information to verify identity, but we do not routinely require an identity-document copy.

We respond without undue delay and normally within one month of receipt. If a request is complex or there are multiple requests, the GDPR permits up to two additional months; we will explain an extension within the first month. Requests are generally free. If we cannot fulfil a request in full, we will explain the reason and your options.

You can complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority, including where you habitually live, work or believe an infringement occurred. You do not have to contact us first.

9. Automated features and security

Playnder uses automated functions to calculate age and statistics, enforce eligibility and technical limits, and match player profiles against saved search filters. These functions do not make recruitment decisions for clubs or scouts. We do not use automated talent scoring or solely automated decisions producing legal or similarly significant effects in the beta. Approval and moderation concerns can be raised for human review.

We use appropriate technical and organisational measures to protect information, including access controls and restricted administrative access. No online system can guarantee absolute security. Contact us promptly if you suspect a privacy or security issue.

10. Adults only and policy updates

Playnder is not intended for anyone under 18. If you believe an underage person has an account or their information was improperly uploaded, contact us so we can investigate and take appropriate action.

We update this notice when our practices change, show the revised date and notify users of material changes where appropriate. We will provide additional information and obtain consent where required before starting a new use that needs it.