01Who we are
SquadraIQ (“SquadraIQ”, “we”, “us”) is a football operating system for clubs and coaching staff. The service is currently operated by João Miguel Martins, an individual (sole trader) based in Portugal. It is run by an individual today; this policy will be updated if the service moves to a legal entity.
For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) and Portuguese Law no. 58/2019, we are the data controller for the data described in this policy, except where we act as a processor on behalf of a club (see section 2).
Data protection contact. For any question or request about your personal data, email squadraiq@gmail.com. We aim to respond within 30 days.
02Our role: controller and processor
SquadraIQ handles data in two distinct capacities, and it matters which applies:
- As a controller: for the data that lets you have an account and a relationship with us: your login and profile data, the football reference catalogue we hold for everyone, and operational logs. We decide why and how this data is processed.
- As a processor: for the operational content a club creates inside its own workspace: squad lists, staff records, calendar and matchday notes, tactical insights, scouting watchlists, and the club’s activity log. The club decides what to record; we store and process it on the club’s instructions. Where a club records data about identifiable people (players, staff, opponents), the club is responsible as controller for having a lawful basis to do so.
03Personal data we collect
Account and profile data
Access to SquadraIQ is currently invitation-only: accounts are created for approved email addresses rather than through open self-registration. When you use an account, we process:
| Data | Where it comes from | Notes |
|---|---|---|
| Email address | Provided when your account is created; used to sign in. | Also used to gate access against an approved list. |
| Password | Set by you. | Stored only as a salted hash by our authentication provider. We never see or store it in clear text. |
| Display name | Optional, editable in Settings. | Shown to your club colleagues inside the workspace. |
| Profile photo (avatar) | Optional upload (image, up to 3 MB). | Stored in our file storage and served from a URL. See section 12. |
| Language preference | Set by you. | Remembered so the interface opens in your language. |
| Club membership & role | Assigned within a club workspace. | Links your account to a club and determines what you can do. |
| Technical & session data | Collected automatically by our authentication provider when you sign in. | IP address, user-agent, sign-in timestamps and session tokens, used to keep you signed in and to secure the account. |
Content you create in a club workspace
Inside a workspace you and your colleagues create working data, squad lists and player roles, staff records (name and role), calendar and matchday entries, session plans, tactical observations, scouting watchlists, and an activity log of decisions. This content can contain personal data about identifiable people, including players who may be minors. We process it as a processor on the club’s behalf (see section 2).
What we do not collect
We do not run analytics, advertising, or behavioural tracking of any kind, and we do not build advertising profiles. We do not collect payment or card data (see Terms, the service is currently offered on a free trial and no payment method is taken). We do not knowingly collect special categories of data (health, etc.) about account holders.
04How we use data, and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and secure your account; authenticate sign-in; keep you signed in. | Performance of a contract (Art. 6(1)(b)); legitimate interests in account security (Art. 6(1)(f)). |
| Provide the workspace and its features; store the content you create. | Performance of a contract (Art. 6(1)(b)); on a club’s behalf, under our processing terms. |
| Operate the shared football reference catalogue and derived analysis. | Legitimate interests in providing football insight (Art. 6(1)(f)), see section 5. |
| Send service emails (e.g. sign-in confirmation, password reset) via our authentication provider. | Performance of a contract (Art. 6(1)(b)). |
| Keep operational and audit logs; investigate abuse; keep the service reliable and safe. | Legitimate interests in security and integrity (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c)). |
| Comply with the law and respond to lawful requests. | Legal obligation (Art. 6(1)(c)). |
Where we rely on legitimate interests, you have the right to object (see section 10). We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.
05Football reference data about players
To power squad building, comparisons, and tactical analysis, SquadraIQ holds a reference catalogue of real footballers sourced from a third-party football-data provider (see section 7). For each player this can include name, date of birth, nationality, position, shirt number, a photo, and performance statistics. From these we derive analytical profiles (e.g. tactical and chemistry scores).
These players are not our users and have no direct relationship with us, so this is third-party personal data. We process it on the basis of our legitimate interests(and our users’ legitimate interests) in football analysis of publicly reported professional sporting activity, balanced against the players’ rights. We show statistics with an indication of their reliability and never present a derived estimate as a hard fact.
If you are a player, agent, or rights holder and want to know what we hold or ask us to correct or remove it, contact squadraiq@gmail.com and see our Legal Notice.
08International transfers
Our database, authentication, and file storage are hosted in the European Union (AWS eu-west-3, Paris), a deliberate and fixed choice, your data is stored in the EU at rest.
Some of our providers are companies established in the United States (Supabase and Vercel), so their staff may access data from outside the EEA for support and operations. Where that involves a transfer outside the EEA, it is covered by the European Commission’s Standard Contractual Clauses and/or the EU-US Data Privacy Framework, together with additional safeguards. As noted above, displaying football images also discloses your IP address to the API-Football CDN, whose servers may sit outside the EEA.
09How long we keep data
- Account & profile data: for as long as your account is active, and a limited period afterwards to meet legal and security obligations, then deleted or anonymised.
- Workspace content: for as long as the club keeps its workspace. Some records are kept as an audit trail and are archived rather than hard-deleted, so history stays intact; these can still be erased on a valid request.
- Technical & session logs: kept for a short period for security, then rotated.
- Football reference data: kept while the player is part of the catalogue and refreshed from the source; removed or corrected on a valid request or when the source changes.
10Your rights
Under the GDPR you have the right to:
- Access: a copy of the personal data we hold about you.
- Rectification: correct data that is wrong or incomplete.
- Erasure: have your data deleted (“right to be forgotten”), subject to legal exceptions.
- Restriction: limit how we use your data.
- Portability: receive your data in a portable format.
- Objection: object to processing based on legitimate interests.
- Withdraw consent: where we rely on consent, at any time.
You can edit your name, avatar, and language in Settings at any time. For access, erasure, portability, or any other request, email squadraiq@gmail.com. We currently handle these requests manually and will action valid requests without undue delay and within one month. Exercising your rights is free.
11Children & minors
SquadraIQ is a tool for clubs and coaching staff and is not directed to children as users; accounts are for adults acting in a professional or organisational capacity.
However, football inevitably involves minors: a club may record data about players who are under 18, and the reference catalogue can include young professionals. We treat data about minors with extra care, it is scoped to the club that recorded it, kept out of immutable logs in clear text where sensitive, and erasable on request. Where a club records data about a minor, the club is responsible for having the appropriate basis and, where required, parental or guardian consent.
12Security
We protect personal data with technical and organisational measures, including:
- Encryption in transit (HTTPS with HSTS) across the whole service.
- Passwords stored only as salted hashes by our authentication provider, never in clear text.
- Tenant isolation enforced at the database level (row-level security), so one club cannot read another club’s data.
- Capability-based access control within a workspace.
- EU data residency for the database, authentication, and file storage.
One current limitation, stated plainly: profile avatars are served from a public storage URL, so anyone with the exact URL can view the image. Do not upload anything sensitive as an avatar. No system is perfectly secure; if we ever detect a breach affecting your data, we will notify you and the supervisory authority as the law requires.
13Changes to this policy
We may update this policy as the product evolves. When we make a material change we will update the “last updated” date at the top and, where appropriate, notify you. The current version always lives at squadraiq.me/privacy.
14Contact & complaints
Questions or requests: squadraiq@gmail.com. Operator: João Miguel Martins, Portugal.
If you believe we have mishandled your data, you have the right to complain to a supervisory authority. In Portugal this is the Comissao Nacional de Protecao de Dados (CNPD), https://www.cnpd.pt. We’d appreciate the chance to resolve it with you first.