Privacy Policy

PlyrHQ is a SaaS platform for sports club management, accessible at plyrhq.com. PlyrHQ is a company registered in Romania, an EU member state, and acts as Data Controller under Regulation (EU) 2016/679 (GDPR).

As an EU-based controller, GDPR is our primary applicable framework. We also comply with applicable data protection laws in all jurisdictions where our services are used, including UK GDPR, CCPA/CPRA (California), LGPD (Brazil), PIPEDA (Canada), and the Australian Privacy Act 1988.

• Entity: PlyrHQ
• Registered in: Romania (EU member state)
• Privacy contact: privacy@plyrhq.com
• General contact: hello@plyrhq.com
• Website: https://plyrhq.com

We collect the following categories of personal data, depending on how you use PlyrHQ:

Passwords are stored exclusively as bcrypt hashes — we never have access to plaintext passwords.

We process your personal data on one or more of the following legal bases under GDPR Article 6:

We use personal data exclusively for the following purposes:

• Service operation: Operate and improve the PlyrHQ platform
• Authentication: Authenticate users and manage accounts
• Transactional emails: Send confirmation, password reset, and payment receipt emails
• Product updates: Send feature announcements and product news (with consent)
• Payments: Process subscription payments via Stripe
• Analytics: Generate product analytics to improve the platform
• Security: Detect and prevent fraud and abuse
• Legal compliance: Comply with applicable legal obligations

We work with the following sub-processors to deliver the service. We have signed Data Processing Agreements (DPAs) with each:

A complete and up-to-date list of sub-processors is available on request at privacy@plyrhq.com.

As an EU-based company, your data is primarily stored and processed within the European Union. When transfers to third countries occur (e.g., Stripe in the USA, Google OAuth), we apply one or more of the following safeguards in accordance with GDPR Chapter V:

• Standard Contractual Clauses (SCCs) — EU Commission-approved clauses under Decision (EU) 2021/914 (the 2021 version)
• Adequacy decisions — where the destination country benefits from a European Commission adequacy decision
• Other appropriate safeguards — such as binding corporate rules or approved codes of conduct where applicable

You may request a copy of the applicable transfer mechanisms by emailing privacy@plyrhq.com.

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law:

Upon expiry of retention periods, data is securely deleted or irreversibly anonymized. A deletion request from the user immediately triggers the erasure process, except for data subject to a legal retention obligation.

PlyrHQ is a professional platform for sports club management and is not directed at minors. However, we understand that sports activities frequently involve minors, and club administrators will manage athlete data for individuals under 18.

• EU/EEA (GDPR Art. 8): Processing of children's data (under 16) for online services requires parental or guardian consent. Club administrators are responsible for obtaining and documenting this consent before adding minors to the platform.
• USA (COPPA): We do not knowingly collect personal information from children under 13 without verifiable parental consent. Club administrators in the USA must obtain parental consent for athletes under 13.
• UK: UK GDPR applies a similar standard (under 13 in some contexts per the Age Appropriate Design Code).
• Brazil (LGPD): Processing of children's data requires specific parental or guardian consent.

PlyrHQ does not directly contact minors. All communications go through club administrators.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, alteration, or disclosure:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest (Supabase / AWS)
• Row-Level Security (RLS) on all PostgreSQL database tables — each organization can only access its own data
• Multi-factor authentication available for all accounts
• Regular security audits and penetration testing
• Audit logs for all administrative and sensitive actions
• Incident response plan with 72-hour breach notification to the supervisory authority (GDPR Art. 33)

Passwords are stored exclusively as bcrypt hashes. We never store or transmit plaintext passwords.

We may update this Privacy Policy periodically to reflect changes in our data processing practices, legal requirements, or service functionality.

• Material changes (new processing purposes, new data categories, new processors outside the EEA) will be communicated via email with at least 30 days' notice before taking effect.
• Minor changes (clarifications, contact updates, reformulations) will be published on this page with an updated “Last Updated” date.
• Continued use of the service after the effective date of material changes constitutes acceptance of the updated policy.

The current version is always available at plyrhq.com/privacy. Previous versions are available on request.

For any questions about this Privacy Policy, to exercise your rights, or to submit a data-related request:

• Privacy requests: privacy@plyrhq.com
• General enquiries: hello@plyrhq.com
• Response time: Within 30 calendar days

We do not currently have a formally appointed Data Protection Officer (DPO), but all privacy matters are handled by our privacy team. Enterprise customers may request a Data Processing Agreement (DPA) at privacy@plyrhq.com.