iFutsal Privacy Policy
1. Who processes your data
The data controller is Miguel Tanda, a natural person, who runs iFutsal (app.ifutsal.app). For any question or request about your data, write to support@ifutsal.app.
2. What iFutsal is
iFutsal is an app for organising five-a-side football: communities of players, invitations, members and, later, matches and results. It is in closed beta and access is by invitation only.
3. What data we process and where it comes from
If you sign up
You give us:
- first and last name;
- a nickname, optional;
- your position on the pitch (goalkeeper or outfield player);
- your email address and a password. The password is never stored in plain text: the authentication service provider keeps only an irreversibly encrypted version of it.
While you use the app, the following are also created:
- the avatar you choose among the available illustrated ones;
- the address of your personal page, derived from your first and last name and editable from your profile;
- the communities you belong to, your role in each (organizer, admin, player) and the dates you joined and left.
If an organizer adds you without you being registered (a “ghost” profile)
An organizer or admin of a community can add you as a member even if you do not have an account, for example to keep track of who plays. In this case the data comes from them, not from you, and is at most:
- a name;
- a nickname, optional;
- your position on the pitch;
- an illustrated avatar.
For a ghost profile we never collect email addresses, phone numbers or photographs: the database itself prevents it, not just the interface.
If someone invites you by email
Whoever invites you can enter your email address, so that only you can use that invitation. The address is used for this purpose only.
Technical data
To work and stay secure, the app uses technical cookies (see §9). The infrastructure providers (§6) also record technical data about requests, such as IP address, date and time, in their own logs, kept for the periods stated in their respective privacy notices.
We do not use statistical analytics, advertising or profiling tools. Service emails do not contain open or click tracking.
4. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, letting you join communities, showing you to the members of the same community | Performance of a contract, that is, the Terms of Service (Art. 6(1)(b) GDPR) |
| Sending you service emails: registration confirmation, password recovery, email change, security alerts, confirmation that your account has been deleted | Performance of a contract (Art. 6(1)(b)) |
| Managing the ghost profiles entered by organizers | Legitimate interest of the community and of the controller in organising matches and keeping track of them (Art. 6(1)(f)), limited to the minimum data listed in §3 |
| Using the email address of an invitation to reserve it for the person invited | Legitimate interest of the inviter and of the controller in preventing an invitation from being used by others (Art. 6(1)(f)) |
| Service security and abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations or requests from authorities | Legal obligation (Art. 6(1)(c)) |
We do not send promotional emails and we do not sell or hand over data to third parties for commercial purposes.
5. Who sees your data
- The other members of your communities see your first and last name, nickname, position on the pitch, avatar and your personal page. This is intentional: in a five-a-side community people know each other. This information is not visible to anyone who does not share at least one community with you.
- Your email is not visible to other members.
- The name of the community is chosen by whoever founded it and is visible to members and to anyone who receives an invitation.
- The providers in §6, only as far as needed to deliver the service.
6. Providers that process the data
To run iFutsal we use four providers:
| Provider | What it does | Where the data is |
|---|---|---|
| Supabase (Supabase Pte. Ltd., Singapore) | Database and authentication | Frankfurt, Germany (EU) |
| Vercel (Vercel Inc., United States) | Hosting and execution of the application | Functions run in Frankfurt, Germany (EU); some processing may take place in the United States |
| Resend (Plus Five Five, Inc., United States) | Sending of service emails | Sent from Ireland (EU); the main processing takes place in the United States |
| Tophost (Tophost S.r.l., Italy) | Mailboxes of the domain: messages written to support@ifutsal.app and the record of deletions (§7) | Italy (EU), on Seeweb S.r.l. infrastructure |
Supabase, Resend and Tophost act as data processors, under their respective data processing agreements. Any transfers outside the European Union take place on the basis of the standard contractual clauses approved by the European Commission (Decision 2021/914); Resend also adheres to the EU–US Data Privacy Framework.
Vercel hosts the application under its own terms of service, and the data passing through its functions may also be processed in the United States.
For the technical data generated by the use of their services, such as logs, Vercel and Resend act as independent controllers, according to their respective privacy notices.
7. How long we keep the data
- Account: for as long as it exists. When the account is deleted, the profile (first name, last name, nickname, email, personal page, avatar) is deleted. Your memberships in communities become nameless profiles: the name is replaced by a made-up label, the avatar by a new randomly chosen one, and no contact data remains. They exist so as not to alter the history of matches already played, and they can no longer be linked to you.
- Leaving a community: whoever leaves or is removed has seven days to rejoin. After that, their membership in that community becomes a nameless profile as above.
- Ghost profiles: for as long as the community exists, unless an organizer or admin removes them, or the person concerned asks for deletion.
- Email of an invitation: it is deleted within 24 hours of the invitation being closed (accepted, declined, revoked, or closed because the invited person deleted their account) or of its expiry.
- Backups: before each database update the controller makes a copy, kept for no more than 30 days. A deleted account or a removed ghost profile remains in earlier copies until they expire; if a copy were ever restored, the deletion or removal is applied again before the service reopens.
- Record of deletions: when an account is deleted, we keep its technical identifier and the moment of deletion, without name or email, for 30 days, in a database table and in a mailbox of the controller. The same applies when an organizer or admin removes the profile of a person without an account from the app: we keep its technical identifier and the moment of removal. They serve only to apply deletions and removals again if a backup were ever restored.
- Technical logs: for the periods stated in the providers' privacy notices (§6).
8. Your rights
You can ask at any time to access your data, correct it, delete it, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest.
- First name, last name, nickname, position on the pitch, personal page and email can be changed from your profile.
- You can delete your account yourself, at the bottom of the “Sign-in & security” page of your profile: we ask for your current password and, once the account is deleted, we send you a confirmation email. If you can't, write to support@ifutsal.app.
- To receive a copy of your data, write to support@ifutsal.app.
- If you were added as a ghost profile and do not want to be, ask an organizer or admin of the community to remove you, or write to support@ifutsal.app stating the community: the profile is removed, or the name is replaced by a made-up label.
We reply within one month of the request. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).
9. Cookies
iFutsal uses only technical cookies, necessary for it to work or tied to a choice you make. We do not use analytics, profiling or third-party cookies, so we do not ask for your consent.
| Cookie | What it is for | Duration |
|---|---|---|
sb-…-auth-token | Keeps you signed in to your account | While you stay signed in |
ifutsal-pending-invite-token | Remembers the invitation you opened while you complete sign-up or log in | 24 hours |
ifutsal-theme | Remembers whether you chose the light or dark theme | 1 year |
NEXT_LOCALE | Remembers the language of the interface | Until the browser is closed |
Fonts are served from our own domain: the browser does not contact third-party servers to load them.
10. Minors
To sign up to iFutsal you must be at least 14 years old.
An organizer can add even a minor as a ghost profile: in that case the limits of §3 apply (name only, optional nickname, position on the pitch and illustrated avatar; never contact details or photographs). A parent or guardian can ask for its removal at any time by writing to support@ifutsal.app.
11. Security
Data travels only over encrypted connections (HTTPS). In the database, every table is protected by rules that limit what each user can read and write. Passwords are never stored in plain text.
12. Changes to this policy
We will update this policy before introducing features that process new data, for example matches, attendance and results. In case of significant changes we will notify you in the app or by email.
Version in force since: 8 October 2026