Privacy Policy

Data we collect

• Account data - email, name, username when you sign up.
• Subscription data - academy subscriptions managed via Stripe. We do not store card details.
• Match content - footage, highlights, and performance data (GPS, analytics) where your club has uploaded or connected it.
• Connected YouTube channel - where a PLAYBACK administrator connects PLAYBACK's own YouTube channel so that clips can be published to it, we store the Google OAuth tokens, the granted scopes, and the channel's ID and title. See Google user data (YouTube) below.
• Newsletter - email address if you opt in via the website footer form.
• Contact form data - name, email, company, role, and message when you submit the contact form.
• Analytics - anonymised usage data to improve the product (via PostHog), including page views, feature usage, and session data.
• PLAYSCANNER search data - when you use the PLAYSCANNER court / pitch search we record a non-cookie session token (held in your browser’s sessionStorage and discarded when you close the tab) tied to the searches you run (sport, location, date, filters), the pages you view, and any click-throughs to third-party booking sites. This feeds four internal tables - sessions, page views, searches, and conversions - used solely to improve venue coverage and detect abuse. No personal data is attached unless you are signed in. We also log hashed IP addresses for anti-abuse rate limiting.

Data we do not collect via PLAYSCANNER

PLAYSCANNER aggregates publicly available venue, slot, and pricing information from third-party providers. We do not collect personal data about the customers of those providers. When you click through from PLAYSCANNER to book a slot, you are redirected to the provider’s own platform, which operates under its own privacy policy and terms. PLAYBACK does not receive or store the booking details you submit to third-party providers.

Children’s data

PLAYBACK is used by clubs, academies, and youth leagues that include players under 18 and under 13. We take the UK GDPR and the ICO’s Age Appropriate Design Code seriously.

Where a child is enrolled in a PLAYBACK-powered club or academy, parental consent for processing the child’s data is obtained by the club or academy as part of their registration, and PLAYBACK acts as a processor on the club’s behalf for that data. Clubs are responsible for ensuring appropriate consent is in place before a child’s data is uploaded to the platform.

We apply data minimisation to children’s data: we collect only what is necessary to deliver the Service, we do not use children’s data for marketing, and we do not profile children for advertising purposes. Public display of a child’s footage, highlights, or profile is controlled by the club and the parent / guardian; individual highlights and profiles are not made public by default. Parents or guardians may contact us at any time to request access, correction, or deletion of their child’s data.

How we use your data

• To deliver the Service (account management, subscriptions, match content delivery, payment processing).
• To communicate with you about the Service and, where you have opted in, about product updates and partnerships.
• To improve the Service through anonymised analytics.
• To prevent abuse, fraud, and unauthorised access.
• To comply with legal obligations.

Legal bases

• Contract - account and subscription data required to deliver the Service.
• Legitimate interest - product updates to customers with active subscriptions; analytics for product improvement; anti-abuse logs; PLAYSCANNER search logs (rate limiting).
• Consent - newsletter opt-ins via the website footer form (withdrawable at any time).
• Processor on behalf of the club - children’s data and match content processed under the consent the club obtained from the parent / guardian.

Processors and sub-processors

We use the following processors under Data Processing Agreements: Supabase (database, storage, auth), Stripe (payments), Resend (transactional + newsletter email), Vercel and Netlify (hosting), Sanity (CMS), PostHog (analytics), and Veo, Spiideo, PlayerData, and Clutch (match / performance data where connected by your club).

Google user data (YouTube)

The PLAYBACK platform (including PLAYHUB at playhub.playbacksports.ai) offers an optional integration that publishes PLAYBACK-produced video clips to YouTube. This section sets out what Google user data we access, how we use it, who we share, transfer, or disclose it to, and how it is deleted.

• What we access - a PLAYBACK administrator authorises the integration through Google OAuth, connecting a single YouTube channel operated by PLAYBACK Sports Ltd. Under the youtube.upload and youtube.readonly scopes we access that channel's identity (channel ID and title) and the ability to upload videos to it. We do not access the YouTube accounts, subscriptions, watch history, comments, or private data of players, parents, coaches, club staff, or any other user of the Service.
• How we use it - solely to upload PLAYBACK-produced clips to the connected channel and to display which channel is currently connected so that administrators can confirm the correct destination before publishing. We do not use Google user data for advertising, profiling, or any purpose unrelated to publishing that content.
• Who we share, transfer, or disclose it to - we do not sell, rent, or trade Google user data, and we do not share it with any third party for advertising, marketing, or data-brokerage purposes. Google user data is disclosed only to: (a) Google, when we call the YouTube Data API on the connected channel's behalf; (b) the infrastructure sub-processors that operate the Service under Data Processing Agreements, namely Supabase (encrypted storage of the OAuth tokens and channel details) and Netlify (hosting and compute for the application that makes those API calls); and (c) where we are required to do so by law, or where disclosure is necessary to investigate a security incident, fraud, or abuse. No other person or company receives Google user data.
• Human access - Google user data is not read by PLAYBACK staff except with the administrator's explicit consent for a specific issue, where necessary for security purposes such as investigating abuse, or to comply with applicable law.
• Artificial intelligence and machine learning - we do not use Google user data to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models, and we do not transfer it to any third party for that purpose.
• Retention and deletion - we store the OAuth access and refresh tokens, the granted scopes, the connected channel's ID and title, and the connection timestamp. When the channel is disconnected we revoke the token with Google and delete the stored record. Access can also be revoked at any time from the Google Account permissions page at myaccount.google.com/permissions, which immediately ends our access.
• Limited Use - PLAYBACK's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Retention

Account data is kept while your account is active and for a reasonable period afterwards in case of reactivation. Newsletter data is kept until you unsubscribe. Match content is kept per the partnership agreement with your club. Anonymised analytics are kept up to 24 months. PLAYSCANNER search logs are kept up to 12 months for trend analysis and fraud prevention.

Your rights

Under UK GDPR you have the right to access, correct, delete, port, or restrict processing of your personal data, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time. To exercise any right, email admin@playbacksports.ai. You may also complain to the Information Commissioner’s Office (ico.org.uk).

International transfers

Some processors (Resend, PostHog, Vercel) may transfer data outside the UK. Where they do, transfers are covered by the UK International Data Transfer Addendum, Standard Contractual Clauses, or an adequacy decision such as the UK-US Data Bridge, as applicable.

Security

We use industry-standard technical and organisational measures to protect personal data, including TLS in transit, encrypted storage, row-level security on our database, and principle-of-least-privilege access controls. No system is perfectly secure; we work continuously to improve and respond to threats.

Changes

Material changes to this policy will be notified via the Site or by email. Minor edits will show in the “Last updated” date above.

Contact

Data protection queries: admin@playbacksports.ai. Postal: PLAYBACK Sports Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.