Privacy Policy
This policy explains how personal data is handled on the FlagRoster website (www.flagroster.com) and in the FlagRoster application (app.flagroster.com) — what we collect, why, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).
1. Who we are
The data controller is:
ProductTrio
Paczkowska 50/8
50-503 Wrocław, Poland
Data protection contact: Aleksander Uznański — dpo@flagroster.com. Use this address for any question or request about your personal data.
We have not appointed a statutory Data Protection Officer (inspektor ochrony danych); the contact above handles all data protection matters.
2. Our two roles
FlagRoster is used by leagues and teams, so we act in two capacities:
- Controller — for data about website visitors, people who book a demo, and account holders (coaches, players, commissioners who sign up). For this data, this policy applies directly.
- Processor — for roster and player data that a team or league enters into the app (for example player names, positions, jersey numbers, statistics, or scoresheets). For this data, the team or league that entered it is the controller, and we process it only on their behalf and instructions. If you are a player with questions about data your club entered, contact your club first — and we will assist them in responding.
3. What we collect and why
| Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|
| Account data — name, email address, role, team/league affiliation | Creating and operating your account; providing the service | Contract performance (1(b)) |
| Content you add — rosters, schedules, plays, results, statistics, scoresheets | Providing the service to your team or league | Contract performance (1(b)); as processor where a club enters others' data |
| Billing data — plan, invoicing details, payment status (card details are handled by our payment processor and never stored by us) | Charging for subscriptions; accounting | Contract performance (1(b)); legal obligation (1(c)) for invoices |
| Demo bookings — name, email, answers you give when booking a call | Scheduling and holding the demo | Steps prior to a contract (1(b)); legitimate interest (1(f)) |
| Technical data — IP address, device and browser type, pages visited | Security, error diagnosis, and — only with your consent — analytics | Legitimate interest (1(f)) for security; consent (1(a)) for analytics |
| Product usage in the app — pages viewed and buttons or links clicked while signed in, linked to your account ID and email address; answers you give to in-app feedback surveys | Understanding how FlagRoster is used, improving it, and relating usage to subscriptions | Legitimate interest (1(f)) |
| Correspondence — emails you send us | Support and answering enquiries | Legitimate interest (1(f)) |
4. Cookies and analytics
Essential cookies keep the site and app working (for example, keeping you signed in). They don't require consent.
Analytics (Google Analytics 4) runs only if you click "Accept analytics" in the cookie banner. Until then — and if you choose "Essential only" — Google Analytics does not store cookies on your device (we use Google Consent Mode with all storage denied by default). Analytics helps us understand which pages are useful; IP addresses are not logged or stored by GA4, and we retain analytics data for 14 months.
Product analytics in the app (PMFtracker) helps us see which features are used and improve them. It is cookieless: it stores nothing on your device. It records pages viewed and clicks on buttons and links — never what you type into fields. When you're signed in, this usage is linked to your account ID and email address so we can relate it to your subscription. Signed-in users who use the app regularly may occasionally be shown a short, optional feedback survey. You can object to this processing at any time by emailing us (see section 12).
You can change your choice at any time via the Cookie settings link in the footer, or by clearing your browser storage for this site.
5. Who we share data with
We use a small number of service providers (processors) to run FlagRoster:
- Vercel — website and app hosting/CDN
- Supabase — application database and authentication
- Google — analytics (with consent), email (Google Workspace), and web fonts
- Cal.com — demo call scheduling
- PMFtracker — in-app product analytics and feedback surveys
- Resend — transactional email delivery
- A payment processor — for subscription payments once you subscribe
We do not sell personal data, and we do not share it with advertisers.
6. International transfers
We keep data in the European Economic Area where possible. Some providers listed above are US companies; where data is transferred outside the EEA, it is protected by the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
7. How long we keep data
- Account data — for the life of your account, then deleted or anonymised within 12 months of closure.
- Team and league content — controlled by your team or league; deleted when they delete it or close their account.
- Invoices and billing records — 5 years, as required by Polish accounting law.
- Analytics — 14 months.
- Support correspondence — up to 24 months after the case is closed.
8. Your rights
Under the GDPR you can, at any time, ask us for:
- Access — a copy of the personal data we hold about you
- Rectification — correction of inaccurate data
- Erasure — deletion of your data ("right to be forgotten")
- Restriction — limiting how we process your data
- Portability — your data in a machine-readable format
- Objection — to processing based on legitimate interest
- Withdrawal of consent — at any time, without affecting past processing
To exercise any of these, email dpo@flagroster.com. We respond within one month. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl — or with the authority in your own EU country.
9. Children's data
Flag football is played by young people, so FlagRoster accounts are open to players under 18.
- Under 16: an account may be created only with the involvement and consent of a parent or legal guardian, who is responsible for the account until the player turns 16.
- 16 and 17: players may create an account themselves.
- League licence applications (for example LFF registration) from anyone under 18 require a parent's or legal guardian's written consent, which the app asks for during the application.
Rosters entered by clubs may include data about younger players; in that case the club acts as the controller and is responsible for having a lawful basis (such as parental consent) for entering it. We process such data solely on the club's behalf and never use it for marketing. A parent or guardian can exercise a child's data protection rights by emailing us at the address in section 1.
10. Security
All traffic is encrypted in transit (TLS). Application data is protected with role-based access controls and row-level security, so teams can only see their own data. Access to production systems is limited to authorised personnel.
11. Changes to this policy
If we make material changes, we will update the date at the top of this page and, for significant changes affecting account holders, notify you by email or in the app.
12. Contact
ProductTrio · Paczkowska 50/8, 50-503 Wrocław, Poland · dpo@flagroster.com