How your information is used

Who is responsible?

For player, dependent, squad, team, coaching, fixture, result, finance and private club-community information, your football club normally decides why the information is needed. The club is the controller and the FootballOS service operator processes that information for the club.

FootballOS is the controller for your platform account, authentication, service security, billing, support and privacy-minimised service analytics. Contact help@footballos.co.uk for the operator’s legal identity, address, privacy contact or the details of the relevant club. These identity and address details must also appear in the club’s signed FootballOS agreement before production approval.

What we use

• Your name, email, sign-in identifiers, verification and session information.
• Your club, team, role, permissions and access requests.
• Information you or authorised club users add about players, dependants, training, fixtures, results and club activity.
• Public aliases and content you deliberately publish to county or public communities.
• Billing references, support correspondence, security audit records and limited route/performance events.
• Your optional marketing-email choice and, when you opt in, the date and time of that choice.
• Permission-scoped information sent when an authorised person deliberately uses an AI feature.

Operational analytics are designed not to collect prompts, messages, player names, imported content, keystrokes or IP addresses. Do not put medical, safeguarding case or DBS offence information into ordinary notes, sessions or community posts.

Why and on what basis?

FootballOS uses account and subscription information because it is necessary to provide the service you request or purchase. It uses tightly limited security, fraud-prevention, reliability, support and moderation information for legitimate interests in operating a safe and dependable service, balanced against your rights. Some billing, security and rights records may be required by law. Optional marketing emails are sent only when you consent, and the consent record is kept so FootballOS can honour and demonstrate your choice. Your club must tell you its own purposes and lawful bases for club-controlled information, especially information about children or compliance checks.

AI supports people; it does not replace them

Optional AI features receive only the authorised context needed for the requested task, with child identities minimised or aliased where supported. Requests tell the provider not to store the API request where that control is available. FootballOS keeps a full, credential-redacted request and response audit for 30 days, restricted to system administrators, to operate and investigate the feature. This audit may contain personal data until additional PII masking is introduced. AI must not make selection, welfare, medical, safeguarding, disciplinary or other legally or similarly significant decisions about a person.

Who receives information?

Information is visible only to the intended role and workspace audience. FootballOS may use contracted hosting, database, email, authentication, payment, monitoring and AI suppliers. An active supplier and transfer register must be approved against the actual production deployment. Club information is not sold and must not be used to train a general-purpose AI model.

International transfers and retention

Before a supplier accesses information outside the UK, FootballOS must record the destination and use an applicable UK adequacy regulation or another valid safeguard such as the UK IDTA or UK Addendum, supported by a transfer risk assessment where required. Information is kept only for the approved purpose and schedule. On service termination, club data is returned or deleted on the club’s instruction unless law requires retention; protected backups expire on their documented cycle.

Your rights

Depending on the purpose and lawful basis, you may ask for access, correction, deletion, restriction, portability or object to processing. You may withdraw consent where consent is used. Marketing consent can be withdrawn through the unsubscribe route in a marketing email or by contacting FootballOS. Contact your club for club-controlled information, or help@footballos.co.uk; FootballOS will route and assist the request. You can complain to the UK Information Commissioner’s Office at ico.org.uk.

Information about children

Children deserve particular protection. Parents, guardians and authorised club users should explain FootballOS in an age-appropriate way and avoid entering unnecessary information. Read our short privacy explanation for young people. Direct child accounts are not within the currently approved governance scope.

Changes and questions

We review this notice at least every six months and whenever a new purpose, supplier, AI use or data category is introduced. Material changes will be explained through the service. Email help@footballos.co.uk with a privacy question or rights request.