Privacy Policy

Last updated: 26 October 2026

TeamPilot is management software for grassroots and youth football clubs. This policy explains how we process the personal data of people who visit this site (teampilot.it) and of people who use the TeamPilot platform, under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and the Italian Personal Data Protection Code (Legislative Decree 196/2003).

In short

• On the site we only collect what you write in the contact form and, only if you accept, visit statistics with Google Analytics. No advertising, no profiling.
• On the platform, the data of players, families and staff belongs to the sports club, which decides how to use it. We store and process it on the club’s behalf.
• We do not sell data, we do not use it for advertising and we do not use it to train artificial intelligence systems.

Who the controller is

TeamPilot, with registered office in Pisa, which provides the TeamPilot service (“TeamPilot”, “we”, “us”).

For any privacy question, or to exercise your rights, use the contact form.

Two different roles

• We are the controller for site data, contact requests, the accounts of people who sign in to the platform, the security of the service and the contractual relationship with client clubs.
• We are a processor (Article 28 GDPR) for the data each sports club enters into the platform: registers of members and families, attendance, documents, payments and everything else. For this data the controller is the sports club, which has given you (or must give you) its own privacy notice. We sign a data processing agreement with every club.

The site

Browsing. As with any website, the servers that host it log technical data about requests: IP address, date and time, requested page, browser type. This keeps the site working and protects it from abuse, and the hosting provider keeps it for the short period set by its own procedures. Legal basis: our legitimate interest in the security of the site (Article 6(1)(f) GDPR).

Contact form. If you write to us we collect your name, email, phone number and subject if you provide them, and your message. We only use them to reply and, if you ask for it, to prepare a proposal or a demo. The message reaches us by email and becomes a record in our internal panel, where we note how the request is going (the demo, any quote). Before sending it we ask you to confirm you have read this notice, and we record its version. Legal basis: replying to your request and pre-contractual steps (Article 6(1)(b)). We keep the request and the correspondence for 24 months after the last exchange, then delete them, unless they lead to a contract; you can ask us to delete them sooner through the contact form. The handover to the panel leaves a temporary copy, which we delete within 30 days.

To block spam, the contact page uses Google reCAPTCHA, which collects technical data about your device and how you interact with the page. Legal basis: our legitimate interest in the security of the form (Article 6(1)(f)). Google’s privacy policy and terms apply. reCAPTCHA is not loaded on the other pages of the site.

Cookies

The site uses these tools:

What	What it is for	Consent needed?	Duration
Light or dark theme and cookie choice, stored in your browser	remembering your choices	No: they are technical	theme until you change it; cookie choice 6 months
Google reCAPTCHA cookies, only on the contact page	spam protection	No: they are needed for security	as set by Google
Google Tag Manager and Google Analytics 4 (_ga and _ga_… cookies)	counting visits, pages viewed, device type and country, in aggregate form	Yes	cookies up to 2 years; report data at most 14 months

Google Tag Manager and Google Analytics only start if you choose “Accept”, or switch on “Statistics” in the preferences. If you reject, or close the banner with the X, they are not loaded. Even when you accept, the site denies Google any advertising use; Google Analytics 4 does not log or store IP addresses. Legal basis: your consent (Article 6(1)(a) GDPR and Article 122 of the Italian Privacy Code).

You can change your mind at any time from “Cookie preferences” at the bottom of every page: if you withdraw consent we delete the Google Analytics cookies from your browser. We ask for your choice again after six months.

We do not use profiling or advertising cookies, social network pixels, or tools that record mouse movements. The Facebook icon at the bottom of the page is a plain link: it loads nothing until you click it.

The platform: data we control

Your account. First name, last name, email, the club or clubs you belong to and your roles. We do not know your password: the authentication service stores it only in encrypted, non-reversible form.

Security and operation. We record:

• your last sign-in, which your club’s administrator can see in the list of users;
• a log of sensitive operations (for example creating an account, changing a role, recording or reversing a payment), used to reconstruct who did what;
• your preferences: language, theme, appearance;
• if you turn on push notifications, the technical address your browser gives us to deliver them, one per device. We delete it when you turn them off or when the browser invalidates it.

In your browser the platform stores your sign-in session, your preferences, your email if you choose to remember it, and a few display choices such as the selected season. It uses no profiling cookies and no third-party analytics.

Service emails. Invitations, password recovery, email change confirmation and the notices your club has turned on. They are service communications, not advertising, and we do not add anything to track whether you open them or what you click.

Relationship with client clubs. The details of whoever signs the contract and of the contact persons (name, role, contact details), and billing data.

Legal bases. Performance of the contract with the club and of the service it offers you (Article 6(1)(b)), tax obligations (point (c)) and our legitimate interest in the security of the service and in preventing abuse (point (f)).

How long. As long as you have active access. When the club removes your access or the contract ends, account data is kept for as long as needed to close the relationship and handle any disputes, then deleted together with the club’s data. Tax records are kept for ten years (Article 2220 of the Italian Civil Code).

The platform: data we process on behalf of clubs

Sports clubs use TeamPilot for their activities and, under their own responsibility, enter:

• records of players (including minors), family members, staff and officials, with family relationships and contact details;
• registrations, teams, calendar, call-ups, attendance, statistics, technical assessments and fitness tests;
• documents, deadlines and certificates;
• health data, such as injuries and measurements, visible only to people entitled to see it;
• fees, payments, receipts and tax documents;
• registrations submitted online with the related consents, internal messages, announcements and boards;
• signatures on match documents: the signature image, date and time and a fingerprint of the signed document. If the signature is given from a link opened on one’s own phone we also record the IP address and browser type, as evidence of the signature;
• the opposing team’s match notes photographed after the game, which carry the names of another club’s players. Those from away games are deleted automatically 45 days after the match, unless the club chooses to keep them.

For this data the controller is the sports club: it decides what data to collect, why and for how long, and gives you its own privacy notice. To exercise your rights, contact the club; if you write to us, we will forward your request.

How we protect it.

• Each club sees only its own data: the separation is enforced by the database, not just by the interface.
• Within the club, each person sees what their role needs: a family sees its own children’s data, a coach sees their own teams, and health and financial data is reserved to the people who handle it.
• Documents and files are kept in private storage and open through temporary links.
• TeamPilot staff do not browse clubs’ data: the platform administration tools only show aggregate figures. We act on data only when needed to fix a problem reported by the club or to keep the service secure.

Assisted access. To help a club solve a problem, a member of our support team can enter its platform only if the club’s administrator has allowed it: the consent lasts at most seven days, the administrator chooses it and can withdraw it at any time. Each access lasts at most two hours and is read-only: the database refuses any change. During the access, health data, confidential notes about people and private documents and files always stay out; data about minors stays out unless the administrator includes it in the consent. Whoever has entered always sees a bar reminding them of it. Every access is recorded in a log the club’s administrator can read (who entered, why, when and for how long), and administrators are notified each time one opens. We act as processor, on behalf of the club.

Public links. A club can create links and QR codes to share some content outside the platform, for example a tournament schedule or a match sheet. Anyone with the link can see it without signing in. The club chooses what to show and can revoke the link; full dates of birth and registration numbers never appear in public versions. The public live pages count how many times they are opened and how long they stay on at the club’s screens, only as daily totals: we do not store IP addresses, cookies or any other data that identifies who is watching.

Deadline reminders and payments. The platform can remind members and families when a document or a fee is about to expire, and shows the club who still has to pay. Who receives these reminders, what they contain and how long they are kept is explained on the Reminders and payments page.

WhatsApp. The platform can prepare a message to share on WhatsApp, for example call-ups. The message opens in the sender’s app and is sent from their phone: TeamPilot does not send it and does not see the replies.

Maps. When someone searches for an address, the text they type goes from our servers to Google Maps Platform to get suggestions and coordinates, without any data about the person searching. The “Open map” button opens Google Maps in a new tab, under Google’s terms.

When the contract ends we return or delete the data as instructed by the club, as set out in the data processing agreement.

Providers

We rely on providers that process data on our behalf and are bound by contract (for clubs’ data, as sub-processors).

Provider	What it is for	Where
Supabase	database, authentication, file storage and real-time updates of the platform	London, United Kingdom
Netlify	hosts the site and the platform and runs the server functions	United States, with a global delivery network
Resend	sending emails	United States
Google	Tag Manager and Analytics on the site (only with consent), reCAPTCHA on the contact page, Maps Platform for addresses and coordinates on the platform	United States and other countries
Browser notification services (Google, Apple, Mozilla)	deliver push notifications and receive only encrypted content	depends on the browser you use

Transfers outside the European Union. The United Kingdom benefits from a European Commission adequacy decision. For providers in the United States, transfers rely on the EU-US Data Privacy Framework, for certified providers, or on the standard contractual clauses approved by the European Commission.

Minors

The site is not aimed at minors, and the contact form is meant for the adults who run a club. On the platform, minors’ data is entered by the sports club, which is responsible for it; access on behalf of a minor is normally given to parents or guardians.

Automated decisions

TeamPilot does not take decisions based solely on automated processing that produce legal effects concerning you or similarly affect you. Some features make suggestions (for example times and pitches for a tournament, or missing details in a record), but decisions always remain with the club’s people.

Your rights

You can ask for access to your data, rectification, erasure, restriction of processing and portability, and you can object to processing based on legitimate interest (Articles 15-22 GDPR). Where processing is based on consent you can withdraw it at any time, without affecting the lawfulness of what was done before.

• For site data, your account and business contacts, write to us.
• For data entered by a sports club, contact the club; if you write to us, we will forward your request.

We reply within one month. If you believe the processing breaches the GDPR you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the country where you live or work.

Security

Encrypted connections (HTTPS), separation of clubs’ data enforced by the database, role-based permissions, passwords never stored in plain text, documents in private storage with time-limited links. No system is infallible: in the event of a data breach we will act as required by Articles 33 and 34 GDPR and notify the clubs concerned.

Changes

We may update this policy when the service, our providers or the law change. The date at the top shows when it was last changed; we notify client clubs of significant changes.