Privacy Policy

1. Who we are

SVMS Consultancy Limited is the data controller for personal data processed through AI Football.

2. What we collect

2.1 Account information

You sign in with a Google account. We do not create or store a password for you. When you sign in, Google shares the following with us and we store it:

• Email address
• Name, as held on your Google profile
• Profile picture URL, where your Google account has one

2.2 Email addresses given outside sign-in

If you enter your email address to install a tool or to receive follow-up guidance, we store that address together with the tool it came from, so we can send you the relevant instructions and related coaching emails. You can unsubscribe from any of these at any time using the link in the email.

2.3 Things you create on the site

• Tools you save to your favourites
• Reviews and ratings you write on tool pages
• Tools you submit for listing, including the contact and project details you supply in the submission form
• Feedback and reports you send us about a tool

2.4 Tool usage

• Which tools you view, install and try, and when
• The queries you type into a tool's in-browser try panel, and the responses returned
• Topics derived from those queries, which we use in aggregate to understand what coaches are asking for

2.5 Developer API data

If you create an API key, we store the key record, the account it belongs to, and a daily count of requests made with it, so we can apply rate limits and bill paid plans correctly.

2.6 Payment data

If you buy a sponsored listing or a paid developer plan, we store:

• Your Stripe customer and subscription identifiers
• Plan, status, billing interval and renewal dates

Card details are collected and held by Stripe. We never see or store your full card number.

2.7 Technical data

• IP address and approximate location derived from it
• Browser and device information
• Pages visited, referrer and session timestamps
• Server-side error diagnostics when a request fails, including the URL, the error and the request context

3. Why we process it, and our legal basis

Where we rely on legitimate interest, you have the right to object. See section 8.

4. AI processing

AI Football lists tools that are powered by artificial intelligence, and lets you try some of them in the browser. This means query text is sent to a system that generates a response automatically, with no human reviewing it first.

4.1 Where your queries go

• Most tools are operated by us and run on our own products: FootballGPT, RefereeGPT and CoachReflect. Your query is sent to that product's API, which is controlled by the same company and covered by this policy.
• Some tools are served directly from our own content library and do not leave our infrastructure.
• Search across that library uses Google's Gemini embedding API to turn your search text into a numerical representation. Google processes that text as our processor.

4.2 What this means for you

• AI output can be wrong, incomplete or out of date. Check it before you use it with players.
• Do not enter personal data about other people, in particular children, into a tool query. You do not need to identify a player to get useful coaching guidance.
• You can ask for human review of any automated output by emailing us.

5. Who we share it with

We do not sell your personal data and we do not let any third party use it for their own advertising. We share it with the following processors so the service can run:

• Supabase (USA) — database and authentication
• Google (USA and Ireland) — sign-in, Google Analytics, and the Gemini embedding API used for search
• Stripe (USA) — payment processing for sponsorships and paid developer plans
• Resend (USA) — email delivery, used by the 360TFT hub that sends our email
• Sentry (USA) — server-side error monitoring. It runs on our servers, not in your browser.
• Cloudflare (USA) — content delivery, DNS and protection against attacks
• Hetzner Online GmbH (Germany) — the servers the application runs on
• Other 360TFT products — FootballGPT, RefereeGPT and CoachReflect, which run the tools you try. These are operated by the same company.

We may also disclose data where we are required to by law, a court order, or to establish or defend legal claims.

Signing up to AI Football does not sign you up to any unrelated 360TFT product mailing list.

6. International transfers

Some of the processors listed above are based in the United States, so your data is transferred outside the UK. Those transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on the UK extension to the EU-US Data Privacy Framework where the provider is certified under it. You can ask us for more detail on the safeguards in place.

7. How long we keep it

• Account data: until you ask us to delete your account, then up to 30 days while it clears our backups
• Marketing email addresses: until you unsubscribe or ask for deletion. We keep a record of the unsubscribe itself so we do not email you again.
• Reviews and submitted tools: for as long as the listing is published, or until you ask us to remove it
• Usage and activity records: 12 months, after which they are deleted or aggregated so they no longer identify you
• API keys and usage counts: until the key is revoked, plus 12 months of usage history
• Payment records: 7 years, as required by UK tax law
• Error diagnostics: 90 days

8. Your rights

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted
• Ask us to restrict how we use it
• Receive your data in a portable, machine-readable format
• Object to processing we base on legitimate interest, including analytics
• Withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.
• Ask for human review of automated output

To exercise any of these, email [email protected]. We will respond within one month. There is no charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office. We would rather you came to us first so we can put it right.

9. Security

• All traffic is encrypted in transit using TLS
• Data is encrypted at rest by our database provider
• Sign-in is handled by Google, so we never hold a password for you
• Database access is restricted by row-level security policies, so one account cannot read another account's data
• API keys are stored hashed and shown to you only once

No system is completely secure, and we cannot guarantee absolute security. If you think your account has been compromised, email us straight away.

10. If something goes wrong

If there is a personal data breach that is likely to be a risk to your rights, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell you directly without undue delay where the risk to you is high.

11. Cookies and tracking

Essential

• Authentication cookies set by Supabase, which keep you signed in
• A short-lived cookie that remembers where to send you after sign-in

These are required for the site to work and cannot be turned off.

Analytics, only if you say yes

Google Analytics measures which pages and tools people use. It is off until you accept it in the cookie banner. If you choose "Essential only", or ignore the banner, the Google Analytics script is never loaded and no analytics cookie is set.

You can change your mind at any time using the Cookie settings link in the footer of every page. You can also block it with Google's opt-out browser add-on or a tracker blocker.

Your choice is stored in your browser's local storage rather than in a cookie, so it stays on your device and is not sent to us.

Error monitoring

We use Sentry to record errors, and it runs on our servers rather than in your browser. It sets no cookies on your device and does not record your screen or your session.

We do not run advertising pixels on AI Football, and we do not build advertising audiences from your activity here.

12. Children

AI Football is built for adults working in football, and is not intended for children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, email us and we will delete it. Please do not enter details that identify a child into a tool query.

13. Changes to this policy

We will update this page when what we do changes, and move the date at the top. If a change materially affects your rights we will tell you by email before it takes effect.

14. Contact us