Privacy Policy

Last Updated: August 1, 2026

This policy explains what personal data ClubMeister collects, why we process it, the third-party providers (sub-processors) we rely on to run the service, and the rights you have under the EU General Data Protection Regulation (GDPR) and comparable laws such as the UK GDPR. We collect only what we need to run a team-management app — no advertising, no selling of your data, ever.

1. Who We Are (Data Controller)

ClubMeister is a team- and club-management app operated by Jasper Boskma ("ClubMeister", "we", "us"). For any privacy matter — including exercising your rights below — you are the data subject and we are the controller of your personal data.

• Controller: Jasper Boskma (ClubMeister)
• Email: privacy@clubmeister.app
• Postal address: Corneliusstraße 58, 52511 Geilenkirchen, Germany

Our full legal notice is in the Legal Notice.

Where your club or team is the entity that decides how your data is used within the app (for example, which members to invite, which events to create, or whether to enable payments), that club acts as a controller in its own right and ClubMeister acts as its processor. This policy covers ClubMeister's own processing.

2. Information We Collect

We collect the following categories of personal data:

Account & profile data

• First and last name
• Email address
• Password (stored only as a secure hash) or, if you sign in with Google or Apple, the identifier those providers return
• Phone number (optional — used for SMS event notifications)
• Profile photo (optional)
• Date of birth (optional)
• Any custom profile fields your club marks as required (e.g. jersey number, position)

Team & activity data

• Team and club membership, roles, and permissions
• Events, calendar entries, line-ups, and event notes
• Event attendance and RSVP responses
• Posts, polls, and chat messages you send (team chat, direct messages, and role chats), including any images, files, or GIFs you attach

Payment data (only if your club enables payments)

• Transaction records, amounts, and payment status
• For club payouts, the banking/identity details required to set up a payout account

Card and bank details are collected and processed directly by our payment provider, Stripe (see the sub-processor table). ClubMeister never stores your full card number.

Contact form

When you write to us through the form at /support, we receive your name, your email address and the message itself. We use them to answer you and for nothing else — no marketing, no profiling. Your IP address is not stored: we keep only a salted, irreversible hash of it, purely to stop the form being used to send us hundreds of messages an hour. Enquiries are deleted once the matter is resolved and no longer needed as a record, and at the latest in line with Section 11.

Technical & usage data

• App version, device/platform type, and language
• Push-notification token (so we can deliver notifications to your device)
• Pseudonymous product-analytics events (which screens and features are used) — see Section 5
• Coarse country/region, derived from your device timezone and language rather than from your IP address
• Approximate location and search text when you look up a venue for an event

3. Legal Bases for Processing (GDPR Art. 6)

We rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to create and run your account, deliver core features (teams, events, chat, RSVPs), and provide payment functionality you use.
• Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse, and improve it through privacy-preserving, aggregate analytics. You can object to processing based on legitimate interests (see Section 9).
• Consent (Art. 6(1)(a)) — for optional features you explicitly opt into, such as SMS notifications (you opt in by replying YES) and push notifications (you allow them at the device level). You can withdraw consent at any time without affecting prior processing.
• Legal obligation (Art. 6(1)(c)) — where we must retain certain records (e.g. transaction records for tax/accounting purposes).

4. How We Use Your Data

• To create and manage your ClubMeister account and profile.
• To operate teams, events, calendars, RSVPs, line-ups, posts, and polls.
• To enable communication through team chat, direct messages, and role chats.
• To send you notifications you have enabled (push and/or SMS) about events and team activity.
• To process payments and club subscriptions where your club uses them.
• To maintain security, prevent fraud and abuse, and troubleshoot problems.
• To understand, in aggregate, how the app is used so we can improve it.
• To notify you about material changes to the service or this policy.

We do not use your data for advertising, we do not sell it, and we do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

5. Analytics

We use Mixpanel to understand how ClubMeister is used, configured for EU data residency (data is sent to Mixpanel's EU endpoint). In the app, analytics events are tied to a pseudonymous identifier and record which features are used, not the content of your messages or personal details. Our marketing website uses Mixpanel in a cookieless mode: no cookies, no persistent identifiers, IP-based geolocation disabled, and the browser's "Do Not Track" signal is respected. We do not build advertising profiles.

6. Sub-Processors and Third-Party Services

To run ClubMeister we share the minimum necessary personal data with the vetted service providers ("sub-processors") listed below. Each processes data only on our instructions and under a data-processing agreement. Some are located outside the EU/EEA — see Section 7 on international transfers.

We keep this list current. If we add or replace a sub-processor, we will update this page and, where required, notify you.

7. AI Connections (Claude & ChatGPT)

A team admin can connect ClubMeister to an AI assistant such as Claude (Anthropic) or ChatGPT (OpenAI) using our MCP connector. This is off by default and only takes effect when an admin explicitly connects an assistant and chooses a single team to connect. If nobody in your club does that, nothing in this section applies to you.

What the assistant can access

Once connected, the assistant can request the following data for the one connected team only, and only within what the connecting admin's own role already permits:

• Team details (name, sport, type, division, timezone, club, member count, plan)
• Events, including times, venues, notes, RSVPs, check-ins and carpools
• The member list — names, roles, playing positions and join dates. Contact details (email, phone) are only included when the assistant explicitly requests them and the admin's role grants access to them.
• Venues, with address and coordinates
• Posts and polls on the team feed, including reply and read counts
• Attendance and engagement statistics derived from the above

The connector cannot read or send chat messages of any kind (team chat, group chats or direct messages), and cannot access payment, fee or Stripe data. It cannot delete anything, and it cannot invite, remove or change the role of a member.

Where that data goes

When an assistant requests data, we transmit it to the AI provider the admin chose. That provider is not our sub-processor. We have no agreement with it, we do not select it, and we receive nothing back from it. The admin, acting for the club, directs the transfer to a service of their own choosing under their own relationship with that provider. What the provider then does with the data — including whether it is retained, reviewed by staff, or used to train models — is governed by that provider's terms and privacy policy, not by this one. Anthropic and OpenAI are both established in the United States, so connecting an assistant will normally involve a transfer outside the EU/EEA that the club, not ClubMeister, is responsible for.

Who is responsible for what

Connecting an assistant is a decision your club makes, not one we make for it. As set out in Section 1, where your club decides how member data is used within the app, the club is the controller and ClubMeister acts as its processor. Enabling a connection is a documented instruction from the club to us to transmit that team's data to the assistant it has chosen, and we act on it. The split is:

• The club (through its admin) is the controller for the decision to connect and for everything that follows from it: choosing the provider, establishing a lawful basis for the transfer, informing members, and dealing with the provider.
• ClubMeister is the processor for the team data that passes through the connector, and the controller only for the connection metadata we keep in our own systems (below) — the registration, the connection record, the hashed tokens and the audit log.
• The AI provider is an independent controller of whatever it receives, on its own terms.

If you are a team admin, this is on you

The data an assistant can reach includes personal data about other members of your team, who are not party to your decision and may not know you have made it. Before you connect an assistant, and for as long as it stays connected, you are responsible for:

• Being entitled to do it. Satisfy yourself that your club permits it and that you have a lawful basis under GDPR Art. 6 for sending member data to a third-party AI provider. If your club has a data protection officer or a committee, this is a decision for them.
• Telling your members that the team is connected to an AI assistant, which one, and what it can see — before you connect, not after. Handle any objection a member raises, including by disconnecting.
• Your agreement with the provider. Read its terms, check whether your data may be used for training, and put any processing agreement or transfer safeguard in place that your club needs. We cannot do this for you and are not party to it.
• Asking only for what you need. The assistant returns what you ask it for. Requesting contact details, or pasting the results somewhere else, are your choices, not ours.
• The assistant account itself — its security, and who can read its conversation history. Anything the assistant has retrieved sits in that account, outside ClubMeister, and we cannot see it or delete it.
• Disconnecting when you no longer need it, when you leave the admin role, or when your club asks you to.

ClubMeister provides the connector, the admin-only gate, the per-team scoping and the audit log so that these decisions can be made and reviewed. We do not, and cannot, make them for you. Before a connection can be created, the admin must confirm on the consent screen that they are authorised to make it and will tell their members; we record when that confirmation was given. These obligations are set out as binding warranties in clause 5 of our Terms of Service.

What we store about the connection

• The assistant's registration — its name and callback addresses.
• The connection itself — which user authorised it, for which team, when, and when it was last used.
• Access and refresh tokens, stored only as SHA-256 hashes; we cannot recover the original token.
• An audit log of every request — which tool ran, for which connection, when, whether it succeeded, how long it took, and a digest of the arguments with anything credential-shaped and any long free text removed. We do not store the data the tool returned.

Retention

Expired authorization codes and long-expired access tokens are deleted automatically each night. Refresh tokens are kept for the life of the connection so that a replayed token can be detected and the connection shut down. Connection records and audit entries are retained while the connection exists and for a limited period afterwards for security and troubleshooting, then deleted in line with Section 11.

Your control

An admin can see every assistant they have connected under AI connections in the app, and disconnect any of them at a tap. Access stops immediately: the assistant's tokens are revoked in the same moment. Permissions are also re-checked on every single request, so a role change or a deactivated membership takes effect at once rather than at the next sign-in. Data already sent to an AI provider before you disconnect is subject to that provider's retention — contact them to have it removed.

Legal basis

For the connection metadata we hold as controller, we rely on performing the service you asked us to provide (GDPR Art. 6(1)(b)) and, for the audit log and rate limiting, on our legitimate interest in keeping the connector secure and abuse-free (Art. 6(1)(f)). For the team data transmitted to the assistant we act on the club's instruction as its processor; establishing the lawful basis for that transfer, and any safeguard required for sending it outside the EU/EEA, is the club's responsibility as controller.

8. International Data Transfers

ClubMeister's primary database is hosted in the United States (AWS, region us-west-1), and several of the sub-processors above are located outside the EU/EEA. Where personal data of EU/EEA (or UK) users is transferred to a country without an EU adequacy decision, we rely on appropriate safeguards under GDPR Chapter V — principally the European Commission's Standard Contractual Clauses (SCCs), and, where a provider is certified, the EU-US Data Privacy Framework. You may request a copy of the relevant safeguards via privacy@clubmeister.app.

9. Data Storage and Security

Your data is stored and managed using Supabase, hosted on Amazon Web Services in the United States. We apply technical and organisational measures to protect your personal information, including encryption in transit (HTTPS/TLS), hashed passwords, row-level access controls in the database so members can only see data they are entitled to, and restricted administrative access. No method of transmission or storage is completely secure, but we work to protect your data and to keep these measures under review.

10. Your Rights

Under the GDPR (and equivalent laws) you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your personal data ("right to be forgotten").
• Restrict processing in certain circumstances.
• Object to processing based on our legitimate interests.
• Data portability — receive your data in a structured, machine-readable format and have it transferred where technically feasible.
• Withdraw consent at any time for processing based on consent (e.g. SMS or push notifications), without affecting the lawfulness of processing before withdrawal.

You can exercise many of these directly in the app (editing or removing your data, deleting content, or deleting your account). For any request, contact privacy@clubmeister.app; we will respond within the time limits set by law (generally one month). You also have the right to lodge a complaint with a data-protection supervisory authority — in the Member State of your habitual residence, your place of work, or the place of the alleged infringement (GDPR Art. 77). As we are established in North Rhine-Westphalia, the authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW); you are free to approach your own instead.

11. Data Retention and Deletion

We keep personal data only for as long as needed for the purposes described in this policy. In particular:

• Attendee data linked to an event (such as first and last name) is deleted from the server when the event is removed.
• Content you create (messages, posts, profile fields) can be deleted by you in the app at any time.
• When you delete your account, we delete or anonymise your personal data, except where we must retain limited records to meet a legal obligation (for example, payment/transaction records for tax and accounting).
• Analytics data is pseudonymous and retained in aggregate.

12. Children's Privacy

ClubMeister is used by sports clubs and teams, which may include minors. Where a member is under the age required for consent in their country, an account should be set up and managed with the involvement of a parent, guardian, or the club administrator responsible for that member. We do not knowingly collect data from children beyond what a club needs to manage participation. If you believe a child's data has been provided without proper authorisation, contact us and we will address it.

13. Changes to This Privacy Policy

We may update this privacy policy from time to time. We will post the updated policy on this page and revise the "Last Updated" date above. For material changes we will provide a more prominent notice where appropriate.

14. Contact Us

If you have any questions about this privacy policy or our data practices, or to exercise your rights, please contact us at:

privacy@clubmeister.app