Privacy Policy

This Privacy Policy explains how Ball or Bench, operated by SVMS Consultancy Limited ("Company", "we", "us", or "our"), collects, uses, shares, and protects your personal data.

Ball or Bench currently opens accounts for players aged 13 and over. Some players are under 18, so their account and sharing choices need particular care. The UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the ICO's Age Appropriate Design Code (the Children's Code) apply to how we handle their data.

1. Data Controller

SVMS Consultancy Limited is the data controller responsible for your personal data processed through Ball or Bench.

2. Personal Data We Collect

2.1 Earlier waitlist

• Email address
• Basic browser information sent when you joined

2.2 Account information

• Your account email address
• Display name or player handle
• Profile photo, if you add one
• Age band (18+ or 13-17), selected at signup; earlier under-13 records remain held
• For 13-17 accounts: the parent or guardian email supplied at signup, used for the parent contact process and account notices
• Authentication identifier (e.g. your Google account ID if you sign in with Google)

2.3 Activity and evidence data

• Training logs and the daily evidence you submit (text notes or video)
• Your card stats, overall rating (OVR), tier, and streak
• Crew membership and the reactions you give or receive
• Reports you send about a crew mate (which player, the name, picture or clip you reported, your chosen reason, when you sent it and how our team resolved it), and players you block
• Usage and diagnostic data: session timestamps, feature usage, error and performance reports, device and browser information, IP address

2.4 Payment data

• For website payments: Stripe customer and payment identifiers, purchase status and history
• For in-app purchases: App Store product and transaction identifiers, purchase status and whether a transaction was made in Apple's test environment
• RevenueCat customer and purchase identifiers, and the lifetime access status used to unlock the app or restore a purchase

Apple handles App Store payments and Stripe handles website card payments. We do not receive or store your complete payment card number.

3. How We Use Your Data

Purpose	Legal basis
Keeping the earlier waitlist record until it is deleted	Consent (given when you joined the waitlist)
Creating and running your account, card, and crew	Contract performance
Storing and displaying the evidence you submit	Contract performance
Requesting a parent contact for teen accounts and recording any consent decision	Legal obligation / contract performance
Sending safeguarding notifications to a linked parent	Legal obligation (child protection)
Processing a lifetime purchase, confirming access and restoring a purchase	Contract performance
Sending service emails (confirmations, account notices)	Contract performance
Preventing fraud, abuse, and referral gaming	Legitimate interest
Understanding how the service is used and fixing problems	Legitimate interest
Legal compliance and disputes	Legal obligation

4. Children's Data and Safeguarding

New Ball or Bench accounts are for players aged 13 and over. Existing under-13 records remain held while parent account checks are developed and reviewed.

4.1 Minimum age and age bands

The first thing anyone does when signing up is tell us their age band. We use this to decide what an account can and cannot do:

Age	Account type	Video upload	Crew feed	Public feed
18+	Self-managed	Yes	Yes	Yes (opt-in)
13-17	Self-managed, parent linked	Yes	Yes (private by default)	Locked, even with parent consent
Under 13	New accounts unavailable; earlier records held	Closed	Closed	Locked

4.2 Parental consent flow

• 13-17: we ask for a parent or guardian's email at signup. A young person can create an account and share approved training video with their private crew, but not with a public feed.
• Under 13: new signup is closed. Earlier accounts, cards and uploads stay held while parent account checks are developed and reviewed.
• For adults and teenagers, creating an account can create a player card before a parent contact has confirmed anything. A card is not proof of parental approval.

4.3 Safeguarding notifications

If a young player's training tier drops, an account notice may go to an approved parent contact. If no approved parent contact is on record, it may go to the account email. This notice is private, not a crew post.

5. Data Sharing and Third Parties

We share personal data with the following service providers, only as needed to run the service:

• Supabase: database hosting and authentication; our primary project data is hosted in London, UK
• Coolify on Hetzner (Germany, EU): application hosting
• Stripe (USA): website payment processing
• Apple App Store: in-app payment processing
• RevenueCat: checking App Store purchases and lifetime access
• 360TFT Hub / Resend (USA): email delivery for service and waitlist messages
• Google (USA): sign-in, if you choose to sign in with Google
• Sentry: error and performance reports that help us fix problems
• YouTube: demonstration preview images and videos; the video player loads when you choose to play it

We do not sell your personal data or send training uploads to advertising providers. We have paused Google Analytics and Meta Pixel on the website. We may disclose data if required by law, court order, or to protect a user, particularly where a child's welfare is at risk.

6. International Data Transfers

Some of our providers are based in the United States. Where data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, Standard Contractual Clauses, and the UK extension to the EU-US Data Privacy Framework. You can ask us for more detail at any time.

7. Data Retention

• Earlier waitlist data: kept only while we still need it for the reason it was collected, or until you ask us to remove you
• Account data: kept while your account is active; some records may remain after account deletion where we have a legal reason to keep them
• Evidence media (photos/video): kept while linked to your account; we handle deletion requests under the rights below, and backup copies may remain for a limited period
• Payment records: kept for the period required by tax, accounting and other applicable law

After the retention period, data is securely deleted or anonymised.

8. Your Rights

Under UK GDPR you have the right to access, correct, delete, restrict, or port your data, and to object to certain processing or withdraw consent. For a child's account, a parent or guardian can exercise these rights on the child's behalf. To exercise any right, email admin@360tft.com and we will respond within one month.

You can also complain to the Information Commissioner's Office (ICO):

9. Data Security

• Encryption in transit (TLS/HTTPS) and at rest
• Access controls and authentication
• Row-level security on our database
• Regular security reviews

No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we take the protection of your data seriously.

10. Data Breach Notification

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and will tell you directly without undue delay if the risk to you is high.

11. Cookies and Tracking

Essential cookies keep your account signed in and help the site work. Google Analytics and Meta Pixel are paused. The website does not offer an optional tracking choice while they are paused.

12. Changes to This Policy

We may update this policy from time to time. If we make material changes we will update the "Last updated" date and, where appropriate, notify you by email or with a notice on the site.

13. Contact Us