Privacy Policy
Last updated 6 August 2026 · Sideline Labs is operated by Bubba Digital Ltd ("Sideline", "we"). Questions or requests: privacy@sidelinelabs.io.
The two roles we play
When you create an account or buy something (a club officer, coach, parent booking a camp, a team entering a tournament, a business sponsoring a club), Sideline is the data controller for that information.
When a club records information about its members inside the platform — players, dependants, attendance, development notes — the club is the controller and Sideline processes that data only on the club's instructions, as its processor. Requests about that data should go to your club; we help clubs answer them.
What we collect
- Account holders: name, email, password (stored as a hash), club memberships and role.
- Buyers without accounts (team contacts, camp parents, sponsors): name, email, phone where given, and what you bought. You never need an account to pay.
- Children: a guardian provides a child's name (for example on a camp booking). Children do not hold accounts; a child profile is always managed by a guardian, and can become the child's own account from age 16 (13 in the UK) with our graduation process.
- Payments: card details go directly to our payment providers and never touch our servers. We hold payment metadata (amount, status, what it was for) and clubs' payout account identifiers.
- Coaching content: drills and session plans a club creates. If a coach photographs a drill for AI import, the image is processed by our AI provider to extract the drill and is not used to train their models.
- Technical: one essential session cookie and standard server logs. No analytics or advertising cookies (see the Cookie Notice).
Why we can use it (lawful bases)
- Contract: running your account, processing purchases, sending transactional email (receipts, confirmations, password resets).
- Legitimate interests: securing the platform, preventing fraud, improving features using aggregate (not personal) usage.
- Legal obligation: financial records, and — for future club fundraising draws — age and licensing requirements.
- Consent: anything optional, which you can withdraw as easily as you gave it.
Who we share it with (subprocessors)
| Provider | Purpose | Location / transfer basis |
|---|---|---|
| Vercel | Hosting | US/EU — EU SCCs & UK Addendum |
| Neon | Database | US/EU — EU SCCs & UK Addendum |
| LaunchKit / Stripe | Payments & club payouts | US/EU — Stripe's DPF certification & SCCs |
| Resend | Transactional email | US — EU SCCs & UK Addendum |
| Vercel AI Gateway | AI drill extraction | US — EU SCCs & UK Addendum |
We never sell personal data, and we never share it with advertisers. Clubs see the data their members and buyers submit to that club.
How long we keep it
- Accounts: until you delete them, then removed within 30 days.
- Payment records: 6 years (UK/Irish financial record requirements).
- Club member data: controlled by the club; when a club leaves, its data is exported to it and deleted from live systems within 90 days.
- Server logs: 30 days.
Your rights
Under UK and EU GDPR you can ask for access, correction, deletion, restriction, portability, or object to processing — email privacy@sidelinelabs.io and we respond within one month. Where the club is the controller we will pass the request on and help it respond. You can complain to the ICO (UK) or the Data Protection Commission (Ireland); we'd appreciate the chance to fix things first.
Changes
We will post changes here and, for material changes, email account holders before they take effect.