Privacy Policy

Last updated: June 10, 2026

1. Data Controller

scoutsland UG (haftungsbeschränkt)

Rähnitzgasse 20b, 01097 Dresden, Germany

Managing Director: Egle Neumann

2. General Information on Data Processing

We process personal data exclusively in accordance with legal provisions, specifically the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Personal data encompasses all information relating to an identified or identifiable person (e.g., name, email address, IP address).

Minimum Age Requirement

ScoutsLand is intended for users aged 16 and over (GDPR Art. 8). We do not knowingly collect personal data from children under 16. If you become aware that a child under 16 has provided personal data without verified parental consent, please contact info@scoutsland.com and we will delete it promptly.

3. Types of Data Processed

Master data (name, email address, company affiliation)
Contract data (subscription, payment status)
Usage data (login times, interactions)
Technical data (IP address, browser, device, operating system)
Payment data (processed via Stripe)
Communication data (support requests)
Mobile device locale (used solely for notification language selection)

4. Purposes and Legal Bases of Processing

Processing relies on:

Art. 6 para. 1 lit. b GDPR (contract fulfillment)
Art. 6 para. 1 lit. c GDPR (legal obligations)
Art. 6 para. 1 lit. a GDPR (consent, e.g., analytics)
Art. 6 para. 1 lit. f GDPR (legitimate interest, e.g., IT security)

5. Our Platforms & Systems

5.1 Backend Infrastructure (scoutsland-service)

Central GraphQL API based on NestJS with MongoDB Atlas supporting account management, authentication, scouting data provision, and AI-powered analysis.

5.2 Live Scores Platform (scoutsland-live)

A React web application with server-side rendering that collects technical access information for performance and security assurance.

5.3 Scout Panel (scoutsland)

Professional dashboard for scouts, clubs, and agencies processing personal account information for contractual purposes.

5.4 Marketing & Content Hub (scoutsland-landing)

Marketing site using Sanity CMS collecting technical information for optimization.

5.5 ScoutsLand Mobile App (iOS & Android)

The ScoutsLand mobile app (bundle ID: com.scoutsland.app) is published by scoutsland UG (haftungsbeschränkt) for iOS and Android. In addition to the data types listed in section 3, the mobile app processes the following:

Push notification tokens: Expo Push tokens (which transitively invoke APNs on iOS and FCM on Android) are stored against the user account to deliver match-event notifications the user has opted into: goals, red cards, kick-off, half-time, full-time, lineup announcements, and kick-off reminders. Tokens are deleted on sign-out or account deletion. Legal basis: Art. 6 para. 1 lit. a GDPR (consent).
Device locale: The device locale (obtained via expo-localization) is used only to select the notification language. It is not retained beyond the current session, not shared with third parties, and not used for any tracking purpose. Legal basis: Art. 6 para. 1 lit. b GDPR.
No advertising tracking: The ScoutsLand mobile app does not integrate any analytics SDKs, advertising identifiers (IDFA on iOS, Google Advertising ID on Android), or cross-app tracking mechanisms. No App Tracking Transparency prompt is shown because no tracking is performed.

6. Third-Party Service Providers

Clerk (Authentication)

We use Clerk for secure user authentication. Clerk may transfer information to third countries using standard contractual clauses.

Email address
User ID
Login information
Authentication tokens

When users sign in via Google OAuth through Clerk, their interaction with Google is additionally governed by Google's Privacy Policy.

Stripe (Payment Processing)

Stripe processes payment information, billing details, IP addresses, and payment status. Stripe functions as an independent controller; its privacy policy applies. Legal basis: Art. 6 para. 1 lit. b GDPR.

Sportmonks (Football Data)

Live data is obtained via the Sportmonks API without transmitting personal user information. Only match and statistics data is processed.

Cloudinary (CDN & Media Optimization)

Cloudinary collects IP address, browser type, device information, and time of access for performance optimization, reduced loading times, and scalable media delivery. Legal basis: Art. 6 para. 1 lit. f GDPR.

Google Analytics (Analytics)

Google Analytics is activated only after explicit consent, collecting anonymized IP addresses, browser information, usage behavior, and session duration. Legal basis: Art. 6 para. 1 lit. a GDPR. Consent withdrawal is available at any time.

Sentry (Error Monitoring)

Sentry (Functional Software, Inc.; GmbH-based EU presence) collects diagnostic data for error correction and system stability. Legal basis: Art. 6 para. 1 lit. f GDPR. Transfers outside the EU are governed by Standard Contractual Clauses.

What is captured on crash:

Device model, OS version, and app version
Stack trace and error context
Anonymized breadcrumbs (navigation and network events preceding the crash)
Anonymized user ID derived from the Clerk user ID

What is NOT captured:

Screenshots, message content, or form input values
Personal information visible on screen or in API request bodies

7. One-Stop-Shop & International Users

For EU private customer sales below the legal turnover limit, taxation occurs in Germany. When thresholds are exceeded, the OSS procedure applies.

8. Cookies

We use technically necessary cookies, authentication cookies (Clerk), and analytics cookies (Google Analytics, consent-required). A cookie banner enables consent management. For more details, see our Cookie Policy

9. Data Security

We implement the following security measures:

TLS/HTTPS encryption
Role-based access control
Serverless infrastructure (Netlify)
Monitoring (Sentry), distributed caching (Redis), background job processing (Bull Queues)

10. Data Transfer to Third Countries

Service providers including Stripe, Clerk, Cloudinary, Google, and Sentry may transfer information to third countries using standard contractual clauses or adequacy decisions.

11. Storage Duration

Personal information is retained only when necessary for contractual fulfillment, legal retention requirements exist, or legitimate interests apply.

12. Rights of Data Subjects

You have the following rights regarding your personal data:

Right of access — request information about your data
Right to rectification — correct inaccurate data
Right to erasure — request deletion of your data
Right to restriction — limit processing of your data
Right to data portability — receive your data in a portable format
Right to withdraw consent — withdraw previously given consent at any time
Right to lodge a complaint with a supervisory authority

Account Deletion

In-app account deletion is available via Settings → Account → Delete Account. The flow calls Clerk's user.delete() API; Clerk then fires a webhook to our backend which performs the following cascade:

Permanently deleted: favorites, push notification subscriptions and preferences, scout goals, Postlab drafts, scout reports, activity history, organization memberships, and team memberships.
Anonymized (content retained, author identity stripped): comments.
Player lists: lists owned by the user are deleted; the user's contributions to shared lists are scrubbed of identifying information.
Subscription records: retained with an accountDeleted flag to satisfy tax and accounting obligations; no personally identifiable information is retained in those records.
User record: PII fields (first name, last name, email address, profile picture, and Clerk user ID) are overwritten with synthetic placeholders. The row is kept as a tombstone so foreign-key references remain valid, but no real personal data is retained.

Requests should be directed to: info@scoutsland.com

13. Changes to this Privacy Policy

We reserve the right to modify this privacy policy when services or legal requirements change.