Privacy Policy
Last updated: 8 September 2026
This notice explains what the Skillcard portal does with personal data. We have tried to write it in plain language rather than in legal boilerplate; if anything here is unclear, tell us and we will improve the wording.
Many of our users are children. That shapes the whole design: no advertising, no data selling, no cross-site tracking, no analytics cookies, and no more personal data than the service actually requires.
Who is responsible
The controller of your personal data is Skillcard OÜ, registry code 17524768, Pärnu mnt 40-6, 10119 Tallinn, Harju maakond, Estonia. Reach us at skillcard@skillcard.pro. We are not required to appoint a Data Protection Officer, so enquiries go to that address and a human answers them.
Your club is a controller in its own right for the training it runs and the roster it maintains. We act as a processor for your club when it uses coach tools, and as a controller for your own account and card.
Where your data comes from
Most of it comes from you, when you sign up and fill in your profile. Your measurements come from the Skillcard device your club runs during a session: it measures the drill and sends the numbers here. Your club may also create your roster entry before you have an account, using your name and training group.
What we use it for, and on what basis
| Why | What | Legal basis |
|---|---|---|
| Create and run your account, and keep you signed in | Email address, password hash, role, verification status | Performance of a contract (GDPR Art. 6(1)(b)) — you cannot have an account without it |
| Show your card and your results | Display name, position, dominant foot, birth year, profile photo, club and training group, and the measurements taken during your sessions | Performance of a contract (Art. 6(1)(b)). Profile fields beyond your name are optional; leaving them blank shows a placeholder |
| Let your coach see your results and track your progress | Your results, linked to your name inside your club | Performance of a contract with your club (Art. 6(1)(b)) |
| Show your card and results to other players and guardians in your club, and show you theirs | Your name, card and results, inside your club only | Your consent (Art. 6(1)(a)) — the “Share my results with my club” switch. It is off until you turn it on, it works both ways, and you can withdraw it at any time in Settings |
| Let a parent or guardian follow their player | The link between a guardian account and a player account | Performance of a contract (Art. 6(1)(b)), set up by an invite the player or club issues |
| Take payment for memberships and test unlocks | Billing customer reference, subscription status, payment status and history. Card details never reach us — they go straight to the payment provider | Performance of a contract (Art. 6(1)(b)); retention of invoices is a legal obligation (Art. 6(1)(c)) |
| Send transactional email | Email address, and the contents of the message (welcome, verification code, account deletion code, invite) | Performance of a contract (Art. 6(1)(b)) |
| Understand how the portal is used so we can improve it | Pseudonymous product events — which screens are opened, whether signup completed. Keyed to a random account identifier, never your name, email or birth year | Legitimate interests (Art. 6(1)(f)) — improving a service you use. No cookie is set for this and it cannot follow you to other sites, which is what keeps the balance in your favour |
| Record how you use the portal, to diagnose confusing screens | A masked replay of taps, scrolling and navigation. Everything you type and all on-screen text is masked in your browser before it is sent | Your consent (Art. 6(1)(a)) — off by default, 13+ only, withdrawable at any time in Settings |
| Keep the service secure and prevent abuse | Sign-in attempts, request logs, device and ingest API tokens | Legitimate interests (Art. 6(1)(f)) — protecting accounts and data |
We never sell personal data, we run no advertising, and we do not share your data with anyone for their own marketing.
Children
Players are often under 18. Where a player is under 18, a parent or guardian can hold access to the account and exercise these rights on the player's behalf. The account itself is created on the basis of the contract with the player and their club, not on consent, so no separate parental consent is needed to hold a card — but anything we do run on consent is treated more carefully for minors.
Session recording is the clearest example: it is off by default, offered only to users aged 13 or over, and never enabled for anyone who has not switched it on themselves.
We do not knowingly collect data from children under 13 beyond what a club supplies to run the training it is responsible for. If you are a guardian and want a child's data removed, email us and we will do it.
How your results are scored
Your card score (FDI) is calculated automatically from your measurements against fixed reference anchors. It is a training aid. It is not used to make any decision that has legal effects for you or similarly significantly affects you, and we do not use it for selection, profiling for marketing, or any automated decision-making in the sense of Article 22 GDPR. What your coach or club does with the number is their decision, not an automated one.
Measurements can contain errors. If you think a result is wrong, tell your coach — results can be corrected or removed.
Who else sees it
- Your coaches and club administrators, for the club you belong to.
- A parent or guardian you or your club has linked to your account.
- Anyone you deliberately share a card link with — a shared card is a public link until you stop sharing it.
- Other players and guardians in your club, in the roster, leaderboards and comparisons — only if you have switched club sharing on, and only inside your own club.
No one outside your club can see your results. Club sharing is scoped to your own club: there is no cross-club roster, leaderboard or profile view, and no other club can look you up. Where the portal shows how a club compares with others in the same country, that comparison is built from anonymous aggregate figures — never named results, and never anything that identifies a player in another club.
Beyond that, personal data is handled on our behalf by the service providers below, under data processing agreements. None of them may use it for their own purposes.
| Provider | What they do | Where |
|---|---|---|
| Amazon Web Services | Hosting, database and photo storage | EU (Frankfurt, eu-central-1) |
| PostHog | Product analytics and, with consent, session replay | EU (Frankfurt) |
| Resend | Transactional email delivery | EU / United States, under Standard Contractual Clauses |
| Stripe | Card payments and subscription billing | EU / United States, under Standard Contractual Clauses |
| Montonio | Bank-link payments | EU (Estonia) |
Your account data, results and photos are stored in the EU. Where a provider may process data outside the EEA, that transfer is covered by the European Commission's Standard Contractual Clauses; ask us for a copy.
How long we keep it (retention)
- Account and profile: retained for as long as your account exists, and erased when you delete it.
- Measurements: deleting your account detaches your results from you and removes your identifying details. Once detached they can no longer be traced back to you, and we may keep them in that anonymised form (see below).
- Session recordings: deleted automatically after 30 days, and immediately if you withdraw consent.
- Product analytics events: retained in pseudonymous form for up to 12 months.
- Payment and invoice records: 7 years, because Estonian accounting law requires it.
- Security and request logs: up to 90 days.
Anonymised data
Once a measurement has been stripped of everything that ties it to you, it stops being personal data and the rules above no longer bite. We keep measurements in that anonymised form and use them to keep club and country averages honest, to improve the scoring model, and in aggregate statistics — including for marketing, for example “players improve their passing accuracy by X% over a season”.
This never includes your name, photo, email or anything else that points back to you, and we do not publish an individual player's results as marketing material without asking them first.
Your rights
Under the GDPR you can:
- See what we hold — email us for an export of your data.
- Correct it — name, position, birth year, dominant foot and photo are all editable in Settings.
- Delete your account — in Settings, confirmed with a code we email you.
- Withdraw consent — club sharing and session recording are both switches in Settings, and withdrawing does not affect what happened before.
- Object to processing based on our legitimate interests, including product analytics.
- Ask us to restrict processing, or to hand your data to another service in a portable format.
Write to skillcard@skillcard.pro. We answer within one month. Exercising these rights is free.
Complaints
If you believe we have handled your data incorrectly, please contact us first so we can put it right. You also have the right to complain to the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), info@aki.ee, or to the supervisory authority in your own EU country.
Cookies
The portal sets no cookie that requires consent unless you opt in to session recording. Every cookie is listed by name in the Cookie Policy.
Changes
If we change how we use your data in a way that affects you, we will say so in the portal before it takes effect, not merely edit this page and change the date at the top.