The short version
- We collect only what we need to run your account, take your subscription, and stop our content being copied.
- We do not use advertising or analytics trackers, and we do not sell your data.
- Your card details go to Stripe. We never see them.
- You can delete your account yourself, at any time, from your account page.
1. Who is responsible for your data
Goalside is the controller of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). You can contact us about your data at [email protected].
This notice covers the Goalside website and service. It should be read with our Terms of use.
2. What we collect, why, and how long we keep it
| What | Why we use it | Our lawful basis | How long we keep it |
|---|
| Email address and password, when you create an account. Your password is stored scrambled (hashed), so we cannot read it. | To create your account, let you sign in, and send you account emails (confirming your email, resetting your password). | Contract: to provide the service you asked for. | While your account exists. Deleted when you delete your account. |
| Subscription details: whether you have Goalside Plus, its status, when it renews or ends, and your Stripe customer reference. | To give you access to Goalside Plus and manage your billing. | Contract; and legal obligation for our accounting records. | Deleted with your account. Billing records we are legally required to keep are kept for 6 years (see Stripe, below). |
| A record of your agreement at checkout (that you asked for immediate access, and which wording you saw). | To show that you agreed, if there is ever a dispute. | Legitimate interests (keeping proof of our contracts); legal claims. | Deleted with your account. |
| Which paid sessions you open, when, and a random browser code. Each paid page you open also carries your email address and a reference code. | To enforce the device and fair-use limits, and to trace a copy if content is shared or copied. | Legitimate interests (protecting our content and our other subscribers’ value from copying). | 12 months, then deleted automatically. Also deleted with your account. |
| Records of when a limit was reached, and any suspension of your account. | To spot sharing and copying, and to review suspensions fairly. | Legitimate interests (as above). | 12 months, then deleted automatically. A suspension lasts until we lift it. Deleted with your account. |
| Problem reports: what you write, the session and page it was about, your email address only if you choose to give one, a link to your account if you were signed in, and a one-way scrambled fingerprint of your network address (not the address itself). | To fix mistakes in sessions, reply to you if you asked, and prevent spam. | Legitimate interests (improving the service and preventing abuse). | 24 months, then deleted automatically. If you delete your account, we remove the link to it; ask us if you want a report deleted sooner. |
| Messages you send us, such as an email to our contact address. | To answer you. | Legitimate interests; contract, where it concerns your subscription. | As long as needed to deal with your message and any follow-up, then deleted. |
| Payment details. You enter your card on Stripe’s page. We receive only confirmation of whether a payment worked and your subscription status. | To take payment. | Contract. | Held by Stripe, not by us (see section 4). |
We do not ask for, and you should not give us, the names or personal details of players or other children. We do not use advertising or analytics trackers on Goalside, and we do not sell your personal data.
You do not have to give us your personal data, but without an email address and password we cannot give you an account or Goalside Plus. The free sessions can be opened without an account.
3. Cookies and similar storage on your device
Goalside does not use advertising or tracking cookies. It stores the following on your device, all of which is needed to provide the service you asked for or to keep it secure, so we do not ask for consent for it:
- A sign-in record (local storage) that keeps you signed in. It is removed when you sign out.
- A random browser code (local storage). It is not linked to anything about you except your account when you sign in. We use it to apply the three-device limit and to protect our content from being shared.
- A confirmation date (local storage), recording when your subscription was last confirmed online, so that saved paid sessions can be checked.
- Saved pages (browser cache): copies of the website’s pages, and sessions you have opened or saved, so that they work with a poor signal or none. A saved paid session shows your email address and reference code like any other, and stops opening if your subscription has not been confirmed online for 30 days. Signing out, deleting your account, or your subscription ending while you are online removes the saved paid sessions and the confirmation date from your device.
You can clear this at any time in your browser settings, but you may then need to sign in again, and saved sessions will be lost.
4. Where the data goes
We share personal data only with the organisations that help us run Goalside. They act on our instructions under their own data protection terms, except Stripe, which is also responsible for some of its own uses (such as fraud prevention and its legal duties).
- Supabase: stores accounts, subscription records and our private session files. Our database is hosted in Ireland.
- Stripe: takes payments, runs the billing page and holds payment and invoice records.
- Cloudflare: hosts the website and may keep short-term technical logs (such as network addresses) to deliver pages and protect the site from attack.
- Our email provider: sends account emails, such as confirming your email address and resetting your password.
We may also share data if the law requires it, to protect our rights, or if we sell or reorganise the business (the buyer would have to keep to this notice).
5. Transfers outside the UK
Some of these organisations, or their staff and systems, are outside the UK, for example in the European Economic Area or the United States. Where personal data is sent outside the UK, we make sure it is protected by an approved safeguard, such as the UK’s adequacy decision for the EEA, or the UK Addendum to the EU standard contractual clauses, or the UK-US data bridge. Ask us at [email protected] if you would like more detail.
6. Keeping it safe
We use sensible measures to protect your data, including encrypted connections, private storage for paid sessions, passwords that are stored scrambled, and access rules that limit what each person and system can see. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the Information Commissioner’s Office as the law requires.
7. Automatic decisions
Our system can automatically pause an account when a device or fair-use limit is reached (see section 9 of the Terms). Every such pause can be reviewed by a person: email [email protected] and tell us your account email.
8. Emails we send
We send only service emails: confirming your email address, resetting your password, and replies to messages or reports you sent. Stripe sends your payment receipts. We do not send marketing emails. If we ever do, we will ask for your consent first, and you will be able to say no at any time.
9. Deleting your account
You can delete your account yourself on your account page. If you have Goalside Plus, it is cancelled at once. We then delete your account, subscription records, agreement record, device and access records. Stripe keeps payment and invoice records for as long as the law requires (normally 6 years for tax and accounting purposes). Any copy of a problem report you sent is kept as set out in the table above.
10. Your rights
Under UK data protection law you have the right to:
- be told how we use your data (this notice);
- ask for a copy of the data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use your data;
- object to our use of your data where we rely on legitimate interests;
- ask for your data in a portable form, where we use it because of a contract with you; and
- not be subject to a significant decision made only by automated means (see section 7).
To use any of these rights, email [email protected]. We may need to check it is really you. We will reply within one month, and we will not charge you unless a request is clearly unfounded or excessive.
11. Complaints
Please tell us first if you are unhappy about how we use your data, and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator: ico.org.uk, 0303 123 1113.
12. Changes to this notice
We may update this notice. The date at the top shows when it last changed. If a change matters to you, we will tell you before it applies.