Privacy policy

1. Who processes your data

FICHA is a service of Krujens SportsTech (being incorporated) (“Krujens”). Tax ID: pending (company being incorporated). Address: pending (company being incorporated). Email: contact@krujens.eu.

FICHA is used by football clubs and academies for their scouting department. That is why there are two roles:

• The club decides which players it follows and what is written about them. It is the controller of the data about players, guardians, matches and reports. Krujens processes that data on the club's behalf (processor, Art. 28 GDPR), only to provide the service and as set out in its contract with the club.
• Krujens is the controller of your account data (name, email, language, preferences and permissions) and of the technical logs needed to keep the service running and secure.

If you are a player, guardian or relative and want to know what data a club holds about you, contact that club. If you don't know who to ask, write to us and we will pass it on.

2. What data we process

• About users (club staff): name, email, role, club, language, notification preferences, AI permission (date and version), the devices where you receive notifications, the notifications received, copilot conversations, the voice recordings you make and their transcription, and what you write in the app.
• About players, on the club's behalf: name, year and date of birth, position, preferred foot, current club, age group, photo, video links, reports, ratings and notes.
• About guardians, on the club's behalf: name, relationship to the player, phone and email (stored encrypted) and signed consents. Only the club's director and administrator can see them, and they are never sent to the AI.
• Technical data: IP address and access and error logs. Emails, identifiers, phone numbers and long numbers are removed from errors before they are stored.
• If you request access to the demo: name, email and, if you give them, club and job title.

3. Purposes and legal basis

• Giving you access and providing the service: performance of a contract (Art. 6(1)(b) GDPR), namely the club's contract with Krujens and these terms of use.
• Artificial intelligence features: only if the club turns them on and you give your permission (consent, Art. 6(1)(a)). You can withdraw it at any time in AI permission without affecting earlier processing; the form keeps working.
• Security, abuse protection, error logging and the AI spending cap: legitimate interest (Art. 6(1)(f)) in keeping the service secure and free from abuse.
• In-app, mobile and email notifications: the ones you choose in Notifications.
• Player and guardian data: the club processes it on its own legal basis (for example, the guardians' consent, which is recorded in the app). Krujens only follows its instructions.

We don't sell data, there is no advertising and no automated decisions with effects on anyone are made (Art. 22): the AI suggests and a person always reviews and decides.

4. Artificial intelligence

The AI transcribes voice notes, turns what you say into a report with quotes, writes the narrative and the weekly briefing, and answers in the copilot. Nothing is published without a person reviewing it, and AI output carries the ✨ AI label.

• Voice recordings are sent to Google (Gemini) or OpenAI to be transcribed. They carry your voice and everything you say, including players' names.
• Texts are sent to Anthropic (Claude). Players are sent as codes (J1, J2…), never by name. Guardians' data, phone numbers and emails are never sent.
• We use these providers' business services: they process the data only to provide the service to us and do not use it to train their models.

Without the club's permission and yours, nothing is sent to the AI.

5. Who it is shared with

With no one other than the club and these providers, which process data on Krujens' behalf under contract:

• Supabase: database, accounts, sign-in emails and files. Servers in London (United Kingdom, a country with an EU adequacy decision).
• Vercel: hosting of the website and server (USA).
• Anthropic: text AI (USA).
• Google: speech-to-text with Gemini (USA).
• OpenAI: speech-to-text, as an alternative (USA).
• Resend: sending notification emails (USA).
• Upstash: usage counters and abuse protection (USA).
• Sentry: error logging, without personal data (Germany, EU).

Transfers to the USA rely on the EU-US Data Privacy Framework when the provider has joined it and, otherwise, on the European Commission's standard contractual clauses. These providers give the data the same or greater protection than this policy.

Mobile notifications go through the push service of your browser or operating system (Google, Apple or Mozilla), which only receives the encrypted notification.

Within the club, each person sees what their role and the club's settings allow. Guardian data is only visible to the director and the administrator.

Apart from this, we would only disclose data if required by law (for example, by a court).

6. How long it is kept

• Your account: for as long as it exists. If you delete it (My account → Delete my account), your name, email, notifications, copilot conversations and voice recordings are deleted immediately. Your reports, notes, transcriptions and the players you added belong to the club and remain, without your name.
• Club data (players, guardians, reports): for as long as the contract with the club lasts. When it ends, the data is returned to the club or deleted, as the contract says.
• Technical and error logs: up to 90 days.
• Demo access requests: up to 30 days.
• Usage and spending counters: deleted automatically (from minutes to a month).

7. Your rights

You can request access to your data, correct it, delete it, object to or restrict its use, take it to another service (portability) and withdraw your consent at any time. In the app you have:

• My account → Download my data: a copy of your personal data in a file.
• My account → Delete my account. It is also explained at /borrar-cuenta.
• AI permission: give or withdraw your permission.

For anything else, write to contact@krujens.eu from your account's email address. We reply within one month at most.

If you believe we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).

8. Minors

FICHA is a tool for adult club staff: minors cannot have an account.

Players may be minors. The club decides about their data and must have their guardians' consent where the law requires it (in Spain, under 14: Art. 7 LOPDGDD). That is why FICHA protects them further: their names never go to the text AI, photos are private, guardian data is encrypted and each club only sees its own.

9. Security

Encrypted connections, each club kept separate from the others in the database, role-based permissions, encrypted guardian data, private photos and recordings, abuse protection and access rules checked by automated tests. In the event of a security breach we would inform the club and, where applicable, the authority and the people affected.

10. Cookies

We only use strictly necessary cookies and technical storage: the session, language, theme and, in the demo, the access permission. There are no advertising or analytics cookies, so no consent is needed for them.

11. Changes

If this policy changes in any important way, we will tell you in the app. If what is sent to the AI, or to whom, changes, we will ask for your permission again.