Privacy Policy

The data controller responsible for your personal data is:

We collect only what is necessary to provide the service.

Account and authentication data

• ·Email address — used to authenticate you via a magic link.
• ·Account name — used to label your account within the product.

Billing data

If you purchase a paid plan, Stripe collects your name, email address, payment card details, and billing address on our behalf. We store only a Stripe customer ID and your subscription status. We never see or store full payment card numbers.

Scoreboard content

Team names, team colors, and logo images you upload are stored to deliver the scoreboard overlay. This content is not personal data unless you choose to include personal information in it.

Analytics data

Google Tag Manager loads Google Analytics, which records pseudonymous usage data such as page views and sign-in actions. When you are signed in, it also records your account's user ID, a random identifier that does not contain your name or email address. In the EEA, the UK, Switzerland and Québec, analytics only runs after you accept it on the cookie banner. Elsewhere it runs by default, and you can turn it off by choosing “Reject all”. Microsoft Clarity only runs after you accept it, wherever you are. No analytics runs on the scoreboard overlay pages.

Email address

Authenticate you; send transactional emails related to your account (e.g. sign-in links, billing receipts).

Account name

Identify your account within the product interface.

Stripe customer ID

Link your account to a Stripe subscription and process billing events.

Scoreboard content

Render your scoreboard overlay and control panel.

Analytics events

Understand how people use ScoreLayer so we can improve it. Requires your consent in the EEA, the UK, Switzerland and Québec.

We process your personal data on the following legal bases under GDPR Article 6:

Contract

Processing your email and account data is necessary to perform the service you signed up for (Art. 6(1)(b)).

Legal obligation

Retaining billing records to comply with tax and accounting law (Art. 6(1)(c)).

Legitimate interests

Preventing fraud and abuse, and maintaining service security (Art. 6(1)(f)).

Consent

Analytics cookies in the EEA, the UK, Switzerland and Québec: only if you accept them on the cookie banner. You may withdraw consent at any time (Art. 6(1)(a)).

We share data with the following sub-processors, who process data strictly on our behalf:

We do not sell, rent, or share your personal data with any other third parties for their own purposes.

Account data

Retained for as long as your account is active. Deleted within 30 days of an account deletion request.

Billing records

Retained for 7 years to comply with EU tax and accounting obligations, even after account deletion.

Uploaded logos

Deleted when you remove the file or when your account is deleted.

Analytics data

Retained per Google Analytics retention settings (default: 14 months). In the EEA, the UK, Switzerland and Québec, only collected with your consent.

Supabase stores data within the EU. Stripe and Google operate in the United States. Where data is transferred outside the European Economic Area, appropriate safeguards are in place — specifically the European Commission's Standard Contractual Clauses (SCCs) under GDPR Article 46(2)(c).

We use minimal browser storage:

In the EEA, the UK, Switzerland and Québec, Google Analytics cookies are only set after you accept analytics on the cookie banner. Elsewhere they are set by default, and choosing “Reject all” turns them off. You can change your choice at any time with the “Cookie preferences” link at the bottom-left of the page.

Under GDPR, you have the following rights regarding your personal data:

Access

Request a copy of the personal data we hold about you.

Rectification

Ask us to correct inaccurate or incomplete data.

Erasure

Ask us to delete your account and personal data ("right to be forgotten").

Restriction

Ask us to pause processing your data in certain circumstances.

Portability

Receive your data in a structured, machine-readable format.

Objection

Object to processing based on legitimate interests.

Withdraw consent

Withdraw analytics consent at any time without affecting prior processing.

To exercise any of these rights, email us at support@scorelayer.live. We will respond within 30 days.

You also have the right to lodge a complaint with your national data protection authority. In Ireland, this is the Data Protection Commission (DPC). A list of all EU supervisory authorities is available at edpb.europa.eu.

ScoreLayer is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. If you have an account, we will notify you by email for significant changes. Continued use of the service after changes are posted constitutes acceptance of the updated policy.

For any privacy-related questions, requests, or complaints, contact us at: