Privacy Policy
This Privacy Policy explains how sportstudio.app ("we", "us", or "our") collects, uses, and protects the personal data of users ("you") who use our web application ("service").
1. Data Controller & Processor
Users always register for a specific organization (the "sport studio"). This organization is acting as the Data Controller. We process data on behalf of the organization as the Data Processor.
Data Controller: Your organization
Data Processor: sportstudio.app · contact@sportstudio.app
2. Data We Collect
From Users:
- First Name
- Last Name
From Organizations:
- Organization Name
- Address
- Phone Number
3. Purpose and Legal Basis
We collect and process your data for:
| Purpose | Legal Basis |
|---|---|
| Account creation and login | Contractual necessity |
| Providing application functionality | Contractual necessity |
| Transactional notifications (email, in-app) | Legitimate interest / contract |
| Error monitoring & security | Legitimate interest |
We do not use your data for advertising or sell your data to third parties.
4. Cookies
We only use functional cookies necessary for login, session handling, and user authentication.
No marketing, analytics, or tracking cookies are used.
5. Subprocessors
We use trusted service providers to help us operate the platform (see below). We ensure all subprocessors comply with GDPR and appropriate data protection agreements are in place.
| Provider | Purpose | Location | Data Processed | DPA in place |
|---|---|---|---|---|
| DigitalOcean | Hosting | Germany (Frankfurt) | Application data | ✅ |
| Laravel Forge | Deployment/Provisioning | Varies | Server Configuration | ✅ |
| Github | Code Storage | EU/US | Source Code | ✅ |
| Postmark | Transactional emails | US (with SCCs) | Email addresses, message content | ✅ |
| Laravel Nightwatch | Monitoring, error tracking | EU | Error Logs | ✅ |
6. Data Sharing
We do not share personal data with third parties except:
- As required by law
- With subprocessors (see above)
7. Your Rights
As a user, you have the right to:
- Access your data
- Correct your data
- Request deletion (right to be forgotten)
- Restrict or object to processing
- Request data portability
- Lodge a complaint with a supervisory authority
To exercise your rights, email us at privacy@sportstudio.app.
8. Data Retention
- User data is retained as long as the user account is active. After deletion, data is removed immediately with the exception of the data necessary for the proper administration of the organization.
- After termination of the organization account, all data is removed immediately.
- Backups are deleted after 90 days.
9. Data Security
We implement the following security measures:
- HTTPS encryption
- Passwords stored using bcrypt hashing
- Role-based access control
- Session management and automatic logout
- Rate limiting and optional 2FA
- Server hosting in the EU
10. Changes
We may update this Privacy Policy from time to time. Changes will be posted on this page and indicated with an updated "Effective Date".
11. Contact
For any privacy-related questions or requests, contact privacy@sportstudio.app.
Effective date: 01.09.2025