XVis Privacy Policy

1.1 Club Admin accounts. Name, email address, club affiliation and role, password (stored hashed), and any club information you provide (badge, colours, ground, sponsors, squad/team sheet data).

1.2 Fan accounts. Name or display name, email address, password (stored hashed), followed clubs, and in-app notification preferences.

1.2a Sponsor and squad data (Pro plan). Where a club on the Pro plan chooses to feature a sponsor, we collect the sponsor's name and logo as provided by the club. Where a club manages multiple named squads (e.g. 1st XV, 2nd XV, Colts), player and squad data is organised accordingly but otherwise handled the same as described in this Policy.

1.3 Guest club listings. Publicly available club information (e.g. name, fixtures) used to create informational, non-followable listings before a club registers.

1.4 Usage data. Pages viewed, features used, and engagement metrics (e.g. via the embeddable match centre widget), collected to operate and improve the Service.

1.5 Payment data. Where a club subscribes to a paid plan, billing name, email, and transaction details are collected. Card details are handled directly by Stripe, Inc. and are not stored by XVis.

1.6 Technical data. IP address, device and browser type, and similar technical information collected automatically for security and service operation (e.g. rate limiting, abuse prevention).

We use personal data to:

• Create and administer accounts and provide the Service;
• Operate club subscriptions and process payments via Stripe;
• Power the live match centre, team sheets, notifications, and social features;
• Communicate with you about your account, the Service, or support requests;
• Maintain security, prevent abuse, and enforce our Terms of Service;
• Analyse aggregate usage to improve the Service;
• Comply with legal obligations.

We process personal data on the following bases:

• Contract — to provide the Service you've signed up for (accounts, subscriptions, match centre features);
• Consent — for optional communications, such as marketing emails, which you may withdraw at any time;
• Legitimate interests — for security, fraud prevention, and improving the Service, balanced against your rights;
• Legal obligation — where processing is required by law (e.g. financial record-keeping).

We share personal data with:

• Stripe, Inc. — to process club subscription payments;
• Supabase / hosting infrastructure providers — to store and run the Service;
• Vercel — to host the Service and, if enabled, to provide privacy-friendly usage analytics;
• Resend (or equivalent email provider) — to send account verification, password reset, and transactional emails;
• Other clubs or fans, where you choose to make information visible (e.g. a fan following a club, public match centre data);
• Law enforcement or regulators, where required by law.

We do not sell personal data to third parties.

Where any of our service providers process data outside the UK, we ensure appropriate safeguards are in place, such as the UK's International Data Transfer Addendum or an adequacy decision.

We retain account data for as long as your account is active. If you close your account, we will delete or anonymise personal data within a reasonable period, except where we need to retain it for legal, accounting, or security purposes (e.g. transaction records).

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Request deletion of your data ("right to be forgotten");
• Restrict or object to certain processing;
• Data portability;
• Withdraw consent at any time, where processing is based on consent;
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise these rights, contact us at hello@xvis.live.

Fan accounts require users to be at least 16 years old. We do not knowingly collect personal data from children under 16.

We apply technical and organisational measures to protect personal data, including rate limiting, file upload validation, security headers, and restricted access via role-based authentication (fan, club admin, superadmin). No system is completely secure, and we cannot guarantee absolute security.

We use cookies that are strictly necessary for the Service to function — for example, to keep you logged in and to remember your session. We may also use Vercel Analytics to understand overall usage of the Service (such as page views and general traffic patterns). Vercel Analytics is designed to be privacy-friendly and does not use cookies to track you individually across sites. We do not use cookies for advertising or third-party tracking. If our use of analytics or cookies changes materially, we will update this Policy and, where required by law, seek your consent.

We may update this Policy from time to time. Material changes will be notified via the Service or by email to account holders.