Privacy policy

What this policy covers

Eskuadra is a CRM for football agents and agencies. It helps them manage players, club requests, pitches and deals, and includes an assistant called Compa. This policy explains what personal data we process, why, with whom, and what your choices are.

1. Who is responsible

[Company or individual name], [address], is the controller of the personal data described here. Contact: privacy@eskuadra.com.

Your agency decides what client data (such as players and contacts) it puts into Eskuadra. For that content the agency is the controller and we act as its processor, under a data processing agreement available on request.

2. What we process

We do not use advertising or third-party tracking cookies, and we do not sell personal data. The website uses cookie-free analytics that count visits without identifying visitors.

3. Compa and AI processing

When you send a message to Compa, the message, the page or record you chose to include and the records Compa reads to answer are sent to an AI model provider to produce the reply. By default this is Anthropic, in the United States. Under Anthropic’s commercial terms, data sent through its API is not used to train its models. If your agency has set its own provider key, that provider is used instead and the app tells you so.

Compa acts as you: it reads only what your role can see, and it only proposes changes. You review and confirm them before anything is saved. Eskuadra never logs the prompts, tool results or answers; per reply it records the model, token counts and timing.

Conversations belong to the member who had them and are kept until that member deletes them. [Platform retention period to be decided.] Read how Compa works.

4. Google and Microsoft calendars

Connecting a calendar is optional and needs your explicit approval on the Google or Microsoft consent screen. On Google we ask for access only to calendars created by Eskuadra (calendar.app.created), plus your email address. On Microsoft we ask to read and write your calendars (Calendars.ReadWrite), plus your email address and offline access. We use this access only to sync Eskuadra events to your calendar.

Eskuadra’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising and we do not allow humans to read it, except with your consent, for security, or to comply with law.

You can disconnect at any time in Eskuadra, which deletes the stored tokens. You can also remove access from your Google account permissions page or your Microsoft account’s app permissions page.

5. Legal bases

We process your data to perform our contract with you or your agency, for our legitimate interests in running and securing the service, with your consent for optional features such as calendar connections, and to comply with legal obligations. Agencies hold their own legal basis for the player and contact data they enter, including any special categories of data in player documents.

6. Who we share data with

• The providers listed on the sub-processors page: Supabase (database, sign-in, files, in the EU), Cloudflare (delivery), Anthropic (Compa), Scaleway (email), and Google or Microsoft only if you connect a calendar.
• Members of your own agency, according to the permissions your agency sets.
• Clubs and other people your agency sends a pitch or a list to: they see the columns the agency chose, through a link.

Some providers process data outside the European Economic Area. Where they do, we rely on the EU Standard Contractual Clauses or an adequacy decision.

7. How long we keep data

We keep account and agency data while the account is active. After an account or agency is deleted we remove its data within [30] days, except where we must keep it by law (for example accounting records). Backups are overwritten on their normal cycle. [Confirm backup retention.]

8. Your rights

Under the GDPR you can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interests. Where processing relies on consent you can withdraw it at any time. To use these rights, email privacy@eskuadra.com. If data belongs to an agency’s client records, we will refer you to the agency, which is the controller, and help it answer. You also have the right to complain to your local data protection authority.

If you are a player who appears in the shared football dataset (name, position, club, a photo with its credit) and want an entry corrected or removed, write to the same address.

9. Security

Encryption in transit and at rest, row-level access policies that keep each agency’s data apart, encrypted storage of calendar tokens and provider keys, role-based permissions, daily backups and sign-in by email code or link with no stored passwords. The security page has the detail. No system is perfectly secure, so we also limit access to what is needed and tell affected agencies promptly if an incident touches their data.

10. Children

Eskuadra accounts are for professionals and not for children under 16. Agencies may record players who are minors as part of representing them; those records follow the rules above and the agency’s own duties towards the player and their guardians.

11. Changes

If we change this policy in a meaningful way, we will update the date above and tell members in the app.