Privacy policy

Data controller

The controller for the processing described in this policy is the MultApp project, which operates the service. For any question about this policy or your personal data, write to privacy@multapp.app.

Data we collect

Account data (via Clerk)

When you sign up, our authentication provider Clerk collects and stores your email address, display name and, optionally, your profile picture. MultApp receives a copy of these fields through a signed Clerk session token each time you use the app, and stores them alongside your team activity so your teammates can identify you.

Team activity

While you use MultApp we store the teams you belong to, your role in each one (player, treasurer or coach), the fines issued to or by you, payment statuses, comments, reactions, your notification preferences and push-notification endpoints. If you choose to add payment details (a Bizum phone number, or a Venmo or PayPal username) so your teammates can settle their fines with you, those details are stored and shown to the members of your teams. MultApp never processes payments and never has access to your bank or card details. All of this information is stored in our Supabase database hosted in the European Union.

Technical data

Our infrastructure providers (Vercel for hosting, Supabase for the database) keep short-lived server logs that include your IP address and browser user-agent. We use them exclusively for security, abuse prevention and debugging.

Purposes and legal basis

We process your data to provide the service you sign up for — managing your teams, recording fines and keeping a reliable history for every member — which is necessary for the performance of a contract (Art. 6(1)(b) GDPR). We rely on our legitimate interest (Art. 6(1)(f) GDPR) to keep the service secure and prevent abuse. Push notifications are only sent with your prior consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from your notification settings without affecting the rest of the service. We do not use your data for advertising, profiling or automated decision-making.

Retention

We keep your personal data for as long as your account remains active. When you delete it, we erase your personal identifiers (name, email, avatar, notification preferences and payment details) from our database and instruct Clerk to delete your authentication record. Fines, payments and comments you created or that mention you are anonymised rather than erased, because your former teammates rely on them for an accurate team history. Server logs are deleted automatically after a short period.

Sub-processors

We share only the minimum data required with the following sub-processors: Clerk, Inc. (authentication and session management), Supabase (PostgreSQL database and storage, hosted in the EU) and Vercel, Inc. (application hosting and delivery, plus cookie-less, aggregated usage analytics). Each of them operates under a data-processing agreement with GDPR-level obligations. We never sell your personal data or share it with advertisers.

International transfers

Our database is hosted in the European Union. Some sub-processors (Clerk, Vercel) are US companies and may process limited data outside the EEA; where that happens, the transfer is protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Security

All traffic to MultApp is encrypted in transit (TLS). Database access is protected by row-level security policies, so members of one team cannot read another team's data, and administrative access is limited to what is strictly necessary to operate the service. No system is infallible: if we ever detect a breach affecting your personal data, we will notify you and the competent authority as required by Arts. 33–34 GDPR.

Your rights

You have the right to access, rectify, port and erase your data, to restrict or object to its processing, and to withdraw any consent you have given — at any time and free of charge. Most of these rights can be exercised directly from your profile page (including full account deletion); for anything else, write to privacy@multapp.app and we will reply within one month at the latest. You can also lodge a complaint with your supervisory authority; in Spain, the AEPD (www.aepd.es).

Minors

MultApp is not directed at minors. You must be at least 16 years old to create an account. If we learn that we have collected personal data from a child under that age, we will delete the account and the associated data.

Cookies

MultApp only sets cookies that are strictly necessary for the service to work: the authentication session (Clerk), CSRF protection and your language preference. The Vercel analytics we use are cookie-less and produce only aggregated statistics. Since we use no advertising or tracking cookies, no consent banner is required.

Changes to this policy

If we make material changes to this policy, we will let you know in the app and update the date shown at the top of this page. Where a change requires your consent, we will ask for it.