Privacy Policy

1. Data controller

The controller is SILVERMOON - UNIPESSOAL, LDA., company number 517 362 708, with registered office at Rua do Cabo 52 1E, 1250-056 Lisboa, Portugal ("LocalMatch"). General and privacy contact: support@local-match.com. LocalMatch has not appointed a Data Protection Officer: it does not fall within any of the cases in Article 37 GDPR. Personal-data requests are handled through the same contact.

2. Data we process

• Account and identity data: name, email address, telephone, date of birth (requested from anyone creating a player account and from whoever represents a partner or an association, solely to confirm the minimum age), user type and credentials managed by the authentication provider.
• Profile and sports data: photograph, location or preferred areas, sports, level, availability and match preferences.
• Booking and activity data: matches, venues, registrations, attendance, cancellations, reviews, reports and support communications.
• Partner and association data: identity, contacts, tax number, address, IBAN, venue information, contracts and documents needed for the commercial relationship.
• Payment data: amounts, method, transaction identifiers, status, refunds and fraud-prevention information. LocalMatch does not store full card details.
• Technical data: IP address, session identifiers, device, browser, security logs and, after consent, analytics data.
• Content supplied by the data subject: messages, requests, documents and files uploaded to the platform.
• Contact details of third-party venues: telephone number or electronic mail address of facilities that do not belong to LocalMatch, provided by whoever organises matches there, for communication addressed to the venue itself.

3. Purposes and legal bases

• Contract and pre-contractual steps: create and manage accounts, show venues and matches, complete bookings, process payments, cancellations, refunds and support.
• Legal obligation: invoicing, accounts, anti-money-laundering duties where applicable, responses to authorities and legally required records.
• Legitimate interests: security, prevention of fraud and abuse, legal claims, strictly necessary service improvement and operational communications, balanced against the data subject's rights.
• Consent: precise location, analytics or marketing cookies and promotional communications. Consent may be withdrawn at any time without affecting earlier lawful processing.
• Vital interests or legal claims where exceptionally applicable.

4. Recipients and processors

We share only necessary data with partners delivering a booking and providers bound by contract and documented instructions.

• Supabase: database, authentication, storage and platform functions.
• Stripe: payments, fraud prevention, refunds and partner payouts.
• Resend: transactional email and, where authorised, marketing messages.
• Vercel: hosting, distribution and technical operation of the application.
• PostHog: product analytics and application error reporting, hosted in the European Union and active only where the analytics category is consented to.
• Meta Platforms Ireland Limited: measurement of LocalMatch's advertising campaigns on Facebook and Instagram through the Meta Pixel, active only where the marketing category is consented to.
• Upstash: Redis services for rate limiting, queues or operational caching.
• Authorities, courts, advisers and auditors where law, security or legal claims require it.

5. International transfers

Some providers may process data outside the EEA. LocalMatch then relies on an adequacy decision, European Commission standard contractual clauses or another valid safeguard, with supplementary measures where needed. Details are available from support@local-match.com. This is the case of Meta Platforms Ireland Limited, which may transfer the data collected by the Meta Pixel to the United States under the EU-U.S. Data Privacy Framework, to which Meta Platforms, Inc. is certified.

6. Retention

• Active account data: for the contractual relationship and as needed to settle outstanding obligations.
• Deletion request: a 30-day confirmation period, followed by deletion of authentication, profiles and personal objects, subject to legal retention.
• Accounting, tax, contractual and payment records: for statutory periods, generally up to 10 years where required.
• Full Stripe webhook payload: 30 days; the technical idempotency key is retained.
• Delivered transactional email: 90 days in the outbox; used verification codes: 30 days; read notifications: 90 days.
• Account exports: temporary link for the period stated in the email, followed by deletion under the operational routine.
• Legacy Firebase archive: no live data remains. The data was migrated and the source project is kept only as a migration backup, and is deleted — project, database and files — as soon as the migration is closed.
• Analytics events collected with consent (PostHog): 12 months.
• Meta Pixel cookies (_fbp and _fbc): three months on the device. Retention of the events received by Meta is governed by Meta's policy.
• Disputes, fraud or legal duties may justify limited additional retention.

7. Data subject rights

Under the GDPR you may request access, rectification, erasure, restriction, objection and portability, withdraw consent, and avoid decisions based solely on automated processing with significant effects. Account deletion and export through /api/account/export are available in the platform. You may also contact support@local-match.com. We normally answer within one month and may verify identity. You may complain to Portugal's data protection authority, the CNPD.

8. Security and breaches

We use access controls, separation of duties, encrypted communications, audit logs, backups and risk-based incident procedures. No system is infallible. Where a breach risks individuals, we notify the authority and, for high risk, affected individuals as required by law.

9. Cookies and analytics

Strictly necessary cookies work without consent. Analytics and marketing are off by default and may only be enabled after an affirmative choice. Product analytics run on PostHog, hosted in the European Union, and are loaded only after that choice. The choice can be changed at any time on the Cookie Policy page, which also lists the data collected and the retention period. Marketing is done with the Meta Pixel and it is loaded only after the marketing category is consented to.

10. Children

LocalMatch is for people aged 18 or over. Minors may not create accounts, so no parental consent applies. If we learn that an account belongs to a minor, we delete it and erase the associated data. Anyone who spots such a case can tell us at support@local-match.com. To confirm this, we ask for the date of birth at sign-up, both from anyone creating a player account and from whoever represents a partner or an association. That date is used only to verify the minimum age, is never published and is not used for anything else.

11. Contact details of third-party venues

Whoever organises a match at a facility that does not belong to LocalMatch gives us a contact for that facility, a telephone number or an electronic mail address, so that we can speak to whoever runs it. That contact is treated as data of a legal person or of a professional acting in the course of business, for the purpose of commercial communication addressed to the facility itself, on the legal basis of LocalMatch's legitimate interest in developing its network of venues, under Article 6(1)(f) GDPR. The contact is kept on the facility record, is not published, is not transferred to third parties and is not used for communications addressed to individual data subjects. Every communication identifies LocalMatch and includes a free and immediate means of refusing future communications; a facility that uses it stops being contacted, and that refusal is recorded precisely so that it is not contacted again by mistake. The contact is retained for as long as the facility remains on the platform as a place where matches are held; where there is a refusal, the record of it is retained for as long as is necessary to ensure that it is honoured. At any time, the facility may request access to, rectification of or erasure of the contact at support@local-match.com.

12. Changes and contact

We may update this Policy for legal, technical or service changes. Material changes will be communicated appropriately before taking effect. Contact: SILVERMOON - UNIPESSOAL, LDA., Rua do Cabo 52 1E, 1250-056 Lisboa, Portugal, support@local-match.com.