Privacy Policy

1. Data controller

The controller is SILVERMOON - UNIPESSOAL, LDA., company number 517 362 708, with registered office at Rua do Cabo 52 1E, 1250-056 Lisboa, Portugal ("LocalMatch"). General and privacy contact: support@local-match.com. LocalMatch has not appointed a Data Protection Officer: it does not fall within any of the cases in Article 37 GDPR. Personal-data requests are handled through the same contact.

2. Data we process

• Account and identity data: name, email address, telephone, date of birth where needed, user type and credentials managed by the authentication provider.
• Profile and sports data: photograph, location or preferred areas, sports, level, availability and match preferences.
• Booking and activity data: matches, venues, registrations, attendance, cancellations, reviews, reports and support communications.
• Partner and association data: identity, contacts, tax number, address, IBAN, venue information, contracts and documents needed for the commercial relationship.
• Payment data: amounts, method, transaction identifiers, status, refunds and fraud-prevention information. LocalMatch does not store full card details.
• Technical data: IP address, session identifiers, device, browser, security logs and, after consent, analytics data.
• Content supplied by the data subject: messages, requests, documents and files uploaded to the platform.

3. Purposes and legal bases

• Contract and pre-contractual steps: create and manage accounts, show venues and matches, complete bookings, process payments, cancellations, refunds and support.
• Legal obligation: invoicing, accounts, anti-money-laundering duties where applicable, responses to authorities and legally required records.
• Legitimate interests: security, prevention of fraud and abuse, legal claims, strictly necessary service improvement and operational communications, balanced against the data subject's rights.
• Consent: precise location, analytics or marketing cookies and promotional communications. Consent may be withdrawn at any time without affecting earlier lawful processing.
• Vital interests or legal claims where exceptionally applicable.

4. Recipients and processors

We share only necessary data with partners delivering a booking and providers bound by contract and documented instructions.

• Supabase: database, authentication, storage and platform functions.
• Stripe: payments, fraud prevention, refunds and partner payouts.
• Resend: transactional email and, where authorised, marketing messages.
• Vercel: hosting, distribution and technical operation of the application.
• PostHog: product analytics and application error reporting, hosted in the European Union and active only where the analytics category is consented to.
• Upstash: Redis services for rate limiting, queues or operational caching.
• Authorities, courts, advisers and auditors where law, security or legal claims require it.

5. International transfers

Some providers may process data outside the EEA. LocalMatch then relies on an adequacy decision, European Commission standard contractual clauses or another valid safeguard, with supplementary measures where needed. Details are available from support@local-match.com.

6. Retention

• Active account data: for the contractual relationship and as needed to settle outstanding obligations.
• Deletion request: a 30-day confirmation period, followed by deletion of authentication, profiles and personal objects, subject to legal retention.
• Accounting, tax, contractual and payment records: for statutory periods, generally up to 10 years where required.
• Full Stripe webhook payload: 30 days; the technical idempotency key is retained.
• Delivered transactional email: 90 days in the outbox; used verification codes: 30 days; read notifications: 90 days.
• Account exports: temporary link for the period stated in the email, followed by deletion under the operational routine.
• Legacy Firebase archive: no live data remains. The data was migrated and the source project is kept only as a migration backup, and is deleted — project, database and files — as soon as the migration is closed.
• Analytics events collected with consent (PostHog): 12 months.
• Disputes, fraud or legal duties may justify limited additional retention.

7. Data subject rights

Under the GDPR you may request access, rectification, erasure, restriction, objection and portability, withdraw consent, and avoid decisions based solely on automated processing with significant effects. Account deletion and export through /api/account/export are available in the platform. You may also contact support@local-match.com. We normally answer within one month and may verify identity. You may complain to Portugal's data protection authority, the CNPD.

8. Security and breaches

We use access controls, separation of duties, encrypted communications, audit logs, backups and risk-based incident procedures. No system is infallible. Where a breach risks individuals, we notify the authority and, for high risk, affected individuals as required by law.

9. Cookies and analytics

Strictly necessary cookies work without consent. Analytics and marketing are off by default and may only be enabled after an affirmative choice. Product analytics run on PostHog, hosted in the European Union, and are loaded only after that choice. The choice can be changed at any time on the Cookie Policy page, which also lists the data collected and the retention period.

10. Children

LocalMatch is for people aged 18 or over. Minors may not create accounts, so no parental consent applies. If we learn that an account belongs to a minor, we delete it and erase the associated data. Anyone who spots such a case can tell us at support@local-match.com.

11. Changes and contact

We may update this Policy for legal, technical or service changes. Material changes will be communicated appropriately before taking effect. Contact: SILVERMOON - UNIPESSOAL, LDA., Rua do Cabo 52 1E, 1250-056 Lisboa, Portugal, support@local-match.com.