Privacy policy

At Clybo’ we process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR) and the Maltese legislation that supplements it (Data Protection Act, Chapter 586 of the Laws of Malta), since the controller is established in Malta, as well as with any applicable United States state privacy laws. This policy explains what data we collect, what we use it for, how long we keep it and what your rights are.

1. Data controller

The controller of your personal data is FlamaTech Consulting LTD, a company registered under C99332, with its registered office at The Penthouse 20, Lyons Range Court, Bisazza Street,Sliema (Malta), VAT MT28308119.

• Identity: FlamaTech Consulting LTD (Clybo’)
• Tax ID / VAT: MT28308119
• Registration details: C99332
• Registered office: The Penthouse 20, Lyons Range Court, Bisazza Street, Sliema, Malta
• General contact: hola@clybo.app
• Data Protection Officer: dpo@clybo.app

2. Data we collect

Depending on your relationship with Clybo’, we process the following categories of data:

• Club managers: name, email, phone, club details (tax ID (CIF), tax address), bank details for charging the subscription.
• Guardians: name, email, phone, identity document, payment reference and postal address.
• Athletes: name, date of birth, identity document, medical data (when provided by the guardian), signed consents.
• Technical data: IP address, user agent, audit logs and, with your consent, sign-in email as an account analytics identifier, pages visited, sign-ins, features used, browser, device, approximate location and LCP, INP, CLS and FCP performance metrics.

3. Purposes and legal basis

We process your data for the following purposes:

4. Signing in with Google

Clybo’ offers Google as an optional method for signing up and signing in. Authentication is carried out through Google OAuth 2.0 and Supabase Auth. The scopes used are email and profile:

• email lets us receive the primary email of your Google Account and know whether Google has verified it.
• profile lets us receive the basic profile details available, such as first name, surname or picture. Google may not provide all of these fields.

We access this data solely to create or link your account, authenticate you, keep you signed in and set up the basic details of your profile. This integration does not request permission to read Gmail, Google Drive, Google Calendar, your contacts or any other content in your Google Account.

Google delivers the data through Supabase Auth, which processes it as Clybo’s authentication provider. The identity identifier, the email and the profile metadata received are stored in the authentication record linked to your account. They are kept for the periods that apply to account data set out in the section “Retention periods” and are not shared beyond the necessary providers described in this policy. We do not sell this data or use it for advertising.

You can remove the connection from the third-party connections in your Google Account. Removing the connection prevents future authorisations through Google, but does not by itself delete your Clybo’ account or the data already added to it. To request access, rectification or erasure, use the channels in the section “Your rights”.

The use and transfer of information received from Google APIs comply with the Google API Services User Data Policy, including its Limited Use requirements.

5. Recipients of the data

We only share your data with the providers strictly necessary to deliver the service, always under a data processing agreement in accordance with Article 28 GDPR:

• Amazon Web Services (Frankfurt, EU) — platform hosting.
• Supabase (Supabase Auth) — authentication, identity linking and session management.
• Stripe Payments Europe Ltd. (Dublin, EU) — payment processing.
• Resend (Germany, EU) — sending transactional email.
• Cloudflare (global network) — DNS, perimeter security and technical transit for PostHog's managed proxy.
• PostHog (EU infrastructure) — consented product and performance analytics in the browser, which uses the normalised sign-in email to link an account's activity across sessions and includes, in the family app and registration forms, session recordings with all content masked; and diagnosis of errors in the server and in the club management dashboard on the basis of legitimate interest, with prior minimisation and sanitisation. It also hosts Clybo’ support in the panel, on the website, in the staff app and in the family app (customer support, legitimate interest): messages, the app version, device type and language that are added to the first message from the staff or family app and, if you provide them, name and email. In the management panel the chat is always available; on the website and in the staff and family apps it only loads when you open it. In no case does it record your activity.
• Google Ireland Limited (Google Analytics 4) — consented analytics on the public landing site only. The tag is not downloaded before you accept; it receives no account identifiers, forms or contact details, and advertising signals and purposes remain disabled.
• B2Brouter (Spain, EU) — issuing and submitting invoices when the club activates the Tax add-on.
• Agencia Tributaria Española (AEAT, the Spanish tax agency) — not a provider: it receives the invoicing records submitted through VeriFactu when the law requires it (legal obligation).

We do not sell or pass on data to third parties for advertising purposes.

6. International transfers

The main servers and PostHog's final ingestion are in the European Union. Network transit may take place on the global infrastructure of providers such as Cloudflare. Google Analytics may involve processing by Google group entities outside the EEA. For these transfers, the safeguards set out in Google's measurement terms apply, such as a current adequacy decision or standard contractual clauses approved by the European Commission.

7. Retention periods

• Active account: for as long as the club keeps its subscription.
• Google identity: the identifier, email and profile added to the account follow the same periods as account data. Removing the connection in Google does not delete them from Clybo’; you can request their erasure through the channels below.
• Tax data and invoices: 6 years from the end of the financial year (art. 30 of the Código de Comercio, the Spanish Commercial Code) and 7 years from issue for VeriFactu records.
• Sales prospecting data: until you withdraw your consent.
• PostHog: up to 12 months; session recordings, 30 days.
• Google Analytics 4: 2 months for user and event data; standard aggregated reports are not subject to that retention control. Its cookies expire after 12 months at most and do not renew that period on each visit.
• Analytics preference: until you change it or clear the local storage of the relevant site.

8. Your rights · GDPR

As a data subject you have the right to:

• Access your personal data.
• Rectification of inaccurate data.
• Erasure when the data is no longer necessary.
• Object to processing based on legitimate interest.
• Restriction of processing.
• Portability in a structured, readable format.
• Withdraw consent at any time, without retroactive effect.

To exercise them, write to dpo@clybo.app stating your name and the right you wish to exercise. We will reply within one month at most.

If you believe the processing does not comply with the regulations, you can lodge a complaint with the controller's lead supervisory authority, the Information and Data Protection Commissioner (IDPC) of Malta, or with the authority of the Member State where you live, work or where the alleged infringement took place (art. 77 GDPR). In Spain, this is the Agencia Española de Protección de Datos (AEPD, the Spanish Data Protection Agency).

9. Privacy rights in the United States

Where a United States state law applies, its residents may have the right to know about or access their personal data, correct it, request its deletion, obtain a portable copy and opt out of its sale, sharing for behavioural advertising, targeted advertising or profiling with significant legal effects. They may also exercise these rights without receiving discriminatory treatment.

At Clybo’ we do not sell or share personal data within the meaning of the California Consumer Privacy Act (CCPA), nor do we use Google Analytics for targeted advertising. Even so, the landing site recognises Global Privacy Control (GPC) as a request to opt out of optional analytics. You can also use Cookie settings in the footer or write to dpo@clybo.app. If a request is refused and your state's law recognises a right of appeal, you can appeal by replying to our decision through the same channel.

10. Data on minors

Clybo’ is designed so that the sports club is the Data Controller for the data of child athletes and their guardians. Clybo’ acts as Data Processor under a DPA signed between both parties. The club's own policy on minors is provided by the club to its guardians at the time of registration.

11. Security

We apply reasonable technical and organisational measures to protect the data: AES-256 encryption at rest, TLS 1.3 in transit, role-based access control, activity logging, encrypted backups and regular review of providers.

12. Changes to this policy

This policy may be updated to reflect legal or operational changes. The date of the last review appears at the top of the document. If the changes are substantial, we will notify you by email before they take effect.

13. How to contact us

DPO: dpo@clybo.app. General enquiries: hola@clybo.app.