Privacy Policy

1. Who we are

SVMS Consultancy Limited is the data controller for personal data processed through RefereeGPT.

2. What we collect

• Account information: email address, display name, country and experience level
• Your questions and the answers: what you ask the match official advisor, and what it replies
• Training activity: quiz answers, scores, streaks, progress statistics and which features you use
• Organisation membership: if you join or are invited to a referee organisation, we store that membership and who invited you
• Feedback and reports: anything you send us about an answer or the app
• Notifications: your browser push subscription, if you turn push notifications on
• Referrals: if you refer someone or arrive through a referral, we record the link between the accounts
• API keys: if you create a key to use RefereeGPT from another tool, we store the key record and its usage
• Email records: which emails we sent you and whether they were delivered, opened or unsubscribed
• Payment data: your Stripe customer and subscription identifiers, plan, status and renewal dates. Card details are held by Stripe. We never see or store your full card number.
• Technical data: IP address, browser and device information, pages visited and session timestamps

3. Why we process it, and our legal basis

Where we rely on legitimate interest you have the right to object. See section 6.

4. AI processing

The match official advisor is powered by Google Gemini. When you ask a question, the text you send is transmitted to Google to generate a reply. Answers are produced automatically, with no human reviewing them first.

• Answers can be wrong or out of date, and they are not an official interpretation of the Laws of the Game. Check against the current IFAB text and your own association's directives before acting on anything.
• Please do not enter details that identify other people, in particular players under 18, in a question. You do not need to name anyone to get a useful answer about an incident.
• You can ask us for human review of any automated output by emailing us.

5. Who we share it with

We do not sell your personal data and we do not let any third party use it for their own advertising. We share it with the following processors so the service can run:

• Supabase (USA): database and authentication
• Google (USA and Ireland): the Gemini API behind the advisor, and Google Analytics if you accept analytics cookies
• Stripe (USA): payment processing
• Resend (USA): email delivery, used by the 360TFT hub that sends our email
• Sentry (USA): server-side error monitoring. It runs on our servers, not in your browser.
• Cloudflare (USA): content delivery, DNS and protection against attacks
• Hetzner Online GmbH (Germany): the servers the application runs on

If you are a member of a referee organisation on RefereeGPT, its administrators can see your membership and the training progress you complete as part of that organisation.

We may also disclose data where the law, a court order, or the defence of legal claims requires it. Signing up to RefereeGPT does not sign you up to any unrelated 360TFT product mailing list.

International transfers. Several processors above are in the United States, so your data is transferred outside the UK. Those transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on the UK extension to the EU-US Data Privacy Framework where the provider is certified under it.

6. Your rights

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted
• Ask us to restrict how we use it
• Receive your data in a portable, machine-readable format
• Object to processing we base on legitimate interest
• Withdraw consent at any time, where we rely on consent
• Ask for human review of automated output

To exercise any of these, email [email protected]. We will respond within one month, and there is no charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office. We would rather you came to us first so we can put it right.

7. How long we keep it

• Account data: until you delete your account, then up to 30 days while it clears our backups
• Questions, answers and training history: until you delete them or close your account
• Usage and analytics records: 12 months, then deleted or aggregated so they no longer identify you
• Email records: until you unsubscribe or ask for deletion. We keep a record of the unsubscribe so we do not email you again.
• Payment records: 7 years, as required by UK tax law
• Error diagnostics: 90 days

8. Security

• All traffic is encrypted in transit using TLS
• Data is encrypted at rest by our database provider
• Database access is restricted by row-level security policies, so one account cannot read another account's data
• API keys are stored hashed

No system is completely secure and we cannot guarantee absolute security. If you think your account has been compromised, email us straight away.

9. If something goes wrong

If there is a personal data breach likely to be a risk to your rights, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell you directly without undue delay where the risk to you is high.

10. Cookies

• Essential cookies: required for authentication and session management. These are always active.
• Analytics cookies: Google Analytics, to understand how the site is used. These are only set if you accept them in the cookie banner, and your IP address is anonymised.

You can change your cookie choice at any time. If you decline analytics, no Google Analytics script is loaded and no analytics cookie is set. We do not run advertising pixels on RefereeGPT.

11. Children

RefereeGPT is built for match officials aged 13 and over, matching the minimum age in our Terms of Service and the UK age of digital consent. We do not knowingly collect personal data from anyone younger. If you believe a child has given us their data, email us and we will delete it.

12. Changes to this policy

We will update this page when what we do changes, and move the date at the top. If a change materially affects your rights we will tell you by email before it takes effect.

13. Contact

See also our Terms of Service.