Privacy Policy

Last Updated: June 3, 2026

Introduction

SPAL ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the SPAL platform (spal.app), our mobile-friendly web application for sports planning and league management.

This policy complies with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as well as other applicable privacy laws.

1. Information We Collect

1.1 Personal Information You Provide

We collect information that you voluntarily provide when you:

  • Create an account (name, email address, password)
  • Complete your profile (profile photo, bio, contact preferences)
  • Create or join groups and teams
  • Organize or register for events
  • Communicate through our platform (messages, comments)
  • Contact our support team

1.2 Automatically Collected Information

When you access our platform, we automatically collect:

  • Device information (IP address, browser type, operating system)
  • Usage data (pages viewed, features accessed, time spent)
  • Location data (if you grant permission)
  • Cookies and similar tracking technologies

1.3 Information from Third Parties

We may receive information about you from:

  • Authentication providers (if you use social login)
  • Payment processors (for transaction verification)
  • Analytics services (for usage patterns)

2. How We Use Your Information

2.1 Lawful Basis for Processing (GDPR)

We process your personal data based on:

  • Contract performance: To provide our services as agreed
  • Legitimate interests: To improve our platform, prevent fraud, and ensure security
  • Consent: For marketing communications and optional features
  • Legal obligations: To comply with applicable laws

2.2 Purposes of Data Processing

We use your information to:

  • Provide, maintain, and improve our services
  • Create and manage your account
  • Process event registrations and team assignments
  • Send notifications about events, messages, and platform updates by email and, where you have opted in, by SMS text message
  • Respond to your inquiries and provide customer support
  • Personalize your experience and recommend relevant content
  • Analyze usage patterns and improve platform functionality
  • Detect, prevent, and address technical issues and security threats
  • Comply with legal obligations and enforce our Terms of Service

2.3 SMS / Text Message Communications

We send SMS (text message) notifications only to users who have explicitly opted in. You provide consent to receive SMS messages either during onboarding or by enabling SMS notifications in your account preferences at any time. We use your phone number solely to deliver these messages and do not use it for any other purpose without your consent.

SMS messages are transactional in nature (for example, event reminders and account-related notifications) and are sent only while SMS notifications remain enabled for your account. You can withdraw your consent and stop receiving SMS messages at any time by disabling SMS notifications in your account preferences, or by replying STOP to any message. Standard message and data rates may apply.

3. Categories of Personal Information (CCPA)

Under the CCPA, we collect the following categories of personal information:

  • Identifiers: Name, email address, username, IP address
  • Contact Information: Email address, phone number (optional)
  • Profile Information: Profile photo, bio, preferences
  • Usage Data: Interaction with platform features, event participation
  • Geolocation Data: Approximate location (if permitted)
  • Device Information: Browser type, operating system, device identifiers

4. Information Sharing and Disclosure

4.1 We Share Information With:

  • Other users: Your profile information and event participation may be visible to group members
  • Service providers: Third-party vendors who assist with hosting, analytics, email delivery, and payment processing
  • SMS delivery provider: We use Twilio to deliver SMS text messages on our behalf. When you have opted in to SMS notifications, your phone number and message content are shared with Twilio solely to deliver those messages; Twilio is contractually restricted from using this information for any other purpose
  • Legal authorities: When required by law or to protect our rights and safety

4.2 We Do NOT:

  • Sell your personal information to third parties
  • Share your data for third-party marketing purposes
  • Transfer data without appropriate safeguards

5. Data Retention

We retain your personal information for as long as:

  • Your account remains active
  • Needed to provide our services
  • Required by law or contractual obligations
  • Necessary for legitimate business purposes

When you delete your account, we will delete or anonymize your personal information within 90 days, except where retention is required by law.

6. Your Rights and Choices

6.1 GDPR Rights (EU Residents)

If you are in the European Union, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate or incomplete data
  • Erasure: Request deletion of your data ("right to be forgotten")
  • Restriction: Limit how we process your data
  • Portability: Receive your data in a structured, machine-readable format
  • Objection: Object to processing based on legitimate interests
  • Withdraw consent: Opt-out of consent-based processing at any time
  • Lodge a complaint: File a complaint with your local data protection authority

6.2 CCPA Rights (California Residents)

If you are a California resident, you have the right to:

  • Know: Request disclosure of personal information collected, used, and shared
  • Delete: Request deletion of your personal information
  • Opt-out: Opt-out of the sale of personal information (we do not sell personal information)
  • Non-discrimination: Exercise your rights without discriminatory treatment

Do Not Sell My Personal Information: We do not sell personal information and have not sold personal information in the preceding 12 months.

6.3 How to Exercise Your Rights

To exercise any of these rights, please contact us at:

  • Email: support@spal.app
  • Through your account settings (for certain rights)

You can stop receiving SMS text messages at any time by disabling SMS notifications in your account preferences or by replying STOP to any message. This choice is independent of your other communication preferences and does not affect essential, non-SMS account communications.

We will respond to verified requests within 30 days (GDPR) or 45 days (CCPA).

7. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses approved by the European Commission
  • Privacy Shield certification (where applicable)
  • Consent for specific transfers

8. Data Security

We implement industry-standard security measures to protect your information, including:

  • Encryption of data in transit (TLS/SSL)
  • Encryption of sensitive data at rest
  • Regular security assessments and penetration testing
  • Access controls and authentication requirements
  • Employee training on data protection

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to:

  • Maintain your session and authentication
  • Remember your preferences
  • Analyze usage patterns and improve our platform
  • Provide personalized content

You can control cookies through your browser settings. Disabling cookies may limit platform functionality.

Cookie Categories:

  • Essential: Required for platform operation
  • Functional: Enhance user experience and remember preferences
  • Analytics: Help us understand usage patterns
  • Marketing: Track effectiveness of communications (with consent)

10. Children's Privacy

Our platform is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn that we have collected information from a child under 13, we will delete it promptly. Parents or guardians who believe we have collected information from a child should contact us immediately.

11. Third-Party Links

Our platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

  • Changes in our practices
  • Legal or regulatory requirements
  • New features or services

We will notify you of material changes by:

  • Posting a notice on our platform
  • Sending an email to your registered email address
  • Requiring acceptance before continued use (for significant changes)

Your continued use of the platform after changes constitutes acceptance of the updated Privacy Policy.

13. Data Controller and Contact Information

Data Controller: SPAL Platform

Contact Information:

  • Email: support@spal.app
  • Website: spal.app

Data Protection Officer (DPO): For GDPR-related inquiries, contact our DPO at support@spal.app

14. Additional Information for Specific Jurisdictions

14.1 European Union Residents

Our representative in the EU can be contacted at: support@spal.app

You have the right to lodge a complaint with your local supervisory authority if you believe we have processed your data unlawfully.

14.2 California Residents

Under the CCPA "Shine the Light" law, California residents may request information about our disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

15. How We Respond to Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature. Our platform does not currently respond to DNT signals, as there is no industry-wide standard for compliance.

16. Automated Decision-Making

We do not use your personal information for automated decision-making or profiling that produces legal effects or similarly significantly affects you.

17. Your California Privacy Rights - CCPA Metrics

In accordance with CCPA transparency requirements:

  • Requests received: Available upon request
  • Requests fulfilled: We comply with all verified requests
  • Average response time: 30 days or less

Questions or Concerns?

If you have questions about this Privacy Policy or our data practices, please contact us at support@spal.app.

Last Updated: June 3, 2026

Read our Terms of Service