Privacy policy

ScrumR (“ScrumR”, “we”, “us”) connects rugby players, coaches and staff, clubs, and agents. This policy explains what personal data we collect, why we collect it, the lawful bases on which we rely, who we share it with, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are in the EEA, the EU GDPR gives you equivalent rights.

The data controller is SCRUMR LIMITED (company number 17074337), registered at Axis 8, Axis Court, Riverside Business Park, Swansea Vale, Swansea, Wales, SA7 0AJ. For any privacy question, or to exercise your rights, contact us at privacy@scrumrapp.com.

Information we collect

We collect the following categories of personal data:

• Account details — name, email address, password (stored only in hashed form by our authentication provider), and your role (player, staff, club, or agent).
• Profile and sporting data — biography, profile and banner images, playing position(s), preferred format (15s/7s), tier, availability, current club, career history, references, height, weight, date of birth, and performance stats.
• Eligibility data — birth country, passport/nationality countries, and international eligibility. We collect this so clubs and agents can assess playing eligibility; it can reveal information about your nationality, so we treat it with particular care and only display it where you have chosen to share it.
• Location data — the town/region and approximate coordinates you provide, used to place profiles on the discovery map and to power location search.
• Media — highlight videos and photos you upload, hosted and streamed through our video provider.
• Activity and usage data — profile views, shortlists, permit and contact requests, job applications, searches, notifications, and similar interactions with the platform.
• Technical data — Device and browser information used to keep the service secure and diagnose faults. With your consent, analytics also includes usage events, IP-derived location and screen recordings with typed text hidden.
• Payment data — if you subscribe to a paid plan, payments are handled by our payment processor. We receive your subscription status and customer reference, but we do not store your full card details.

How and why we use your data

We use your personal data to:

• Create and operate your account and profile;
• Make your profile discoverable to other ScrumR users in line with your role and settings (this is the core purpose of the platform);
• Connect players and staff with clubs and agents through search, shortlists, permit and contact requests, and job applications;
• Send service notifications and transactional emails;
• Process subscriptions and payments;
• Keep the platform secure, prevent abuse, and diagnose and fix problems;
• Let club coaches take registers, including with no signal;
• With your consent, understand usage and improve the service.

Lawful bases for processing

Under the UK GDPR we rely on the following lawful bases:

• Performance of a contract — to provide the account and recruitment services you sign up for.
• Consent — for optional features such as uploading video, making specific information public, and non-essential analytics. You can withdraw consent at any time.
• Legitimate interests — to secure the platform, prevent fraud and abuse, diagnose faults, and let club coaches take registers with no signal, balanced against your rights and freedoms.
• Legal obligation — where we are required to process data to comply with the law.

Profile visibility

ScrumR is a discovery platform: information you add to your profile is, by design, visible to other registered users appropriate to your role (for example, clubs and agents can search for and view player and staff profiles). You control what you publish and can edit or hide profile information, or delete your account, at any time. Some aggregated, non-identifying activity (such as “a club viewed your profile”) may be shown to other users; the identity behind such activity is not revealed except where a user explicitly contacts or shortlists you.

Offline registers

Club coaches can take a register with no signal. To make that work, the coach's device (their phone or tablet) keeps a short copy of their squad for sessions in the next 7 days. The copy holds each player's name as ScrumR shows it, their position, availability answer and attendance mark. It does not hold email addresses, notes or any other profile details. ScrumR uses the copy for up to 7 days. After that, it is deleted the next time the coach opens ScrumR in that browser or app. It is deleted sooner when the coach signs out, or when someone else signs in to ScrumR in that same browser or app. Marks a coach takes with no signal stay on the device until they sync.

If a player leaves a squad or asks us to delete their data, their name leaves the copy the next time the coach's device updates it. ScrumR stops showing an old copy within 7 days at most.

Who we share your data with

We do not sell your personal data. We share it only with service providers (“processors”) who help us run the platform under contract and on our instructions:

• Supabase — database, authentication, and file storage;
• Mux — Video hosting and streaming. Mux does not collect playback analytics for ScrumR;
• Stripe — payment processing for paid plans;
• Resend — transactional email delivery;
• PostHog (EU) — Product and usage analytics, only if you accept;
• Vercel — Application hosting and content delivery; Web Analytics and Speed Insights only if you accept analytics;
• Sentry — Error reports to diagnose and fix faults;
• MapTiler, OpenFreeMap, and Mapbox — map and location rendering;
• Upstash and Inngest — rate limiting and background processing.

We may also disclose data where required by law, to enforce our terms, or to protect the rights and safety of our users.

International data transfers

Some of our providers are based outside the UK and EEA, including in the United States. Where we transfer personal data internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (or Addendum to the EU Standard Contractual Clauses) and equivalent measures, so that your data continues to receive an adequate level of protection.

Data retention

We keep your personal data for as long as your account is active and as needed to provide the service. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain certain information to comply with legal obligations, resolve disputes, or enforce our agreements. Our payment providers keep invoices and charges for accounting purposes after a subscription is cancelled. See Delete your ScrumR account for exactly what we delete and what we keep. You can also pause your account instead of deleting it. Pausing hides your profile. Coming back may mean resubscribing. If you join the waitlist to be emailed when you turn 18, we keep those details for up to 3 years after you become eligible. The copy of a squad kept on a coach's device for offline registers is used for 7 days at most, then deleted the next time ScrumR opens on that device.

Your rights under the GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you;
• Rectification — ask us to correct inaccurate or incomplete data;
• Erasure — ask us to delete your personal data (the “right to be forgotten”);
• Restriction — ask us to limit how we process your data;
• Portability — receive your data in a portable, machine-readable format;
• Objection — object to processing based on our legitimate interests;
• Withdraw consent — at any time, where we rely on consent;
• Not be subject to solely automated decisions that have a legal or similarly significant effect on you.

To exercise any of these rights, email privacy@scrumrapp.com. We will respond within the time limits set by law (normally one month).

Children and young players

ScrumR is a recruitment platform on which profiles are visible to clubs and agents. It is not intended for children under 13, and we do not knowingly create accounts for them. If you are between 13 and 18, you should only use ScrumR with the knowledge and consent of a parent or guardian, who should help you decide what information to make public. If you believe a child has provided us with personal data without appropriate consent, contact privacy@scrumrapp.com and we will take appropriate steps to address it.

If you're under 18 and in a club squad, your coach's device may keep your name and the other details above too. See Offline registers.

Cookies and analytics

Essential. We use cookies and similar storage to keep you signed in, keep ScrumR secure and take payments. These are always on. We also keep registers on a coach's device so they work with no signal. We send error reports to Sentry so we can fix faults. They do not include your name or email address.

Analytics. Analytics is off unless you accept it. If you accept, we use PostHog (EU) to record how ScrumR is used. That includes the pages you view, what you tap, how fast pages load, and screen recordings with typed text hidden. We link this to your account: your user ID, email address, role, subscription status and club. PostHog also receives your IP address and uses it to estimate your location. We use Vercel Web Analytics and Speed Insights to measure page views and speed.

Your choice. You choose when you first visit ScrumR. You can change it at any time in Settings or with the Analytics choices link. If you switch analytics off, we stop collecting straight away and remove analytics data stored on your device. We ask again after six months and whenever analytics changes. We keep a record of your choice, with its date and version. To delete analytics data we already hold, email privacy@scrumrapp.com.

• Supabase — Keeps you signed in and stores your account. Always on.
• Payment provider — Takes payments and prevents payment fraud. Always on.
• Sentry — Reports crashes so we can fix faults, without your name or email address. Always on.
• PostHog (EU) — Measures usage and records screens with typed text hidden, linked to your account. Only if you accept analytics.
• Mux — Delivers video and does not collect playback analytics for ScrumR. Always on.
• ScrumR offline register — Keeps a coach's registers, and a short copy of their squad for the next 7 days, on their device so a register works with no signal. Always on.
• Vercel Web Analytics and Speed Insights — Measures page views and page speed. Only if you accept analytics.

Data security

We use technical and organisational measures — including encryption in transit, access controls, and row-level security in our database — to protect your personal data. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.

Complaints

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk, or with your local supervisory authority if you are in the EEA.

Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you through the platform.

Contact

For any privacy-related question, or to exercise your rights, contact us at privacy@scrumrapp.com.