Privacy Policy
Last updated: 19 September 2026
This Privacy Policy explains how Acciom Limited ("we", "us", "our") collects, uses, stores and shares personal data in connection with the Touchlines platform ("Service"). It applies to coaches, spectators and anyone else who interacts with the Service.
We are registered with the Information Commissioner's Office (ICO) under registration number [ICO Registration Number — to be added].
We take your privacy seriously and process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
Data Controller:
Acciom Limited
Company Number: 11862326
Registered in England and Wales
Registered Office: [Registered Address — to be added]
Email: hello@touchlines.app
For data protection queries, email us at: hello@touchlines.app
2. Data We Collect
2.1 Account Data (Coaches)
When you create a Touchlines account:
- Name and email address
- Password (stored encrypted and managed by Clerk — we do not see your raw password)
- FA Coach Number (optional, if provided)
- Subscription and payment status (not card numbers — processed by Stripe)
2.2 Team and Player Data
When you use the Service to manage your team:
- Team name, age group, club name
- Player names (first name, and optionally a last initial — you control what you enter)
- Player statistics: goals, assists, match participation records, time on pitch (Pro)
- Match records: date, opponent, result, scorers, events, format
- Coach notes and Player of the Match records (Pro)
- Tournament records, standings and trophies
Player data and children: Touchlines is used to track youth football teams. Player data consists of names (as entered by the coach) and football statistics. We do not collect any data directly from minors. As coach, you are responsible for ensuring you have appropriate authorisation (and, for players under 13, parental consent) before entering player data into the platform.
2.3 Match Location Data (Pro)
If you use the match location feature (Pro tier), we collect the geographical coordinates of match venues. This is used to display a map of grounds visited during the season. You can choose not to use this feature.
2.4 Media Uploads
Photos and videos uploaded to the Service (by you or by spectators via shared links) are stored in Vercel Blob storage. You control whether spectator uploads are enabled for your teams and whether they require moderation.
2.5 Spectator Data
When a spectator accesses a shared match link:
- Name and email address (required to access the live share — not stored beyond the match session unless the spectator creates an account)
- Any comments or media the spectator uploads
2.6 Technical and Usage Data
When you use the Service, we automatically collect:
- IP address and browser type
- Pages visited, features used and time spent
- Device and operating system information
- Error reports and performance data
2.7 Analytics
We use PostHog (EU region) to collect aggregated usage analytics. This helps us understand how the Service is used and improve it. PostHog is configured to anonymise data where possible.
3. How We Use Your Data
| Purpose | Data Used | Lawful Basis |
|---|---|---|
| Providing and operating the Service | Account, team, match data | Contract performance |
| Sending transactional emails (match shares, Replay notifications, billing) | Name, email | Contract performance |
| Processing payments and managing subscriptions | Subscription status (Stripe holds card data) | Contract performance |
| Live match sharing with spectators | Match events, score, spectator name/email | Contract performance / Legitimate interests |
| Generating Touchlines Replay | Season statistics, media, coach notes | Contract performance |
| Improving and developing the Service | Aggregated usage analytics | Legitimate interests |
| Communicating important service updates | Legitimate interests | |
| Complying with legal obligations | Any data required by law | Legal obligation |
| Preventing fraud and ensuring security | Account, technical data | Legitimate interests |
We do not use your data for automated decision-making that produces legal or similarly significant effects.
4. Marketing Communications
We will only send you marketing emails if you have explicitly opted in. You can opt out at any time by clicking the unsubscribe link in any marketing email or by contacting us at hello@touchlines.app.
Transactional emails (e.g., match share links, Replay ready notifications, subscription confirmations) are not marketing and will be sent when relevant to your use of the Service.
5. Sharing Your Data
We share personal data only as described below. We do not sell your personal data.
5.1 Sub-processors (Service Providers)
We use the following third-party processors to operate the Service. Each is bound by a data processing agreement:
| Provider | Purpose | Location | Link |
|---|---|---|---|
| Clerk | Authentication and user management | USA (SCCs in place) | clerk.com/privacy |
| Turso | Database hosting | USA (SCCs in place) | turso.tech/privacy |
| Stripe | Payment processing | USA (SCCs in place) | stripe.com/privacy |
| Vercel | Hosting and file storage | USA (SCCs in place) | vercel.com/legal/privacy-policy |
| Supabase | Real-time match updates | USA (SCCs in place) | supabase.com/privacy |
| PostHog | Analytics (EU region) | EU | posthog.com/privacy |
| Emailit | Transactional email | [Location] | [Privacy link] |
"SCCs" means Standard Contractual Clauses, the mechanism we rely on for transfers of personal data to countries outside the UK.
5.2 Legal Disclosure
We may disclose personal data if required to do so by law, court order, or to cooperate with regulatory authorities, or where necessary to protect the rights, property or safety of Acciom Limited, our users or others.
5.3 Business Transfers
If Acciom Limited is involved in a merger, acquisition or sale of assets, your data may be transferred as part of that transaction. We will notify you before your data is subject to a different privacy policy.
6. International Transfers
Some of our sub-processors are based outside the UK. We ensure appropriate safeguards are in place for international transfers, primarily through Standard Contractual Clauses approved by the UK ICO.
7. Data Retention
| Data Category | Retention Period |
|---|---|
| Account and profile data | Until account deletion + 30 days |
| Team and player data | Until account deletion + 30 days |
| Match records and statistics | Until account deletion + 30 days |
| Payment and subscription records | 7 years (legal requirement for financial records) |
| Media uploads (photos/videos) | Until deleted by coach, or account deletion + 30 days |
| Spectator session data | Session duration only, unless spectator creates an account |
| Safeguarding acknowledgement records | 12 months; IP addresses automatically deleted after 12 months, acknowledgement records retained for audit purposes |
| Analytics data (PostHog) | 24 months |
| Server access logs | 90 days |
When you delete your account, we initiate deletion of your personal data within 30 days. Some data may be retained for longer where required by law.
8. Your Rights
Under UK GDPR, you have the following rights:
Right to access: You can request a copy of the personal data we hold about you.
Right to rectification: You can ask us to correct inaccurate or incomplete data.
Right to erasure: You can ask us to delete your personal data where there is no legitimate reason for us to continue processing it.
Right to restrict processing: You can ask us to suspend processing your data in certain circumstances.
Right to data portability: You can request your data in a structured, machine-readable format. You can export all your data from the profile settings page.
Right to object: You can object to our processing of your personal data where we rely on legitimate interests as our lawful basis.
Rights related to automated decision-making: We do not make decisions about you based solely on automated processing.
To exercise any of these rights, email us at hello@touchlines.app. We will respond within one month.
9. Cookies
We use the following categories of cookies:
Strictly necessary cookies: Required for the Service to function (authentication sessions, security). These cannot be disabled.
Analytics cookies (PostHog): Used to understand how the Service is used. These are set only with your consent where required by law.
You can manage cookie preferences in your browser settings.
10. Safeguarding — Youth Matches
When a coach creates a match for a team with an age group of U11 or younger, we display a safeguarding notice and record an acknowledgement that:
- The coach confirms they have parental consent to share match data for the team.
- Live match links display scores and first names only — no photos, addresses, or other identifying information about players.
- Spectator media uploads are moderated by the coach before publication.
What we record: When a coach or spectator acknowledges the safeguarding notice, we log: the match and team reference, the age group, a timestamp, and the requester's IP address and browser user agent.
IP addresses: IP addresses collected as part of safeguarding acknowledgements are automatically deleted after 12 months in line with UK GDPR data minimisation requirements. The acknowledgement record itself (without IP) is retained for up to 12 months for audit purposes.
Spectator acknowledgements: Spectators visiting a live match link for a youth team are shown the same safeguarding notice before accessing the score feed. We record their acknowledgement for audit purposes under the same retention schedule.
11. Children's Privacy
The Service is not directed at children under 13. Coaches enter player data (including names of young players) on behalf of their teams. We do not knowingly collect personal data directly from children. If you become aware that a child has provided us with personal information without appropriate consent, please contact us at hello@touchlines.app and we will take steps to remove it.
12. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or damage. These include encryption in transit (TLS), encrypted storage, access controls, and regular security reviews.
Despite these measures, no transmission of data over the internet is completely secure. We cannot guarantee absolute security.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect, or by posting a notice on the Service. The date at the top of this page shows when it was last updated.
14. How to Complain
If you have concerns about how we handle your personal data, please contact us first at hello@touchlines.app. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk
15. Contact Us
For any privacy-related questions:
Acciom Limited
Company Number: 11862326
Email: hello@touchlines.app
Website: touchlines.app
This Privacy Policy was last updated on 19 September 2026.