Privacy Policy

1. Who is responsible

For your account, sign-in, billing and the security of the service, MCO, Marko Humar s.p. is the data controller.

For the data a club enters about its teams, players, guardians and events, the club is the controller and Paliro processes that data on the club's behalf, under these terms and the club's instructions. Questions about why a club holds your family's data go to the club; questions about how Paliro handles it come to us at hello@paliro.app.

2. What we process

Paliro keeps only what the service needs to work:

• Account data: name, email address, language, time zone, and the sign-in method you use (magic link or Google). Passwords are never stored; Paliro has none.
• Club and team data entered by coaches and club admins: team names, players (first and last name, jersey number, position, optionally a birth date), guardians linked to a player, coaches and club admins, locations.
• Schedule data: events, recurring schedules, cancellations and changes, and each family's answers (coming, can't attend, arriving late, needs a ride, can drive, a note for the coach).
• Messages: notes coaches post to a team and events they share, and the automatic change posts.
• Notification data: what was sent to whom, over which channel (in-app, push, email, SMS), when it was delivered and whether it was seen, so a coach can tell who still needs a nudge.
• Mobile number, only if you verify one for SMS alerts, together with your opt-in and any STOP request.
• Push subscriptions for the devices where you enable push notifications.
• Billing data for clubs on a paid plan: plan, subscription status, invoices and SMS credit purchases. Card details are entered on Stripe's pages and never reach Paliro.
• Technical data: server logs with IP address and browser type kept for security and troubleshooting, and the cookies described below.

3. Children

Players are usually children. Clubs add them with the consent of a parent or guardian, and a child's own account is only possible from the age of 13 and only through the club. Paliro never contacts a child directly by SMS or email; all communication goes to the linked guardians unless the player has their own account.

4. Why we process it and on what basis

Under the GDPR, Paliro relies on:

• Performance of a contract: running your account, showing schedules, delivering answers and changes, billing paid plans.
• Legitimate interest: securing the service, preventing abuse, keeping delivery logs so coaches know who was reached, and improving the product from aggregated usage.
• Consent: SMS alerts (you verify a number and switch them on; reply STOP or turn them off at any time), push notifications (you allow them in your browser), and optional Google sign-in.
• Legal obligation: keeping invoices and tax records for as long as accounting law requires.

5. Who sees your data

Inside a club, coaches and club admins see the roster, contact details and answers for their teams. Parents and players see only their own child's data and the schedule; they never see other families' contacts or answers.

Paliro does not sell personal data and does not use it for advertising. To run the service we use these providers, each bound by a data processing agreement: Vercel Inc. (hosting (EU region, Frankfurt)); Neon Inc. (database (EU)); Resend Inc. (transactional email); Stripe Payments Europe Ltd. (payments, invoices and tax); Infobip d.o.o. (SMS delivery); Google LLC (optional sign-in with Google).

Data is stored in the European Union. Where a provider processes data outside the EU, the transfer rests on the European Commission's standard contractual clauses or an adequacy decision.

6. How long we keep it

• Account data: until you delete your account. Deleting it removes your profile and unlinks you from any players; the club's roster keeps the player.
• Club data: until the club deletes it or closes its account. A closed club is kept read-only for 30 days so it can be exported or restored, then deleted.
• Notification and delivery logs: 12 months.
• Server logs: 90 days.
• Invoices and payment records: as long as accounting and tax law requires (currently 10 years in Slovenia).

7. Your rights

You can access, correct, export or delete your data, restrict or object to processing, and withdraw consent at any time. Most of this you can do yourself in Profile & settings; for anything else write to hello@paliro.app and we answer within a month.

If you think we handle your data unlawfully you can complain to the supervisory authority: Informacijski pooblaščenec (Slovenian Information Commissioner), www.ip-rs.si.

8. Cookies

Paliro sets only strictly necessary cookies: your session after sign-in, your language choice, and a security token. There are no advertising or cross-site tracking cookies, so no cookie banner is needed.

9. Security

Data travels over TLS and is stored encrypted at rest with our hosting providers. Access inside Paliro follows the roles described above, sign-in uses one-time links instead of passwords, and platform administrators' access to a club is logged. If a breach affects your data we will inform you and the authority as the GDPR requires.

10. Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows the current version; material changes are announced in the app or by email.

11. Contact

MCO, Marko Humar s.p., Ljubljana, Slovenia. Email: hello@paliro.app.