Privacy Policy
1. Who we are
LeagueBot is a service operated by Datateru Ltd, a company registered in England and Wales (company number 17212478), registered office 112 Margetts Road, Bedford, MK42 8DU, United Kingdom.
You can contact us at support@datateru.com for any privacy-related queries.
This policy explains what we do with personal data, and, importantly, which of two different roles we are playing when we do it. Those roles are set out in the next section, because they determine who you should contact about your data.
2. Our role: controller and processor
Under UK GDPR, a controller decides why and how personal data is used. A processor only acts on a controller's instructions. We are one or the other depending on the data:
- →We are the CONTROLLER for: club administrator accounts, contact form submissions, billing records, and website server logs. We decide how that data is used, and this policy is our notice to you about it.
- →We are a PROCESSOR for: everything about a club's players: display names, pseudonymised phone identifiers, match results and the content of messages sent to Ace. The club decides to run the league, decides which players are in it, and supplies their details. The club is the controller; we act on its instructions.
If you are a player and want to access, correct or delete your data, contact your club in the first instance. They are the controller and they hold the decision. We will assist them promptly. You may also contact us and we will pass the request on.
Our obligations to clubs as their processor are set out in our Data Processing Agreement, which forms part of our Terms of Service. Every club has one; you do not need to sign anything separately.
3. What data we collect
We handle personal data in the following categories:
- →Club administrator details: name and email address, used to create a dashboard login and to contact you about your account. We are the controller for this.
- →Player phone numbers: supplied when a club admin adds a player, and received when a player messages Ace. The number is converted to a pseudonymous identifier on receipt and the original is not written to our database. See “Security” below for what that does and does not mean.
- →Player display names and usernames: supplied by the club admin, or chosen by the player. These appear on the club's public standings page. See “The public standings page”.
- →Match results: submitted by players via WhatsApp or entered by a club admin.
- →Message content: the text of WhatsApp messages sent to Ace, and Ace's replies. This is processed to work out what the player is asking for. See “How Ace uses AI”.
- →Contact form submissions: name, email address and message, when you contact us through this website.
- →Billing data: subscription status, plan and payment history. Card details are handled entirely by Stripe and never reach our systems.
- →Website server logs: IP address, user agent, requested URL and timestamp, recorded automatically when you visit this site.
4. Legal basis for processing
Where we are the controller, we rely on the following legal bases under UK GDPR:
- →Contract performance: administering your subscription, providing the dashboard, and taking payment.
- →Legitimate interests: keeping the platform secure and reliable, preventing misuse, and responding to enquiries. We have considered your interests and rights and consider these uses proportionate and expected.
- →Legal obligation: retaining accounting records.
- →Consent: marketing and product update emails, where you have opted in. You can withdraw consent at any time.
Where we act as a processor for a club, the legal basis is the club's to establish, not ours. Clubs are responsible for having a lawful basis for adding players and for telling those players how their data will be used. Our Terms of Service require this.
5. How Ace uses AI
Ace is an AI assistant. To understand a message like “I beat Sam 6-3 7-6”, the content of that message is sent to an AI model for interpretation. We use Anthropic's Claude models, accessed through the Anthropic API. This is the one part of the service where data is processed outside the United Kingdom. See “International transfers” below.
Two things follow from that, and we think you should know both:
- →Message content leaves our own systems to be interpreted. It is processed under a contract that permits it to be used only to return a response to us.
- →Message content is NOT used to train AI models. Neither we nor our AI provider use it for model training or improvement.
Ace only ever sees messages sent to it. It has no access to any other conversation on your phone, to your contacts, or to any WhatsApp group you are in.
Ace can make mistakes in interpreting a message. No decision Ace makes has a legal or similarly significant effect on you, and a club admin can correct any entry from the dashboard. If you would rather not message Ace at all, ask your club admin to submit your results on your behalf.
6. The public standings page
Each club gets a publicly accessible standings page on its own subdomain. It shows player display names or usernames alongside their box, results and standings. It is not password-protected and can be found and indexed by search engines.
Phone numbers, email addresses and message content are never published. Only a player's name or username and their results are shown.
Clubs are responsible for telling their players that this page is public before adding them. Players who do not want their real name published can ask their club admin to change their display name to a username or initials, which the platform supports.
7. Children and junior players
Clubs may run junior leagues, so we know some players will be under 18. Where that is the case:
- →The club, as controller, is responsible for obtaining consent from a parent or guardian where one is required. In the UK, a child under 13 cannot consent to an online service on their own behalf.
- →The club is responsible for deciding whether a junior league's standings page should identify children by name. We recommend usernames or initials for junior leagues, and the platform supports this.
- →We collect no more data about a junior player than about any other player, and we do not profile players or use their data for marketing.
- →A club administrator account must belong to an adult aged 18 or over.
If you are a parent or guardian and want a child's data removed, contact the club, or contact us at support@datateru.com and we will act on the club's instruction promptly.
8. How we use your data
- →To operate the league management service and keep standings up to date.
- →To allow Ace to recognise which player a message came from, and to interpret what it says.
- →To publish club standings on the club's public page.
- →To respond to support and contact enquiries.
- →To process subscription payments via Stripe.
- →To monitor and improve the reliability, security and performance of the platform.
We do not sell personal data, we do not share it for advertising, and we do not use it to train AI models.
9. Data retention
We keep personal data only as long as we need it:
- →Active league data (player names, pseudonymised phone identifiers, results): kept while the club's subscription is active, so that historical standings remain meaningful.
- →Message content: a short conversation history is kept for one hour so that Ace can follow a thread, then expires automatically. It is not stored in our league database. Our AI provider retains messages sent to it for interpretation only for a limited period, and does not use them to train models.
- →On cancellation: club data is deleted within 90 days, unless the club asks for it sooner or the law requires us to keep it.
- →Club administrator accounts: deleted within 90 days of the subscription ending.
- →Contact form submissions: up to 24 months.
- →Website server logs: 90 days.
- →Billing and accounting records: 7 years, as required by UK tax law.
A club can ask us to delete a specific player's data at any time, and we will act on that instruction. We will keep results in an anonymised form where deleting them would corrupt the league table for other players.
10. Sub-processors and third-party services
We use the following third-party services, each of which may process personal data on our behalf. Each is bound by a contract requiring it to protect that data and to use it only for the service it provides to us:
- →Cloud infrastructure provider (Amazon Web Services): hosting, compute, storage and access logs, in the United Kingdom.
- →Managed database provider: the PostgreSQL database holding league data (player display names, pseudonymised phone identifiers, match results), in the United Kingdom.
- →Meta Platforms (WhatsApp Business Platform): delivery and receipt of the WhatsApp messages between players and Ace.
- →Telephony provider: supplies each club's phone number and carries the SMS used to verify it. Handles phone numbers in full.
- →Anthropic: interprets the content of messages sent to Ace. Processed in the United States. See “How Ace uses AI” below.
- →Stripe: subscription payments and billing. Card details are handled by Stripe and never reach us.
- →Transactional email provider: onboarding and billing notifications.
- →Form handling provider: receives contact form submissions from this website.
We identify each of these providers by name to our customers, and to anyone with a legitimate interest, on request at support@datateru.com.
We will give clubs at least 30 days' notice before adding or replacing a sub-processor that handles player data, so that a club can object. This list is the authoritative one and is updated whenever it changes.
11. International transfers
Our hosting and our database are located in the United Kingdom. Message content sent to Ace is processed by Anthropic in the United States. In addition, some of our sub-processors are established in the United States and may process data there or in other countries.
Where personal data is transferred outside the UK, we rely on one of the following safeguards, as appropriate to the recipient:
- →UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it.
- →The UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum.
We carry out a transfer risk assessment before relying on contractual safeguards. You can ask us for details of the safeguards applying to any particular transfer at support@datateru.com.
12. Security
We take appropriate technical and organisational measures to protect personal data: encryption in transit, access controls, isolation of each club's data into its own database schema, and least-privilege access for our own staff.
About phone numbers. We do not keep your phone number. When a message reaches us, the number is turned into a scrambled code that lets us recognise you without revealing it, and that code is what we store.
We hold as little directly identifying information as the service can work with. Your number is never stored in readable form, never appears on the public standings page, and is used for nothing but recognising you when you message Ace. To recognise you the next time you message, we have to be able to match your number against what we have stored, so we cannot hold nothing at all. That is why we do not claim your number is untraceable: it still counts as personal data, and the rights set out in this policy apply to it.
Your phone number is necessarily handled in full by WhatsApp and by our telephony provider in order to deliver messages to you. That is inherent to sending a WhatsApp message and is outside our control.
13. Personal data breaches
If a breach affecting personal data occurs, we will investigate immediately and take steps to contain it.
Where we act as a processor for a club, we will notify that club without undue delay so that the club can meet its own obligations. Where we are the controller, we will notify the Information Commissioner's Office within 72 hours where the breach is likely to result in a risk to people's rights, and will tell affected individuals directly where the risk is high.
14. Cookies and analytics
This website sets no cookies and runs no third-party analytics or advertising trackers. There is nothing here to consent to, which is why you have not been shown a cookie banner.
Our web server records standard access logs (IP address, user agent, requested page and timestamp), which we use to keep the site available and secure, and which are deleted after 90 days. We rely on legitimate interests for this.
If we introduce analytics in future, we will update this policy and, where the law requires consent, ask for it before anything is set on your device.
15. Your rights
Under UK GDPR, you have the right to:
- →Access: request a copy of personal data held about you.
- →Rectification: request correction of inaccurate data.
- →Erasure: request deletion of your personal data.
- →Restriction: request that we limit how data is used.
- →Portability: receive your data in a machine-readable format.
- →Object: object to processing based on legitimate interests.
- →Withdraw consent: where processing is based on consent.
Players should contact their club, which is the controller of their league data and the party able to decide the request. If you contact us instead, we will forward it and assist the club in responding.
Club administrators and website visitors can contact us directly at support@datateru.com. We will respond within one month, as required by UK GDPR. Exercising these rights is free.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to put things right first.
16. Changes to this policy
We may update this policy from time to time. Material changes will be communicated to active subscribers by email. The date at the top of this page always shows when it was last revised, and the current version is always available at this URL.
17. Contact
Datateru Ltd
Registered in England and Wales, company number 17212478
112 Margetts Road, Bedford, MK42 8DU, United Kingdom
support@datateru.com
We have not appointed a Data Protection Officer, as we are not required to do so. Privacy queries are handled by the address above.