1. Who we are
Sporting Scouter is the trading name of Daniel Sousa, self-employed, taxpayer number PT229306535, Rua das Escolas 148, 4520-322 Fornos, Santa Maria da Feira, Aveiro, Portugal. We are the controller of the data described in this policy, except in section 6, where we process data on behalf of organisers. Privacy contact: support@sportingscouter.com. We reply within one month. People in the United Kingdom may write to the same address.
2. Summary
| If you are… | Data we process | Why | How long |
|---|---|---|---|
| Someone who commented on a public Facebook or Instagram post about an event | Comment text, date, post and link to the original. We do not keep your name, profile or photo | Reports for organisers on what was said about the event | 5 years from the comment, or less if you object |
| An athlete reviewing an event on our site | Email, bib number, review | Verify and publish the review | See section 4 |
| An organiser customer | Account and company data, billing | Provide the service, charge, invoice | See section 5 |
| A site visitor | Search terms, technical logs, statistics | Search, security, statistics | See section 5 |
3. Public comments on social networks
What we do. Through a data collection provider, we collect public comments made on posts about sports events on Facebook and Instagram. We classify them by theme and phase (before, during and after the event) and use artificial intelligence to write a summary of pain points, suggestions and praise. We sell that report to the event’s organiser. Where the data comes from. Public posts on Facebook and Instagram. What we keep. The text, the date, the post, the link to the original and a technical identifier of the comment. We do not keep the commenter’s name, username, profile or photo. What the organiser sees. The text and date of comments on posts linked to their event, without the commenter’s name, and a link to the original on the social network, where the comment is public and may show your name. Legal basis. Our and the organisers’ legitimate interest in knowing public opinion about their events in order to improve them (Art. 6(1)(f) GDPR). We weighed this interest against your rights and adopted safeguards: we do not keep the author, we limit retention and we remove comments immediately on request. You may ask us for a summary of that assessment. Artificial intelligence. The analysis is done by artificial intelligence models from the providers in section 7. We do not take decisions about people based on these comments. Health data. If a comment mentions health (for example, an injury), we process it only because its author made it public (Art. 9(2)(e) GDPR). Retention. 5 years from the date of the comment.
Your right to object: immediate removal
You may object at any time. Write to support@sportingscouter.com with the link to your comment (or to the post and the text). We remove it immediately from our systems and reports and tell the organisers who saw it. You do not need to give a reason.
4. Athlete reviews on our site
What data. Email and bib number (required), text, title, ratings and automatic translations of the review. The title and text are translated by an artificial intelligence service (OpenAI, section 7), without your name or email; if you write names or your bib number in the text, they go with it. Why. To confirm your email, check whether you took part (by matching the bib number and email against the organiser’s list, where there is one), publish the review, let the organiser reply and contact you if needed. What the organiser sees. The review, without your email or bib number. Legal basis. Legitimate interest in publishing participants’ reviews (Art. 6(1)(f)). Retention. Reviews whose email is not confirmed: not published, and deleted at your request. Confirmed reviews: we keep the email and bib number for as long as the review exists, to prove where it came from and to contact you; we delete them at your request and keep the review without them.
5. Organisers, visitors and other contacts
| Processing | Data | Legal basis | Retention |
|---|---|---|---|
| Business portal account | Email, credentials, name, country, city, language, image; company data (name, type, address, phone, website, social links); sign-up source | Contract; sign-up source: legitimate interest | While the account is active; deleted 24 months after the last access or purchase, with prior notice |
| Acceptance of the terms | Version accepted, date, language | Legitimate interest (proof of contract) | Up to 5 years after the contract ends |
| Payments and invoices | Name, email, billing address and tax number (collected by Stripe), invoices | Contract and legal obligation | Invoices: the following 10 calendar years (Portuguese VAT Code, Art. 52) |
| Event search | The term you type, stored without IP or identifier; we review it and delete anything with personal data | Legitimate interest | No fixed period, with periodic review |
| Technical logs | IP, approximate location derived from the IP, browser, technical request data and search term | Legitimate interest in security and operation | Up to 7 days |
| Aggregate visit counting on the site (Cloudflare Web Analytics) | Pages viewed, country, device and browser type, without cookies and without identifying visitors | Legitimate interest (point (f)) | Aggregate data |
| Site statistics | Pages viewed, visit source, clicks; in business accounts, only an internal identifier | Legitimate interest | 24 months |
| Public event catalogue (internal tool) | Public event information and, at most, organisers’ public contact details, collected from public pages | Legitimate interest in keeping a catalogue of public events (point (f)) | While the event is in the catalogue; contact details deleted on request |
| Business contacts | Organisation’s work email, messages exchanged, opt-outs | Legitimate interest | Opt-outs: we keep the email and date so we never contact you again; contacts with no reply are deleted 12 months after the last contact |
| Cookies. We use the cookies needed to keep you signed in. You can manage your choices under “Cookie preferences” in the site footer. |
6. When we process data on behalf of an organiser (Finisher Feedback)
When an organiser gives us their participant list so that we send invitations, the organiser is the controller and we process the data on their behalf under a data processing agreement. We keep the name, email and bib number until the organiser asks us to delete them or the contract with them ends. To exercise your rights, contact the organiser; if you write to us, we forward your request.
7. Who we share data with and transfers
The providers that process data on our behalf, what they do, where they are and the safeguard used are on the Subprocessors page, which forms part of this policy:
Last change to this list: 2026-10-21
| Entity and purpose | Data processed | Products | Location and safeguard | Last change |
|---|---|---|---|---|
| Cloudflare, Inc. Network, CDN and firewall; bot protection (Turnstile); app hosting; database, files and queues; AI classification of comments (Workers AI); aggregate cookieless visit counting (Web Analytics) |
IP address and technical data of all visitors; public comments (without author); report and dispute files | All productsSocial DebriefFinisher Feedback | Global network EU-U.S. Data Privacy Framework |
2026-10-21 |
| DigitalOcean, LLC Application server (API) |
Data handled by the API | All productsFinisher Feedback | Frankfurt (EU) Data hosted in the EU; EU-U.S. Data Privacy Framework |
2026-10-21 |
| Supabase, Inc. Database and sign-in |
Accounts, companies, events, reviews, participants, invitations, consents | All productsFinisher Feedback | Frankfurt (EU) Data hosted in the EU |
2026-10-21 |
| Resend (Plus Five Five, Inc.) Sending emails (invitations, confirmations, notices), through Amazon SES |
Recipient email and name, email content, delivery events | Finisher FeedbackReviewsAccounts | Ireland (EU) EU-U.S. Data Privacy Framework |
2026-10-21 |
| OpenAI Ireland Ltd. Translation of reviews, responses and the analysis; notes when an organiser resolves an alert; help preparing business contacts |
Title and text of reviews and responses (without the author's name or email); public business contacts | ReviewsFinisher FeedbackBusiness contacts | EU / US Standard contractual clauses |
2026-10-21 |
| Bright Data Ltd. Collection of public comments and public event and organisation pages |
Public web content | Social DebriefBusiness contactsEvent catalogue | Israel European Commission adequacy decision |
2026-10-21 |
| Stripe Payments |
Buyer email and billing data; card data (Stripe only) | Accounts | US / EU EU-U.S. Data Privacy Framework |
2026-10-21 |
| PostHog, Inc. Usage statistics and errors, cookieless |
Pages viewed, visit source, clicks; in business, only an internal identifier | All products | EU EU-U.S. Data Privacy Framework, for anything leaving the EU |
2026-10-21 |
| Google LLC Company email; Google sign-in (if you choose it); fonts in the reviews widget |
Emails exchanged with us; Google account email and name; IP address of people who view the widget | All productsAccountsReviews widget | EU / US EU-U.S. Data Privacy Framework |
2026-10-21 |
| Termly, Inc. Cookie banner (until replaced) |
IP address, browser data, cookie choice | All products | US EU-U.S. Data Privacy Framework |
2026-10-21 |
| Anthropic Ireland, Limited AI reading of public event pages for the event catalogue |
Public event information; at most, organisers' public contact details | Event catalogue | EU / US Standard contractual clauses |
2026-10-21 |
| Anysphere, Inc. (Cursor) Automated engineering tool that maintains the event catalogue |
Public event information; at most, organisers' public contact details | Event catalogue | US Standard contractual clauses |
2026-10-21 |
| GitHub, Inc. Code hosting and change records for the event catalogue |
Public event information; at most, organisers' public contact details | Event catalogue | US EU-U.S. Data Privacy Framework |
2026-10-21 |
Organisers who buy the Social Debrief receive the comments described in section 3. The Portuguese Tax Authority receives invoice data.
8. Your rights
You may ask for access, rectification, erasure, restriction and portability, and you may object to processing based on legitimate interest (Art. 21 GDPR); objections to comments are handled immediately (section 3). Write to support@sportingscouter.com. We reply within one month, extendable by two more in complex cases, and we tell you if so. You may complain to the Portuguese data protection authority, CNPD (www.cnpd.pt), or to the authority where you live or work; in the United Kingdom, to the Information Commissioner’s Office (ico.org.uk). We do not take automated decisions with legal or similarly significant effects on you.
9. Changes
If we change this policy, we update the version and date at the top and, if the change is material, we email customers.