Privacy Policy

Last updated: 17 August 2026

This Privacy Policy explains how Arivette ("Arivette", "we", "us") collects, uses and protects personal data when you use our platform for managing and running sports clubs (the "Service"). We are committed to protecting your privacy and to handling personal data in line with the EU General Data Protection Regulation (GDPR) and applicable local law.

1. Who is responsible for your data

Arivette provides the Service to sports clubs. Each club acts as the data controller for the personal data of its members, and Arivette acts as a processor on the club's behalf. Where Arivette determines the purposes of processing (for example, operating the platform and its accounts), Arivette acts as controller. Where a club operates under more than one legal entity, each entity is the controller for the data it issues and collects. You can contact us at any time at admin@arivette.cat.

2. Information we collect

Account data: name, email address, password (stored only as a secure hash) and, optionally, phone number and profile photo.
Club data: the sporting and organisational information you or your club add, such as categories, teams, events, attendance, performance, surveys, media and messages.
Data about minors: where a club manages under-age athletes, limited data is processed under the responsibility of the club and the athlete's legal guardian.
Payment data: records of what is charged, owed and paid. Card and bank details are entered directly with the payment provider and are never stored by Arivette.
Technical data: basic logs needed for security, auditing and to keep the Service running, including IP address and approximate timestamps of sensitive actions.

3. How we use your data

To provide and maintain the Service and your account.
To enable club communication (news, notifications, messages) and day-to-day management.
To keep the Service secure and to maintain the audit trail of sensitive actions.
To comply with our legal obligations.

We do not use personal data to train machine-learning models, to build advertising profiles, or for any purpose unrelated to running your club.

4. Legal bases

We process personal data on the basis of the performance of a contract (providing the Service), our legitimate interests (securing and improving the Service), your consent (for example, image use, push notifications and connecting a third-party calendar), and compliance with legal obligations. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Google user data

Two features of the Service can involve your Google Account, and both are optional. If you never use them, Arivette holds no Google data about you at all.

Signing in with Google. If you choose to sign in with Google, we receive your Google account identifier, your email address, whether Google states that the address is verified, and your name. We use them only to identify you and to link the sign-in to your existing Arivette account. We do not receive your Google password.

Connecting Google Calendar. If you choose to connect Google Calendar, we ask only for permission limited to calendars created by this application. Specifically:

What we access: only the calendars Arivette itself creates in your account, one per club, named after that club. We cannot read, modify or delete any other calendar or event in your Google Account, and we do not request that ability.
What we do with it: we write your club's events into that calendar and keep them up to date. Nothing is read back from your Google Account into Arivette.
What we store: the identifier of the calendar we created, your Google account identifier, and an authorisation token that lets us keep writing. The token is encrypted at rest, is never shown in the Service, and is never included in logs.
What we never do: we do not sell Google user data, do not share it with third parties, do not use it for advertising, and do not use it to train machine-learning models.
How to stop it: disconnect from within Arivette, which revokes the authorisation with Google and removes the calendars we created. You can also revoke access at any time from your Google Account's security settings.

Arivette's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Connecting Google Calendar is not offered to under-age athletes. It is available to adults and to the legal guardians who manage a family's scheduling. Everyone else can use the calendar subscription link instead, which requires handing over no account at all.

6. Sharing and service providers

We do not sell personal data. Data belonging to one club is isolated from other clubs. We share data only with the providers needed to run the Service, under data-processing agreements:

Hosting — servers located in the European Union, where your data is stored.
Resend — delivery of transactional email (invitations, notices, receipts).
Stripe and SumUp — payment processing. Each club connects its own provider account and charges in its own name; Arivette never holds your money and never stores card or bank credentials.
Google — only where you have chosen to sign in with Google or to connect Google Calendar, as described in section 5.
Push delivery services — if you enable notifications, your browser or device registers with its own push service (operated by the maker of your browser or operating system) and we send notices through it. It carries the message, not your club data.

We may also disclose data where required by law. Analytics for the public website are handled by our own self-hosted software; we do not use advertising networks or third-party tracking.

7. International transfers

Your data is stored in the European Union. Some providers listed above may process limited data outside the European Economic Area; where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses or an equivalent safeguard.

8. Data retention

We keep personal data for as long as your account or your club's account is active, and thereafter only as long as needed for legal, accounting or security purposes. Audit records are kept on an append-only basis according to the club's retention policy. When you disconnect a third-party integration, the stored authorisation is deleted at once.

9. Children and minors

The Service is used by clubs that may manage under-age athletes. Sensitive actions relating to a minor are approved by the minor's legal guardian, and data about minors is subject to additional access restrictions and auditing. Where a club requires it, a purpose is only granted once every holder of parental authority has agreed, and a single refusal is decisive. Features that involve handing over a personal third-party account are not offered to under-age athletes.

10. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict and object to the processing of your personal data, and to data portability. To exercise these rights, contact your club or us at admin@arivette.cat. You also have the right to lodge a complaint with your local data protection authority.

You can delete your own account at any time from your profile, without contacting anyone. What is deleted and what your club keeps anonymised is explained in Delete your Arivette account.

11. Security

We use encryption in transit, access controls based on roles and club isolation, and auditing of sensitive actions. Passwords are stored only as hashes, and credentials belonging to third parties — such as a club's payment keys or a calendar authorisation — are encrypted at rest and never returned by the Service. Removing someone's access takes effect in the database, not only in the interface. No system is completely secure, but we take reasonable measures to protect your data.

12. Cookies and local storage

We use only the storage strictly necessary to keep you signed in and to remember basic preferences (such as language and view mode). We do not use advertising or third-party tracking cookies.

13. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected on this page with an updated date.

14. Contact

For any question about this policy or your personal data, contact us at admin@arivette.cat.