This notice explains what personal data Match Point Leagues holds, why, who else handles it, and what you can ask us to do with it. It’s written for four groups of people: organisers who run leagues, players whose names and results appear in them, parents and guardians who follow a child’s results, and anyone visiting the site.
Who we are
Match Point Leagues is run by Craig Harvie, a sole trader based in Scotland, who is the data controller for the personal data described here.
Contact: matchpointleagues@gmail.com. A real person reads every message.
What we hold, and why
Organiser accounts. When you sign up we hold your name, email address and profile picture, and which club you belong to and your role in it. We need these to run your account and your club’s dashboard (lawful basis: contract).
Player records. Organisers add players to leagues. A player record holds a first and last name, and sometimes an email address, plus the matches, scores and results that follow from playing. Organisers can also record the surface and, in junior leagues, the ball colour for each match, and mark a player as a junior. An organiser, the player or a parent can add an LTA number, and an organiser or parent can add a year of birth, which works out the player’s LTA age group. For a junior, a parent can ask for a nickname to show on public pages, which an organiser has to approve. Players aren’t asked for consent before they’re added. We rely on the organiser’s and the club’s legitimate interest in running a league, balanced against the player’s interests, which is why the protections below exist (lawful basis: legitimate interests).
Player app accounts. A club can invite a player, or a parent or guardian, to follow results in the player app. When you sign in we hold your name, email address and sign-in details, which players you’re linked to, and, for a parent or guardian, when you confirmed you’re the child’s parent or guardian. You can choose a picture for a player from a set of icons; we never store photos. Results you send from the app wait for an organiser to approve them (lawful basis: contract for your account, legitimate interests for the results).
Awards and coach feedback. A club’s organisers can give a player an award, with an optional message, and write feedback about them. Feedback can be linked to a match and tagged with what it’s about, such as technique or mindset. For each piece of feedback, an organiser chooses whether the player, and a junior’s parents or guardians, see it in the player app, or only the club’s organisers do. We hold the text, who wrote it and when. Awards and feedback never appear on public pages (lawful basis: legitimate interests).
Award emails. When a coach gives a junior an award, we email the parents and guardians who follow them in the player app, unless the coach chooses not to. The email has the child’s first name, the award and the coach’s message. Every email has an unsubscribe link, and you can turn them off at any time in the app’s notification settings. We keep a record of that choice and a link code for unsubscribing (lawful basis: legitimate interests).
Class registers. A club’s coaches can run weekly classes and take a register of who came to each session. We hold the session dates and who was there. The club’s organisers, the player, and a junior’s parents or guardians in the player app can see the player’s attendance. Registers never appear on public pages (lawful basis: legitimate interests).
Score submissions. A player can submit a score through a club’s score link. We hold the proposed score and date, and any name the person submitting types in. An organiser has to approve a submission before it counts, and it is deleted once approved or rejected (lawful basis: legitimate interests).
Sign-ups. On a club’s sign-up link, a player enters their name and, optionally, an email address. This is held until an organiser approves or rejects it. Approval turns it into a player record; rejection deletes it. On a box league’s sign-up link, a returning player picks their name, and a new player can also say roughly what level they play at and leave a note for the organiser. Those sign-ups are held until the organiser starts the next season, removes them or cancels the sign-ups, and are then deleted; a new player’s name and email become a player record when the season starts. On a club’s join link, a player or a parent signs in and enters their name, or their children’s names, and a parent confirms they’re the parent or guardian. This creates new player records for the club; it never takes over an existing one (lawful basis: legitimate interests).
Entry fees. If a club charges an entry fee to sign up, Stripe takes the payment on the club’s behalf. We hold the name and email on the sign-up, the amount, whether it was paid or refunded, and Stripe’s payment identifiers. We never see card numbers (lawful basis: contract).
Plus subscriptions. If a club subscribes to Plus, Stripe collects the payment details, the billing address and any VAT number, which it uses to work out tax. We never see or store card numbers. We hold the Stripe customer and subscription identifiers and the subscription’s status, so we know whether the club is on Plus (lawful basis: contract).
Keeping the site working. Error reports and a sample of page performance data go to Sentry, with email addresses, private links and account identifiers removed before they leave the browser or server. Visit counts, and counts of actions such as scores recorded or seasons created, come from Vercel Analytics, which is cookieless and aggregate, and never records people’s names or email addresses. To count an action, our server passes Vercel the visitor’s IP address, browser type and the page they came from, so it can tell visits apart (lawful basis: legitimate interests).
Messages you send us. If you email us, or report an issue from the dashboard, we hold what you send, including your email address (lawful basis: legitimate interests).
What’s public
League, season and club pages are public. Anyone can see them without an account, and search engines index them. They show players’ names, match results and standings. That’s what makes the leagues work: players can see the table without logging in.
We ask AI training crawlers not to read pages that show players’ names. AI search tools can still read and link to them, as search engines do.
Some protections apply:
- Player profile pages are not listed in search engines. Anyone with the link can still open them.
- Children’s names. When an organiser marks a league as containing children’s names, public pages show a made-up name, such as “Swift Falcon”, instead of the real one. Real names stay visible to the club’s organisers. In the player app, other players in that league are shown by first name and last initial, or their approved nickname.
- Email addresses are never public. Only the club’s organisers see them.
- Ball colours are never public. A junior’s ball colour shows their stage of development, so only the club’s organisers and the player’s linked accounts see it.
- Year of birth and LTA number are never public. Only the club’s organisers and the player’s linked accounts see them, along with the age group worked out from the year of birth.
Children
Junior leagues are a supported use, so the site can hold children’s names and results. We only know a player’s age if an organiser or parent adds their year of birth, which is optional; we never ask for a full date of birth. Organisers who enter a child must have permission from a parent, guardian or the club, and should turn on the children’s names setting so public pages use made-up names. A parent can ask for a nickname to be shown instead of the made-up name. An organiser approves it first, and a nickname containing the child’s real first or last name is refused. Parents and guardians can ask us to remove a child’s name at any time (see “Your rights”).
A parent or guardian can follow a child in the player app in two ways: through an invite link an organiser creates for that child, which works once and expires after 14 days, or through the club’s join link, where they add their own children. Either way they confirm they’re the child’s parent or guardian.
Children under 13 shouldn’t sign in themselves; a parent or guardian follows them instead. An organiser can invite a junior to their own sign-in only once a year of birth is recorded that shows they’re at least 13.
In the app, a parent, guardian or junior sees the junior’s matches, results, club rankings, surface and ball colour, awards and any feedback the club has shared. It also shows the names of the other players in the junior’s league tables and matches at the same club. In a league marked as containing children’s names, those players are shown by first name and last initial, or their approved nickname, instead of their full name. Organisers should write feedback about a child as they would expect a parent to read it, even when they keep it to organisers, and shouldn’t use it for health or safeguarding information.
Who else handles the data
We use these services to run the site. Each one handles data only to provide its service to us.
| Service | What for | Where |
|---|---|---|
| Vercel | Hosting, server logs, visit counts, feature switches, bot checks on sign-up and score forms | Servers in Frankfurt; Vercel is a US company |
| Neon | The database | Frankfurt |
| Clerk | Sign-in for organisers, players and parents; accounts and club membership | United States |
| Cloudflare | Protects Clerk's sign-in from bots and abuse | Global |
| Stripe (Stripe Payments UK Ltd) | Plus payments, entry fees and billing emails | UK, EU and US |
| Resend | Sends award emails to parents | Ireland; Resend is a US company |
| Sentry | Error and performance monitoring | United States |
| Google (Gmail) | Our support inbox | Global |
Where data leaves the UK or EU, it’s covered by appropriate safeguards, such as the UK International Data Transfer Addendum or the standard contractual clauses in each provider’s data processing terms.
We don’t sell personal data, and we don’t use it for advertising.
How long we keep it
We keep data for as long as a league, club or account exists, and we don’t delete older records automatically yet. What we do today:
- Organisers can delete matches, seasons, leagues and players with no match history.
- A player with match history can be erased: their name is replaced with “Former player”, and their email, nickname, year of birth and LTA number are deleted, along with the copies of their name and email on sign-ups and entry fee payments. Their results stay, so other players’ tables don’t change.
- Score submissions, results sent from the player app and sign-ups are deleted once an organiser deals with them. Box league sign-ups are deleted when the next season starts or the sign-ups are cancelled.
- Player app invite links stop working after 14 days, or once used.
- Awards and coach feedback are kept until an organiser removes them, or the player is erased, which deletes them.
- Class registers are kept until an organiser deletes the class, or the player is erased, which deletes their attendance.
- If you close your organiser or player app account, email us and we’ll delete your details.
Your rights
Under UK data protection law you can ask to see the data we hold about you, have it corrected or erased, get a copy to take elsewhere, object to how we use it, or restrict its use. Email matchpointleagues@gmail.com. We’ll reply within a month. If you’re a player, you can also ask your club’s organiser, who can correct or erase your record straight away.
If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
Cookies
We only use cookies the site needs in order to work, so we don’t ask for consent.
| Cookie | What for | How long |
|---|---|---|
__client_uat (and a copy with a suffix) | Set by Clerk, our sign-in provider, for every visitor. Records whether you’re signed in. | 1 year |
__client | Set by Clerk on clerk.matchpointleagues.com. Holds your sign-in session. | Up to 1 year |
__session | Set by Clerk once you sign in. Proves who you are to the dashboard. | About 1 minute, renewed while you’re active |
__cf_bm, _cfuvid | Set by Cloudflare, which Clerk uses, on clerk.matchpointleagues.com. Protects sign-in from bots and abuse. | 30 minutes, and the browser session |
theme | Remembers light or dark mode in the dashboard | 1 year |
sidebar-collapsed | Remembers whether the dashboard sidebar is collapsed | 1 year |
mpl_home | Set when a player or parent signs in, so the site links to the player app instead of the dashboard | 1 year |
mpl_me_player | Remembers which child or player you last looked at in the player app | 1 year |
mpl_hub_preview | Set when an organiser previews a player's view of the player app | 1 hour |
On a score link, your browser also remembers which player you picked, so you don’t have to pick again next time. It stays in your browser until you clear it.
Vercel Analytics counts visits without cookies and doesn’t identify you. When you submit a sign-up or score form, Vercel’s bot check reads signals from your browser to tell people from automated abuse.
Changes
If this notice changes in a way that matters, we’ll update the date at the top and say so on the dashboard.