Your players' data, handled properly.
We built AutomateSport to be GDPR-ready from day one — not bolted on as an afterthought. Here's exactly how we handle data.
UK / EU data residency
All data is stored on UK and EU infrastructure. It never leaves the region. Relevant for clubs subject to UK GDPR.
Encrypted in transit and at rest
All traffic uses TLS 1.2+, and data at rest is encrypted with AES-256. Particularly sensitive fields — such as a club's saved bank details for bank-transfer subs — are additionally encrypted at the application layer with a key held outside the database. Standard, audited implementations — no bespoke crypto.
Row-level isolation
Every row in the database carries a club ID. Every read is filtered server-side via Supabase RLS — one club cannot access another's data.
GDPR and PECR ready
Consent is captured at player onboarding. Every outbound message carries a STOP opt-out. Players can request erasure — we anonymise name and phone while keeping payment totals coherent.
We never touch your money
Subs go directly from player to your club — by card via Stripe Connect, or in cash or by bank transfer arranged directly between them. AutomateSport is never in the payment flow. Stripe's PCI DSS compliance covers card handling.
Player rights built in
Players can opt out of messages at any time with a STOP reply. Managers can action data deletion requests in one tap. Opt-out status is visible on every player profile.
We never touch your money.
Subs go directly from player to your club — by card via Stripe Connect, or in cash or by bank transfer arranged directly between them. AutomateSport is never in the payment flow.
What GDPR-ready actually means here.
We're not a large organisation with a dedicated DPO. But we've built every feature with UK GDPR and PECR in mind:
- Players give explicit consent before receiving messages — captured at onboarding via invite link or manager entry.
- Every outbound WhatsApp message carries a STOP / opt-out link. Opt-outs are honoured immediately and visible to the manager.
- The right to erasure is a first-class feature — not a support ticket. Managers can soft-delete a player, which anonymises their name and phone number while keeping payment totals coherent for season records.
- We don't sell or share contact details. Player data is used solely to run the service.
- Data is stored in UK/EU infrastructure and is not transferred to third countries.
Data-related enquiries.
For data subject access requests, erasure requests, or any other privacy-related question, contact us at hello@automatesport.com. We'll respond within 30 days as required by UK GDPR.
AutomateSport Ltd is the data controller for information processed through this platform. Registered in England & Wales, Company No. 17254482.