Who and what
The club, school or federation that adds its staff or players to Atlas Chalk is the controller. Abundance Atlas, Inc. is the processor.
The club accepts this agreement by using Atlas Chalk for its staff or players. There is no signature flow. It covers the processing of personal data under the GDPR, the UK GDPR and the Swiss FADP.
Subject and duration
We run Atlas Chalk for the club, for as long as the club has a program, and for the delete window below.
Data and people
- Coaches and staff: name, email address, sign-in and program role.
- Players and game-day analysts, 13 or older, in high school and college programs only: first name and last initial, sign-in, the MFA factor, assignments and study activity.
- Plays, playbooks, game entries and tags.
We do not ask for special category data.
Our duties
- We process personal data only on the club's documented instructions. Using the product is the instruction.
- Everyone with access to the data is bound to keep it confidential.
- We keep the data secure, as the annex says.
- We help with data subject requests. The export and the delete controls are in Settings.
- We tell the club of a personal data breach without undue delay.
- At the end, we delete the club's data within 30 days. Encrypted backups age out in 30 days.
- We give the club the information needed to show compliance, and allow audits, written questions first.
Subprocessors
The club gives general authorisation. We tell program owners by email, and update this page and its date, at least 30 days before a new subprocessor starts. The club can object. The privacy policy says what each one receives.
- Supabase: Database and sign-in. Country: United States. Safeguard: Not confirmed yet.
- Vercel: Hosting, and counting visits to our public pages. Country: United States. Safeguard: Not confirmed yet.
- PostHog: Product analytics. It receives the pages you open, the controls you click, your account identifier, your browser, device type and country. Never your email address, your plays, or anything from the player portal or the tagger. Country: United States. Safeguard: Not confirmed yet.
- Stripe: Payments and subscriptions. Country: Not confirmed yet. Safeguard: Not confirmed yet.
- Google sign-in: Continue with Google. It tells us your name, email address and picture. Country: Not confirmed yet. Safeguard: Not confirmed yet.
- Resend: Delivers account email, such as the link that confirms your address, and holds the waitlist. It receives your email address and the message. Country: United States. Safeguard: Not confirmed yet.
- TypeSafe: Suggests which standard formation or concept a staff's own term means. It receives only the term you typed, your program's level and our standard football names. Never your plays, your account or anything about players. Its stated policy is not to train on what it receives. Country: Not confirmed yet. Safeguard: Not confirmed yet.
- GitHub: Keeps an encrypted weekly copy of our database for 30 days, so we can recover if our database provider fails. Only we hold the key, so GitHub can't read it. Country: United States. Safeguard: Not confirmed yet.
- Meta: Measures our ads. It runs only on our public pages, only if you accept (or, outside the EU, EEA, UK and Switzerland, until you refuse). It receives the page you open, your browser, your IP address and a sign-up event. Never your email address, your name or anything from the coach app, player portal or tagger. Country: Not confirmed yet. Safeguard: Not confirmed yet.
Data that leaves your country
Stored data is in the United States. Transfers rely on each subprocessor's safeguard as the list above states. Where we do not know it yet, the list says “Not confirmed yet”.
Annex: technical and organisational measures
- Row-level security: every program table has row-level security, and a member reads only their programs' rows.
- MFA for players and analysts: player and analyst access needs a second factor (an authenticator app), enforced in row-level security.
- Encryption in transit: HTTPS only, with HSTS.
- Encrypted off-site backup: weekly, encrypted with age, kept 30 days.