Privacy Policy

ScrumR ("ScrumR", "we", "us") connects rugby players, coaches and staff, clubs, and agents. This policy explains what personal data we collect, why we collect it, the lawful bases on which we rely, who we share it with, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are in the EEA, the EU GDPR gives you equivalent rights.

The data controller is SCRUMR LIMITED (company number 17074337), registered at Axis 8, Axis Court, Riverside Business Park, Swansea Vale, Swansea, Wales, SA7 0AJ. For any privacy question, or to exercise your rights, contact us at privacy@scrumrapp.com.

This marketing site

If you create a player or club account, that data is collected on app.scrumrapp.com and is covered by the rest of this policy. If you join the staff or agent waiting list on www.scrumrapp.com, we also collect:

• Name, email, country, role, and optional organisation.
• A hashed version of your IP address and your user-agent string.
• UTM parameters from the link that brought you here, if present.

We use that to email you when staff or agent access opens, to send your referral link, to understand where signups come from, and to invite you in. Product updates are only sent if you tick the box on the form. We do not sell your data.

Information We Collect

We collect the following categories of personal data:

• Account details — name, email address, password (stored only in hashed form by our authentication provider), and your role (player, staff, club, or agent).
• Profile and sporting data — biography, profile and banner images, playing position(s), preferred format (15s/7s), tier, availability, current club, career history, references, height, weight, date of birth, and performance stats.
• Eligibility data — birth country, passport/nationality countries, and international eligibility. We collect this so clubs and agents can assess playing eligibility; it can reveal information about your nationality, so we treat it with particular care and only display it where you have chosen to share it.
• Location data — the town/region and approximate coordinates you provide, used to place profiles on the discovery map and to power location search.
• Media — highlight videos and photos you upload, hosted and streamed through our video provider.
• Activity and usage data — profile views, shortlists, permit and contact requests, job applications, searches, notifications, and similar interactions with the platform.
• Technical data — device, browser, and analytics events used to keep the service secure, diagnose faults, and improve it.
• Payment data — if you subscribe to a paid plan, payments are handled by our payment processor. We receive your subscription status and customer reference, but we do not store your full card details.

How and Why We Use Your Data

We use your personal data to:

• create and operate your account and profile;
• make your profile discoverable to other ScrumR users in line with your role and settings (this is the core purpose of the platform);
• connect players and staff with clubs and agents through search, shortlists, permit and contact requests, and job applications;
• send service notifications and transactional emails;
• process subscriptions and payments;
• keep the platform secure, prevent abuse, and diagnose and fix problems;
• understand usage and improve the service.

Lawful Bases for Processing

Under the UK GDPR we rely on the following lawful bases:

• Performance of a contract — to provide the account and recruitment services you sign up for.
• Consent — for optional features such as uploading video, making specific information public, and non-essential analytics. You can withdraw consent at any time.
• Legitimate interests — to secure the platform, prevent fraud and abuse, and improve our service, balanced against your rights and freedoms.
• Legal obligation — where we are required to process data to comply with the law.

Profile Visibility

ScrumR is a discovery platform: information you add to your profile is, by design, visible to other registered users appropriate to your role (for example, clubs and agents can search for and view player and staff profiles). You control what you publish and can edit or hide profile information, or delete your account, at any time. Some aggregated, non-identifying activity (such as "a club viewed your profile") may be shown to other users; the identity behind such activity is not revealed except where a user explicitly contacts or shortlists you.

Who We Share Your Data With

We do not sell your personal data. We share it only with service providers ("processors") who help us run the platform under contract and on our instructions:

• Supabase — database, authentication, and file storage;
• Mux — video hosting and streaming;
• Stripe — payment processing for paid plans;
• Resend — transactional email delivery;
• Kit — product update emails from this marketing site (opt-in only);
• PostHog (EU) — product and usage analytics;
• Vercel — application hosting and content delivery;
• MapTiler, OpenFreeMap, and Mapbox — map and location rendering;
• Upstash and Inngest — rate limiting and background processing.

We may also disclose data where required by law, to enforce our terms, or to protect the rights and safety of our users.

International Data Transfers

Some of our providers are based outside the UK and EEA, including in the United States. Where we transfer personal data internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (or Addendum to the EU Standard Contractual Clauses) and equivalent measures, so that your data continues to receive an adequate level of protection.

Data Retention

We keep your personal data for as long as your account is active and as needed to provide the service. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain certain information to comply with legal obligations, resolve disputes, or enforce our agreements. Stripe retains invoices and charges for accounting purposes after a subscription is cancelled. You can also pause your account instead of deleting it — pausing hides your profile and can be reversed by logging back in. If you join the waitlist to be emailed when you turn 18, we keep those details for up to 3 years after you become eligible.

Your Rights Under the GDPR

You have the right to:

• Access — request a copy of the personal data we hold about you;
• Rectification — ask us to correct inaccurate or incomplete data;
• Erasure — ask us to delete your personal data (the "right to be forgotten");
• Restriction — ask us to limit how we process your data;
• Portability — receive your data in a portable, machine-readable format;
• Objection — object to processing based on our legitimate interests;
• Withdraw consent — at any time, where we rely on consent;
• Not be subject to solely automated decisions that have a legal or similarly significant effect on you.

To exercise any of these rights, email privacy@scrumrapp.com. We will respond within the time limits set by law (normally one month).

Children and Young Players

ScrumR is a recruitment platform on which profiles are visible to clubs and agents. It is not intended for children under 13, and we do not knowingly create accounts for them. If you are between 13 and 18, you should only use ScrumR with the knowledge and consent of a parent or guardian, who should help you decide what information to make public. If you believe a child has provided us with personal data without appropriate consent, contact privacy@scrumrapp.com and we will take appropriate steps to address it.

Cookies and Analytics

We use a small number of cookies and similar technologies that are necessary to keep you signed in and to keep the service secure, together with privacy-conscious analytics to understand how the platform is used. Non-essential analytics rely on your consent where required. On this marketing site we also use a referral cookie (sc_ref) and UTM cookies.

Data Security

We use technical and organisational measures — including encryption in transit, access controls, and row-level security in our database — to protect your personal data. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.

Complaints

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with your local supervisory authority if you are in the EEA.

Changes to This Policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the platform.

Contact

For any privacy-related question, or to exercise your rights, contact us at privacy@scrumrapp.com.