Who is responsible for your data
[your full legal name], trading as Goalside, of [your postal address], is the controller of your personal data. Contact: [your contact email].
What we collect, and why
- Your email address and a password when you create an account. We use them to let you sign in. We never see your password in readable form. (Lawful basis: performing our contract with you.)
- Subscription details: whether you have Goalside Plus, when it renews or ends, and a record that you agreed to immediate access when you subscribed. (Contract and legal obligation.)
- Which paid sessions you open, when, and from which browser. Each browser gets a random code (kept in local storage) so we can see if one account is shared across many devices, and each paid page you open carries your email address and a reference code. We keep this for up to 12 months and use it only to stop copying and sharing of our content, and to investigate it. (Our legitimate interest in protecting our content.)
- Problem reports. If you use “Report a problem”, we keep what you write, which session it was about, the page address, your email address only if you choose to give one, a link to your account if you were signed in, and a one-way fingerprint of your network address (not the address itself) that we use to stop spam. We use reports to fix sessions and keep them for as long as they are useful. (Our legitimate interest in improving the product.)
- Payment details. You enter your card on Stripe’s page. We never receive or store your card number.
We do not use advertising or analytics trackers on Goalside, and we do not sell your data.
Cookies and similar storage
Goalside stores three items in your browser (local storage): one keeps you signed in, one is a random code that identifies your browser for the three-device limit, and one records when your subscription was last confirmed, so that saved sessions can be checked. It also keeps copies of the website’s pages in your browser’s cache so that sessions you have opened or saved work with no signal. All of this is strictly necessary for the service you asked for and for protecting our content, so we do not ask for consent. A saved copy of a paid session carries your email address and reference code like any other, and stops opening if your subscription has not been confirmed online for 30 days. Signing out, or your subscription ending when you are online, removes the saved paid sessions and the confirmation record from your device.
Who else handles your data
- Supabase stores accounts and subscription records.
- Stripe takes payments and holds billing records.
- Our website host serves the pages and may keep technical server logs.
These providers act for us under their own data protection terms. Some may process data outside the UK; where they do, they rely on approved safeguards.
How long we keep it
We keep your account while it exists. If you ask us to delete it, we delete your account and subscription records, except billing records we must keep for tax purposes (normally six years), which Stripe and we hold.
Your rights
You can ask to see, correct or delete your data, to restrict or object to how we use it, or to receive a copy. Email [your contact email]. You can also complain to the Information Commissioner’s Office at ico.org.uk.