Privacy Policy

1. Who is responsible

For your owner or staff account, onebase is the controller. For data about members, children and parents, the club is the controller and onebase is the processor, acting on the club's instructions. Parents should contact their club first about their child's data.

2. What we collect

Account data: name, email, phone, role. Club data: name, sport, locations, schedule, packages and prices, public page content.

Member data, entered by the club or by the parent at registration: child's name, date of birth, gender, age group; parent's name and phone; the club terms accepted, with version and date; health answers, allergies and medication; emergency contacts.

Payment data: invoices, payments and their method, the club's verified bank account and identity documents for payout verification. Card and account numbers are handled by the licensed payment partner, not stored by onebase.

Usage data: which screens are used and when, device type, and aggregate visit counts on club pages. No third-party tracking pixels are used on club pages or in the parent app.

3. Google sign-in

Club owners, staff and members sign in with Google. When you do, Google shares with onebase only your name, email address, profile picture and your Google account ID, under the scopes openid, email and profile. onebase does not receive your Google password and does not access your Gmail, Drive, contacts, calendar or any other Google data.

We use this information only to create and identify your account, sign you in, and show your name and email to the people in your club who need to see them. Your Google account ID is how we recognise you; your email is never merged into someone else's account.

onebase's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell it, use it for advertising, or share it except as described in this policy. You can remove onebase's access at any time at myaccount.google.com/permissions; to delete your onebase account and its data, write to us.

4. Children's health data

Health answers and emergency contacts are the most sensitive data we hold. They are shown only to roles the club permits, never placed in a URL, a notification, a page title, a public page or a default export, and every access is logged.

So that a coach can act at the pitch without signal, medical alerts for the sessions a coach runs are cached on that coach's device and removed when their access ends.

onebase staff never browse health data. Support access, where strictly needed, is narrow, logged and time-limited.

5. How we use data

To run the club's operations: rosters, age groups, schedules, attendance, invoices and reminders. To let parents see and pay what they owe. To publish the club page the club chooses to publish. To operate, secure and improve onebase, and to bill clubs for their subscription.

6. Who we share it with

Processors we need to run the service: hosting, email and push notification providers, and the licensed payment partner. Each is bound by contract to use data only for that purpose.

We never sell personal data and never share member data between clubs. A parent with children at several clubs sees each child's data only in that club's context.

7. Retention

Club data is kept while the club's account is active and for a limited period afterwards to allow recovery, then deleted. Archived members are kept by the club until the club deletes them. Payment records are kept as long as tax law requires.

8. Your rights

You can access, correct and delete your data, and withdraw any consent separately, including photo consent, at any time. Parents do this in the app or by asking their club; clubs and staff do it in the backoffice or by writing to us. Withdrawing photo consent never affects membership.

9. Security

Data is encrypted in transit and at rest. Access is role-based and logged. The internal console used by onebase staff runs on separate infrastructure and separate authentication, unreachable from a club or parent session.

10. Children

Children do not have their own accounts. Parents or guardians act on their behalf. Adult members may act as their own guardian.

11. Cookies

Public club pages use no tracking cookies. The backoffice and parent web use session cookies needed to keep you signed in, and remember your language choice.

On the onebase.id website we use Google Analytics to count visits and see which pages are used, and Hotjar to see how visitors move through a page (heatmaps and session recordings). Neither tool runs on club pages. What you type into our forms, such as your name, phone number and email, is masked and never appears in a recording. Both tools set their own cookies; you can block them in your browser settings without losing any part of the site.

12. Changes

We may update this policy. Material changes are announced in the backoffice and the parent app before they take effect.

13. Contact

Privacy questions and requests: halo@menotto.club, or the address on the contact page.