Privacy Policy

Gaffy is a product of Studio 31, obrt za računalno programiranje, vl. Lukas Bašić ("we", "us", "our"), Ulica Vladimira Nazora 22, 10450 Jastrebarsko, Croatia, OIB: 95074033310. You can reach us at info@studio31.hr for any privacy question.

For your account and billing data, we act as the data controller under the GDPR. For the personal data of the players you manage in Gaffy, you (the agent) are generally the controller and we act as your processor - we hold and process it only to provide the Service to you.

Account data: your name, email address, profile photo and the identifier from your chosen sign-in provider (Google or Apple).

Billing data: handled by our payment processor, Stripe - your billing name, address, VAT ID if provided, and subscription status. We don't see or store your card details.

Content you add: player profiles (including date of birth, nationality and photo where you add them), contracts, commissions, costs, calendar events, notes, licences, documents and highlight videos you upload.

Football reference data: when you search for a club, league or player, we query a third-party sports database and cache the result (names, logos, and public career details) to make future searches faster. This is public information about clubs and footballers generally, not about you.

Device and technical data: push-notification tokens, device platform, your timezone (used to schedule reminders in local time), IP address and basic request logs needed to run and secure the Service.

Support and correspondence: anything you send us when you contact support.

To provide the Service - store Your Content, run reminders, keep you signed in, and let you manage your players, contracts and schedule.

To take payment, calculate applicable VAT, and issue invoices, using Stripe and Croatian fiscalisation requirements where they apply.

To secure the platform, diagnose faults, and understand product usage through first-party analytics we run on our own servers - we don't send usage data to third-party analytics or advertising services.

We do not sell personal data, and we do not use Your Content to build advertising profiles.

We process account and billing data to perform our contract with you, to comply with tax and accounting obligations, and based on our legitimate interest in operating a secure, reliable service.

Where you've asked us to, we rely on your consent - for example, for optional notification categories you can turn off in the app.

Stripe - payment processing, VAT calculation and invoicing.

Google Firebase - verifying Google and Apple sign-in, and delivering push notifications.

Apple - Sign in with Apple.

Cloudflare - file storage (R2) for photos and documents, and video hosting (Stream) for highlight reels.

TheSportsDB - the third-party football database we query for club, league and player search results.

We may also share data where required by law, or with a successor entity if Gaffy is acquired or merged, always subject to the protections in this policy.

We do not sell your data or share it with clubs, federations or other agents.

Your Content is kept for as long as your account is active.

Closing your account from within the app permanently and immediately deletes your players, contracts, documents, notes and other content, along with any files stored for you. This is a hard delete, not a temporary hold - make sure you've kept anything you need first.

Billing records are kept for as long as Croatian tax and accounting law requires, even after account closure.

Server logs are kept for 10 days and notification history for 30 days, after which they are deleted automatically.

Player records you create are personal data about people who are not Gaffy users. You're responsible for having a lawful basis to hold that information and for meeting any transparency obligations you owe them; we process it strictly on your instructions, as your processor.

Under the GDPR you can ask us to access, correct or delete your personal data, restrict or object to certain processing, and request a portable copy of what you provided. Deleting your account already deletes your content immediately; for anything else, contact us at info@studio31.hr and we'll respond within the timeframe the law requires.

You also have the right to lodge a complaint with your local data protection authority - in Croatia, the Agencija za zaštitu osobnih podataka (AZOP).

Some of our subprocessors (including Stripe, Google/Firebase and Cloudflare) may process data outside the European Economic Area. Where that happens, we rely on the safeguards they provide, such as the EU Standard Contractual Clauses.

The website uses only strictly necessary cookies - to keep you signed in and secure your session. These can't be switched off, and we don't use third-party analytics, advertising or marketing cookies on the site.

Fonts are self-hosted, so loading the site does not send your IP address to a third-party font provider.

The mobile app does not use cookies. It stores your session securely on your device (Keychain on iOS, Keystore on Android) and caches images locally so they load faster.

We don't store passwords - sign-in is handled by Google or Apple. Documents are held in private storage and only ever served through short-lived, signed links; connections to the Service are encrypted in transit.

Gaffy is a professional tool for football agents and is not directed at children. We don't knowingly collect data from anyone under 18 as an account holder.

We may update this policy as the Service changes. We'll update the date below and, for material changes, let you know in the app or by email.

Privacy questions and data-subject requests: info@studio31.hr. We aim to respond within the timeframe required by applicable law.