Privacy policy

1. Who is responsible

The data controller is Color The Football S.L., Passeig de la Riera, 6C, 08329 Teia, Barcelona, Spain. For any privacy question or request, write to hola@colorthefootball.com.

2. What we collect

• Account data: your email address and, if you sign in with Google, your name and profile picture.
• Book details: your child's first name, shirt number, kit colors and any notes you add.
• Photos: the 1 to 5 photos of your child that you upload.
• Order data: the products you buy, your billing and shipping address, and your phone number for delivery.
• Payment data: payments are processed by Stripe. We never see or store your full card number.
• Technical data: the essential cookies described in section 9, and basic logs needed to keep the service secure.

3. Why we use it and our legal basis

• To create, deliver and support your book, and to manage your account and orders (performance of a contract).
• To process your child's photos, based on the explicit consent you give as parent or legal guardian when you upload them. You can withdraw it at any time.
• To issue invoices and keep accounting records (legal obligation).
• To keep the service secure and prevent fraud and abuse (legitimate interest).
• To send you news or offers, only if you opt in (consent). You can unsubscribe in every email.

4. Your child's photos

• We use the photos only to illustrate your book. We never publish them, never use them in our marketing and never sell them.
• Photos are deleted automatically 30 days after upload, or straight away when you ask or delete your account.
• The illustrations of your book are kept in your account so you can download them again, until you delete them or your account.
• Our AI provider processes the photos under a data processing agreement and does not use them to train its models.
• Only a parent or legal guardian may upload a child's photos. You must not upload photos of other people's children without their parents' permission.

5. Who helps us (processors)

• Supabase (database, file storage and sign-in, hosted in the EU, Frankfurt).
• Vercel (website hosting) and Railway (book processing, EU region).
• OpenAI (image generation from your photos).
• Stripe (payments), our email provider (order emails) and our print partners, such as Lulu or Gelato, which receive only the print files and the shipping address of printed books.
• All of them act on our instructions under data processing agreements.

6. Transfers outside the EU

Some providers, such as OpenAI and Stripe, may process data outside the European Economic Area. In that case we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision.

7. How long we keep it

• Photos: 30 days after upload, or less if you ask.
• Account and book illustrations: until you delete them or your account.
• Orders and invoices: for the period required by tax and accounting law.

8. Your rights

• You can ask to access, correct, delete or export your data, to restrict or object to its use, and withdraw your consent at any time. Write to hola@colorthefootball.com; we reply within one month.
• If you think we have not handled your data properly, you can complain to the Agencia Española de Protección de Datos (AEPD) or to the data protection authority of your country.

9. Cookies

We only use essential cookies: one to remember your language and the ones that keep you signed in. We do not use advertising or tracking cookies, so we do not ask for cookie consent. If this changes, we will ask you first.

10. Changes

If we change this policy, we will update the date above and, for important changes, tell you by email or on the website.