Privacy Policy

1. Introduction

KlarBeats ("we," "our," or "us") is the sports club management platform operated by KlarBeats UG (haftungsbeschränkt) in Germany. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Service. This policy complies with the General Data Protection Regulation (GDPR) and applicable German data protection laws.

By using our Service, you agree to the collection and use of information in accordance with this Privacy Policy.

2. Data Controller

The data controller for the processing of personal data is KlarBeats UG (haftungsbeschränkt), Unterbiberger Straße 13, 85579 Neubiberg, Germany, represented by Managing Director Ypatios Asmanidis. If you have any questions about this Privacy Policy or our data practices, please contact us using the contact information at the end of this policy.

3. Information We Collect

3.1 Information You Provide

We collect information that you provide directly to us, including:

• Account Information: Email address, password, first name, last name
• Profile Information: Display name, profile picture (if provided)
• Organization Data: Organization name, description, and related information
• Content: Data you upload, post, or transmit through the Service, including player information, game data, evaluations, and messages
• Communication Data: Information you provide when contacting us for support

3.2 Automatically Collected Information

When you use our Service, we automatically collect certain information, including:

• Usage Data: Information about how you access and use the Service
• Device Information: IP address, browser type, device type, operating system
• Log Data: Access times, pages viewed, features used

3.3 Device Permissions

Our mobile application may request access to certain device features and permissions to provide enhanced functionality:

• Camera: We request camera permission to allow you to take photos directly within the app, such as profile pictures, player photos, or event images. Photos are only taken when you explicitly choose to use the camera feature. We do not access your camera without your explicit action.
• Storage/Media: We request storage permission to allow you to select and upload images from your device's photo library. This permission is only used when you choose to upload images.
• Location: We request location permission to show event locations on maps and provide location-based features. Location data is only collected when you explicitly enable location services and use location-based features.
• Notifications: We request notification permission to send you important updates, reminders, and alerts related to your sports club activities.

You can revoke these permissions at any time through your device settings. Note that revoking certain permissions may limit some features of the Service.

3.4 Mobile Analytics and Diagnostics

To keep the mobile app stable, secure, and performant, we process limited analytics and diagnostic telemetry from mobile devices.

This may include app version, device model, operating system version, crash/performance events, and high-level interaction metrics. We use this data to detect incidents, troubleshoot issues, and improve reliability and product quality.

• Telemetry is used for product operations, reliability monitoring, and service improvement.
• Crash and performance diagnostics may be processed by integrated platform services such as Firebase Crashlytics and related analytics tooling.
• Where required by law, consent controls are provided and can be changed in your device or app settings.

You can disable available analytics and diagnostics controls where supported by your platform and local legal requirements.

3a. Minors, Parents and Who Enters the Data

Player data, including data about minors, is entered by trainers, clubs, or parents/guardians, who confirm that they are entitled to do so. KlarBeats does not offer self-registration to anyone under 18; junior accounts are created by a parent, guardian, or trainer.

Player photos and any AI-assisted (“Klara”) outputs are visible only to the player's own team members, that team's trainers, and club admins/owners where a club exists. They are never made public and are never shared outside the team/club context through KlarBeats.

KlarBeats includes an AI-assisted feature (“Klara”). It is currently switched off platform-wide while we finalize its data-protection safeguards. No player or team data is sent to any AI model while it is off. See the AI Transparency Notice for detail once Klara is re-enabled.

KlarBeats does not collect medical, injury or other health-related data about players, and we are removing any such data that was previously entered.

4. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve the Service
• To authenticate your identity and manage your account
• To process your requests and transactions
• To send you service-related communications, including verification emails and security alerts
• To respond to your inquiries and provide customer support
• To detect, prevent, and address technical issues and security threats
• To comply with legal obligations and enforce our Terms of Service
• To analyze usage patterns and improve user experience

5. Data Storage and Location

Your data is stored securely using the following services:

• Firebase (Google Cloud Platform): We use Firebase for authentication, database storage (Firestore), and file storage. Firebase data is stored in Google Cloud data centers, which may be located in the European Union or other regions as configured.
• Google Cloud Functions: We use Google Cloud Functions for server-side processing. These functions process data but do not store it permanently.

Primary application data is stored in Firebase/Google Cloud Platform. We also use additional processors for specific functions, such as map/geocoding services and payment providers as described in this policy. We do not use third-party advertising networks.

6. Data Sharing and Disclosure

We do not share, sell, or rent your personal data to third parties. We may disclose your information only in the following limited circumstances:

• Service Providers: We may share information with service providers who assist us in operating the Service (e.g., Firebase/Google Cloud Platform), but only to the extent necessary to provide the Service. These providers are bound by strict confidentiality obligations.
• Maps and Geocoding: If you use map or location-related features, relevant address or coordinate data may be processed by mapping/geocoding providers (for example Google Maps Platform) to render maps and resolve locations.
• Payments: For subscription and merchandise payment flows, payment-related data may be processed by payment providers and related APIs (for example PayPal services and other configured payment processors). We do not store full payment card details in our core application database.
• Legal Requirements: We may disclose information if required by law, court order, or government regulation, or to protect our rights, property, or safety, or that of our users or others.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL
• Secure authentication and authorization mechanisms
• Regular security assessments and updates
• Access controls and audit logs
• Firebase security rules to protect database access

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

8. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

• Right of Access: You have the right to request access to your personal data and receive a copy of the data we hold about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal data under certain circumstances.
• Right to Restrict Processing: You have the right to request restriction of processing of your personal data.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to processing of your personal data under certain circumstances.
• Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw consent at any time.

To request access, correction, or deletion of your data (or your child's data), email privacy@klarbeats.com. We will handle deletion requests within 30 days.

To exercise any of these rights, please contact us using the contact information provided at the end of this policy. We will respond to your request within 30 days.

9. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Retention periods vary by data type (for example account data, organization records, notification logs, and media files). When you delete your account, we delete or anonymize personal data according to our account-deletion process, except where retention is required for legal, security, or accounting obligations.

10. Cookies and Tracking Technologies

We use essential cookies and similar technologies to provide and improve the Service. These technologies are necessary for authentication, security, and basic functionality. We do not use third-party advertising cookies or tracking pixels.

You can control cookies through your browser settings. However, disabling certain cookies may affect the functionality of the Service.

11. Youth players and minors' data

KlarBeats is built for sports clubs and teams, including youth development programs. As described in Section 3a above, player profiles for minors are always created and managed by clubs, coaches, or parents/guardians — KlarBeats does not offer self-registration to anyone under 18, and junior accounts (which may include a login created on the junior's behalf) are always set up by an adult, never by the young player themselves. Organizations using the Service are responsible for ensuring they have a lawful basis to process minors' data under applicable law (for example parental consent, club membership and statutory permissions for sports organizations, or another valid basis). If you are a parent or guardian and have questions about your child's data, or wish to exercise GDPR rights (access, rectification, erasure, restriction, portability, or objection), please contact your club first, or contact us using the information at the end of this policy; we will work with the relevant organization as needed.

12. International Data Transfers

Your data may be processed and stored in data centers located outside the European Economic Area (EEA) as part of Firebase/Google Cloud Platform services. When we transfer data outside the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Google Cloud Platform's compliance with GDPR and data protection standards
• Firebase's data processing agreements

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically for any changes.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, or if you wish to exercise your rights under GDPR, please contact us:

You also have the right to lodge a complaint with a supervisory authority if you believe that our processing of your personal data violates GDPR. In Germany, the relevant supervisory authority is the Federal Commissioner for Data Protection and Freedom of Information (Bundesbeauftragte für den Datenschutz und die Informationsfreiheit).