Privacy Policy
Last updated: 6 October 2026
This privacy policy is available in English, German and Dutch. Where the versions differ, the English version prevails.
iiCaptain is a team management application for amateur sports teams. This policy sets out what personal data we process, for what purpose, on what legal basis, who we share it with and how long we keep it. It is written to be checked: every processing activity in the table below has a purpose, a basis, a source, recipients and a retention period.
We publish changes on this page with a new date. When a change materially affects you, we ask you to accept it again on your next visit, so you have actually seen the new version.
1. Who is responsible
iiCaptain is published by Arcalis, based in the Netherlands. For privacy questions, access requests and complaints, reach us at support@iicaptain.app.
We have not appointed a data protection officer; an organisation of this size is not required to. Your request reaches the same people who build and run the service.
2. When we are controller and when we are processor
It depends on the situation. For your own account we decide the purposes and are the controller. For a team run by a club, the club decides what is recorded about its members; there we are the processor and the club is the controller.
| Situation | Our role |
|---|---|
| Your personal account Name, email address, password, language and notification preferences. | Controller |
| A team you create yourself You set up the team and decide who to invite; we provide the service. | Controller |
| A team run by a club The club decides what is recorded about members and who has access. | Processor |
| Payments and invoices We are legally required to keep invoices and do not decide that ourselves. | Controller |
| Security, error tracking and site analytics We decide what is measured to keep the service secure and working. | Controller |
If your club or association runs teams in iiCaptain, a data processing agreement is available. See the data processing agreement.
3. What we process, why and for how long
This table is the heart of this policy. Each row describes one processing activity: the purpose, the data, the legal basis, where the data comes from, who receives it and how long it is kept.
| Purpose | Data | Legal basis | Source | Recipients | Retention |
|---|---|---|---|---|---|
| Create and manage your account | Name, email address, password (hashed), profile picture, phone number, language and theme preference | Performance of the contract | From you | Google Ireland Limited (Firebase, Google Cloud) | While your account exists; deleted within 30 days of account deletion |
| Record your membership of a team | Role, shirt number, positions, squad flags, archived state, copied name and email | Performance of the contract | From you, From your team admin | Google Ireland Limited (Firebase, Google Cloud) | While the team exists; deleted within 30 days of team deletion |
| Schedule matches, trainings and events | Date, time, location, opponent, lineups, tasks, drills | Performance of the contract | From you, From your team admin | Google Ireland Limited (Firebase, Google Cloud) | While the team exists; deleted within 30 days of team deletion |
| Track availability and attendance | Your answer per match, training or event and when you gave it | Performance of the contract | From you | Google Ireland Limited (Firebase, Google Cloud) | 3 years, then anonymised |
| Keep the team kitty: who paid what for whom | Expenses you or teammates record (description, amount, date, who paid, who it was for) and the settlements between members. No bank or payment details. | Performance of the contract | From you | Google Ireland Limited (Firebase, Google Cloud) | While the team exists; deleted within 30 days of team deletion |
| Team posts and team messaging | Message content, reactions, polls and who posted them | Performance of the contract | From you | Google Ireland Limited (Firebase, Google Cloud) | 2 years, then deleted or anonymised |
| Send invitations, password resets and service notices | Email address, name, message content | Performance of the contract | From you | Google Ireland Limited (Firebase, Google Cloud), Google Ireland Limited (transactional email) | Delivery log 90 days |
| Push notifications about schedule changes, and a reminder the day before when you have not yet said whether you are coming | Device token, device type, notification preferences | Consent | From you, Automatic on use | Google Ireland Limited (Firebase, Google Cloud) | Until you withdraw consent |
| Charge and invoice Premium subscriptions | Email address, Stripe customer and subscription identifiers, invoice details. We never receive your card details. | Performance of the contract | From you | Stripe Payments Europe, Ltd. | 7 years (tax retention requirement) |
| Sell and renew Premium bought in the iPhone or Android app | Your account ID, the team the subscription is for, the product, and its purchase, renewal and expiry dates. Apple or Google takes the payment under their own terms; we never see your payment details. | Performance of the contract | From you, From an external source | RevenueCat, Inc. | While your account exists; deleted within 30 days of account deletion |
| Import hockey competition data | Team name, fixture list, results and pool standings from Hockey.nl | Performance of the contract | From an external source | KNHB (Hockey.nl) | While the team exists; deleted within 30 days of team deletion |
| Prevent abuse, trace errors and secure the service | IP address, browser type, timestamp, page requested, audit log of admin actions | Legitimate interest | Automatic on use | Google Ireland Limited (Firebase, Google Cloud), Google Ireland Limited (reCAPTCHA) | 90 days, unless an investigation or legal duty requires longer |
| Measure how visitors use the website | Random visitor number, page visited, language, acquisition channel, test variant | Consent | Automatic on use | Google Ireland Limited (Firebase, Google Cloud) | 14 months, then deleted |
| Show advertising through Google AdSense | Whatever Google determines through its own cookies; see the cookie policy | Consent | Automatic on use | Google Ireland Limited (AdSense) | Until you withdraw consent |
| Answer support requests | Your question, your name and email address, and the ticket's status | Performance of the contract | From you | Google Ireland Limited (Firebase, Google Cloud) | 2 years after the ticket is closed |
4. Retention periods
We do not keep data longer than needed for the purpose it was collected for. These are the periods referred to in the table above.
Backups: Deleted data may remain in encrypted backups for up to 90 days before those backups expire. During that period it is not used for anything other than disaster recovery.
5. Children and youth teams
Youth teams are part of amateur sport, and iiCaptain is meant for them too. So rather than only saying children may not use the service, this section explains how it works.
Creating your own account requires you to be 16 or older. That is the age that applies in the Netherlands for consent to information society services; other EU countries may set a lower age, in which case the lower age of the child's country of residence applies.
For players under 16, a parent or guardian creates and manages the account. That person gives consent, can view and correct the child's data, and can withdraw consent at any time by deleting the account. On sign-up we ask you to confirm that you meet the age requirement or are acting as a parent or guardian; we do not carry out further age verification, because doing so would require collecting more data about children than the problem warrants.
For underage team members we keep data to what a team needs to run: name, availability, position and shirt number. A date of birth, address or phone number is not required. Team admins are asked not to record more than that.
We do not send marketing email to minors and do not use their data to personalise advertising. If you discover that a child under 16 has an account without a parent's consent, email support@iicaptain.app; we will delete the account and the associated data.
The model for minors will be reviewed by a lawyer before any marketing aimed at youth teams; this text describes the model as it is implemented in the product.
6. Cookies and similar technologies
We only place necessary cookies without asking. Analytics and advertising cookies are placed only after you have agreed to them in the cookie banner, and you can change that choice at any time.
The complete list of cookies, local storage and third-party scripts (including provider, purpose and retention) is in the cookie policy.
7. Transfers outside the EEA
Your data is primarily stored on servers in the European Union. Some suppliers may access it from the United States for administration and support.
For those transfers we rely on the European Commission's standard contractual clauses, together with the measures the supplier takes. The location and basis per supplier are listed on the subprocessor page.
8. Security
We take technical and organisational measures to protect your data:
- Data is encrypted in transit using TLS.
- Passwords are stored hashed by Firebase Authentication; we never see them.
- Per-team access rules in the database, so one team's data cannot be read from another.
- Limited administrative access, with an audit log of admin actions.
No measure is complete. If a breach poses a risk to your rights, we report it to the Dutch Data Protection Authority within 72 hours and inform you where it poses a high risk.
9. Your rights
Under the GDPR you have the following rights:
- Access: a copy of the personal data we hold about you. You can also export your data yourself from your account settings.
- Rectification: have inaccurate or incomplete data corrected. Most of it you can edit yourself in your profile.
- Erasure: have your account and data deleted. You can do this directly from your account settings.
- Restriction: temporarily stop the use of your data while a request is being handled.
- Portability: receive your data in a structured, commonly used, machine-readable format.
- Objection: object to processing based on legitimate interest.
- Withdraw consent: for push notifications, analytics and advertising. Withdrawal applies going forward and does not make earlier processing unlawful.
Make a request at support@iicaptain.app. We respond within one month. If the request concerns a team run by a club, we pass it on to that club, because in that case they are the controller.
If you disagree with how we handle your request, you can complain to the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl) or to the supervisory authority of the EU country where you live.
10. Changes to this policy
We update this policy when the service or the processing changes. The date at the top shows the last change. For a material change we ask you to accept it again before you continue using the app.
11. Contact
Questions about this policy or your data:
- Email: support@iicaptain.app