YOUR PERSONAL DATA VERSION 0.9 · updated on 7 October 2026

Privacy policy

This policy explains what data SpotXI uses, why, for how long and how to exercise your rights.

Data controller and contact

Alex TSAGUE is responsible for processing your personal data. For any question about its use, email support@spotxi.app.

YOUR PRIVACY CONTACT

controller: Alex TSAGUE

privacy contact: support@spotxi.app

Data collected

The data used depends on how you use SpotXI: login, player profile, club activity, invitations and safety.

SpotXI never asks for your EA password, an EA login code or your GPS location.

Login details and your age category are required to create an account. A player or club profile is needed to publish and receive proposals. Avatar, crest, screenshots and notifications remain optional.

DATA USED

login: account identifier, email and login method
age: declared category ages 15–17 or 18 and over
player profile: display name, public EA ID, platform, positions, play area, languages and self-declared level
club: club, role and membership
activity: availabilities, needs, invitations and decisions
images: public avatar and crest, if you add them; an adult player's avatar also appears on their public sports page, once the page is linked

safety: private contact after acceptance, blocks and private reports
messaging: text messages exchanged after an accepted session or trial, messaging pause and message reports
support and feedback: messages, attachments and optional screenshots, read only by administrators
technical: notification token and limited technical data
not collected: GPS, city, personal address, password, code or EA token

Purposes and legal bases

Your data is used to provide the service, arrange connections and protect users against abuse.

WHY WE USE YOUR DATA

account, profile, matching, invitations and messaging: performance of the service contract
safety, blocking and reporting: legitimate interest in preventing abuse and protecting users
website technical errors, without cookies or persistent identifiers: legitimate interest in keeping the website working
usage measurement, diagnostics and incident replay: your consent, withdrawable at any time
optional notifications: according to your choice and your device permissions
legal obligations: meet obligations applicable to SpotXI

Accepting the terms of use does not constitute consent to non-essential trackers.
Matching compares the criteria you declare and shows its reasons. No decision producing legal effects is made by automated means.

Recipients and processors

Access to data is limited to authorised people and providers needed to operate the service, according to their role.

PROVIDER CATEGORIES

authentication: login and sessions
network: traffic routing, anti-bot protection and receipt of support emails
email: sending account deletion requests
notifications: sending push notifications on iOS and Android
audience measurement: Google Analytics, provided by Google Ireland Limited
app product measurement, diagnostics and replay: provider hosted in the EU
hosting: public website on a rented server; app data on our own servers

Data is not sold. No private contact, email, message or token is sent to audience measurement.
Transfers outside the EU: our authentication, network, email and notification providers are based in the United States, and audience measurement (Google) may also transfer data there. These transfers rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.

Retention periods

How long your data is kept depends on its purpose. Retention periods and the events that trigger deletion are listed below.

RETENTION AND DELETION

account and profile: while the account is active; immediate deletion on request
inactive account: retained until you request deletion; no automatic deletion for inactivity
availabilities, needs and invitations: until expiry, closure or account deletion
private contacts: immediate deletion on withdrawal or account deletion
messages: for the life of the account; the text you sent is erased when your account is deleted

active blocks: while the block is necessary
reports and audits: 24 months after closure, restricted access
support: 12 months after the exchange ends, attachments included
feedback and screenshots: 24 months after resolution
technical logs: 6 months
audience measurement: data kept 14 months, measurement cookies 13 months
app product measurement and diagnostics: 12 months; replays: 30 days
measurement choices: 6 months on the device
backups: copies may temporarily remain after active data is deleted

Your rights

You can request access, rectification, erasure, restriction or portability of your data, and object to its processing under the conditions provided by GDPR. Email support@spotxi.app; we verify your identity only when necessary.

You can withdraw consent at any time, without affecting processing already carried out. A complaint may be sent to the CNIL.

EXERCISE YOUR RIGHTS

channel: support@spotxi.app · verification: only when necessary

We respond within one month. If the complexity or number of requests requires an extension, we inform you within that month of the reasons and the extension, limited to two additional months.

Ages 15 to 17

Access is limited to people declaring that they are at least 15. A declared age category is not proof of age and is never presented as such.

AGE AND ACCESS

access: limited to people declaring that they are at least 15

visible category: ages 15–17 or 18 and over · age not verified

Cookies and trackers

Measurement trackers only start with your consent, purpose by purpose. Website technical errors are reported without cookies or persistent identifiers.

On public sports pages, measurement includes the page address, the player’s EA ID and gamertag, their club and their statistics. This data describes the page viewed, never your SpotXI account.

COOKIES AND PREFERENCES

usage measurement on the website: Google Analytics, pages and actions, with a 13-month measurement cookie
usage measurement in the app: Google Analytics for Firebase and PostHog, screens and actions, with an installation identifier
diagnostics: request limits and loads over 5 seconds
incident replay: up to 30 seconds after an error or slowdown, once per session
your choice: kept for 6 months, changeable in the app settings or on the website’s Cookies and measurement page

Notifications remain optional and can be disabled in your device settings.

Last updated: 7 October 2026. For any question about this policy, contact support@spotxi.app.