Legal
Privacy Policy
Effective 15 September 2026 · GDPR — Regulation (EU) 2016/679
This explains what BookThe90 collects, why, and what you can do about it. The data controller is Nikitas Neofytou, Saixpir, 6027 Larnaca, Cyprus.
1
What we don’t do
Worth stating first, because it is unusual enough to be worth knowing:
BookThe90 contains no analytics, no advertising, no tracking of any kind, and no third-party trackers. We do not profile you, we do not sell or share data for advertising, and we do not track you across other apps or websites. There is nothing to opt out of because there is nothing running.
We also never see your card details. Those go directly to Stripe.
2
What we collect
Data
Why
- Name, email, phone
- To identify your account, let venues know who is booked in, and contact you about a booking.
- Date of birth
- To confirm you meet the minimum age.
- Profile photo
- Optional. Shown to other players in bookings and matches.
- Preferred position and foot
- Optional. Shown to other players so sides can be picked sensibly.
- Bookings and payments
- What you booked, when, what it cost, whether it is paid, and a Stripe reference. No card data.
- Match and tournament activity
- Which games you joined, which side you played on, recorded results, and your rating.
- Chat messages
- Messages you send in booking and match chats, so the people in that game can read them.
- Notification token
- Only if you allow notifications. An anonymous device identifier used to deliver them.
Location never leaves your device. If you allow location access, your phone works out which venues are nearest and sorts the list. That calculation happens on the phone. Your coordinates are never sent to us and never stored.
3
Why we are allowed to
Legal basis
Applies to
- Performance of a contract
- Your account, bookings, payments, chats, and match participation — we cannot provide the service without these.
- Legitimate interests
- Keeping the service secure, preventing misuse, recording no-shows, and the rating system that makes matches balanced.
- Consent
- Push notifications and location. Both are optional, and you can withdraw either in your device settings at any time.
- Legal obligation
- Transaction records we or Stripe must keep for tax and anti-fraud purposes.
4
Who else sees it
Who
What, and why
- The venue you booked
- Your name and booking details, so they know who is on the pitch. They also see messages in that booking’s chat.
- Other players
- Your name, photo, rating, and preferred position and foot — to people in the same booking, match or tournament team.
- Stripe
- Payment processing. They receive your card details directly and the amount. Stripe is the controller of that data for its own purposes.
- Supabase
- Hosting, database and sign-in. Our data is stored in the EU (Ireland).
- Expo
- Delivery of push notifications, where you have allowed them.
- Google or Apple
- Only if you sign in with them. They confirm your identity to us; we receive your name and email.
We do not sell your data. We do not share it with advertisers. We will disclose it where the law requires us to.
5
How long we keep it
For as long as you have an account. Delete the account and it goes — see clause 7.
Two things outlive that. Past team line-ups and recorded results keep the fixture but unlink you from it, so results that other players’ ratings depend on are not silently rewritten; you are not identifiable in what remains. And Stripe retains payment records for the period its own legal obligations require, which is outside our control.
6
Your rights
Under the GDPR you can ask us to:
- give you a copy of the data we hold about you, in a portable format
- correct anything inaccurate — most of it you can edit yourself in the app
- delete your account and data
- restrict or object to a particular use of it
- withdraw consent for notifications or location, at any time
Email support@bookthe90.com and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, or to the supervisory authority where you live.
7
Deleting your account
In the app: Profile → Account settings → Delete account, then type DELETE to confirm. It is immediate and cannot be undone.
If you no longer have the app installed, email support@bookthe90.com from the address on the account, and we will action it within 30 days.
Deleting removes your profile, your bookings past and upcoming, your chat messages, your match and tournament memberships, your rating and its history. Upcoming bookings are cancelled first, subject to the refund rules in the Terms of Use.
Deletion is refused while others depend on you — while you are organising an upcoming open match, or captaining a tournament team. The app tells you which, so you can resolve it.
The same instructions are published at Delete Your Account, which you can reach without installing the app.
8
Children
BookThe90 is not for under-16s and we do not knowingly collect their data. If you believe a child has an account, tell us and we will remove it.
9
Security
Data is encrypted in transit and at rest. Access is restricted by row-level rules so one account cannot read another’s data. Card details never reach our systems. No system is perfectly secure, but we will tell you and the regulator if a breach affects your data, as the law requires.
10
Changes
We will update this page if what we collect changes, and tell you in the app where the change is significant. The effective date at the top always reflects the current version.
11