1. Who we are
The Roster is operated by Gustas Maskoliūnas ("we," "us"). For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for the personal data described below. You can reach us at Maskoliunas33@gmail.com for anything related to your data or this policy.
2. What we collect
We collect only what the product actually needs to function. Specifically:
- Account data — your email address and a hashed password. We never store your password in readable form.
- Coach profile data — name, sport, club, years of experience, availability status, a short bio, a CV summary or link you paste in yourself, phone number, and agent name/contact if you choose to provide one.
- Club profile data — club name, location, and a contact email.
- Forum content — anything you post in a thread or reply, tied to your account email.
- Shortlist activity — which coaches a club has added to its shortlist, and when.
- Notifications — a record of forum replies and shortlist adds relevant to your account, so we can show you your notification board.
- Support conversations — messages you send through the in-app support chat, including anything you tell the AI assistant.
- Payment metadata — if you subscribe to Pro placement, we store your Stripe customer and subscription IDs and your subscription status. We never see or store your actual card number — that's handled entirely by Stripe on their own systems.
3. Why we process it, and on what legal basis
- To provide the service you signed up for — your account, profile, directory listing, forum access, and shortlist features. Legal basis: performance of a contract with you.
- To process Pro subscriptions — billing and subscription management via Stripe. Legal basis: performance of a contract with you.
- To keep the platform trustworthy — reviewing flagged listings, investigating suspected scams. Legal basis: our legitimate interest in preventing fraud and abuse, balanced against your rights.
- To notify you of relevant activity — forum replies, shortlist adds. Legal basis: performance of a contract with you.
- To provide support — including passing your support messages to our AI provider (Anthropic) to generate a response. Legal basis: performance of a contract with you / our legitimate interest in resolving your issue efficiently.
4. Who we share data with
We use a small number of third-party processors to run the service. We don't sell data to anyone, ever.
- Stripe (payment processing) — receives what's needed to process your subscription. See Stripe's own privacy policy for how they handle it.
- Anthropic (AI support assistant) — receives the text of your support chat messages to generate a reply. Anthropic is based in the United States; this involves a transfer of your data outside the EU, which we rely on Anthropic's standard contractual clauses to cover.
- Our database and hosting providers — store the underlying data that makes the app work. We choose providers that offer appropriate security commitments.
If law enforcement or a court compels us to disclose data, we will do so only to the extent legally required, and will tell you unless we're legally prohibited from doing so.
5. How long we keep it
We keep your account and profile data for as long as your account is active. You can delete your own account and its data any time from the "Danger zone" section of your profile page — no need to email us, though you're welcome to if you'd rather. Deleting your account also cancels any active Pro subscription automatically. Forum posts are retained even after account deletion where removing them would break the thread for other participants, but they're disassociated from your identity and show as posted by a deleted user. Billing records are kept as long as required by Lithuanian tax law regardless of account status.
6. Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Request erasure of your data ("right to be forgotten")
- Restrict or object to certain processing
- Receive your data in a portable format
- Lodge a complaint with a supervisory authority
To exercise any of these, email Maskoliunas33@gmail.com. If you're not satisfied with our response, you can complain to Lithuania's State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija): L. Sapiegos str. 17, LT-10312 Vilnius, Lithuania — ada@ada.lt — vdai.lrv.lt/en.
7. Cookies
We use one essential cookie to keep you signed in (via our authentication system). We do not currently use analytics or advertising cookies. If that changes, we'll update this policy and, where required, ask for your consent first.
8. Children
The Roster is not directed at, and should not be used by, anyone under 16. We don't knowingly collect data from children.
9. Security
We use reasonable technical measures to protect your data, including password hashing and encrypted connections. No system is perfectly secure, and we can't guarantee absolute security — but we treat this seriously and will notify affected users of any data breach as required by law.
10. Changes to this policy
If we make material changes to this policy, we'll post the update here with a new "last updated" date, and where the change is significant, try to notify active users directly.