Privacy Policy

Rotate is operated by Wouter Blondeel, trading as High Performance Coaching (brand: SpeedLab), Kapucijnenvoer 109, 3000 Leuven, Belgium, VAT BE 0563.498.734 — contact: info@speedlab.be.

For club and federation deployments, the club is the data controller for player data: the club decides which players are entered and for what purpose, and we process that data on the club's behalf as a processor under a data processing agreement. For individual coach accounts, the coach decides what data they enter; the coach must be entitled to enter data about their players within their club context. Questions about how your club uses Rotate are best addressed to your club first.

Account data — e-mail address and a hashed password, plus your organization and role in the app.

Player and match data — player names, shirt numbers, line-ups, playing time, substitutions and match events (goals, cards, penalty corners, pauses). Players are often minors; we deliberately keep this data minimal — no player photos are stored anywhere in the product.

Wellness data — where a team uses load monitoring: injury status, self-reported session load (RPE), recovery and pain indications. This is health-related data; access is strictly limited (an athlete sees only their own data; coaches see their own team). The legal basis (typically explicit — for minors parental — consent) is established and managed by the club as controller.

We do not use advertising trackers, we do not profile users, and we never sell data.

Data is stored with Supabase (PostgreSQL database, authentication and storage) in the West Europe (London) region. The United Kingdom is covered by an EU adequacy decision, so this transfer is permitted under the GDPR. The web application is hosted and delivered by Vercel. Both act as sub-processors under their respective data processing agreements. When payments launch, checkout data is handled by Paddle as merchant of record — we never see or store your card details.

Access is enforced in the database itself (row-level security): coaches only reach their own organization's data, athletes only their own records. Live match screens shared via a match code are read-only and scoped to that single match.

Your data is kept while your account is active. After a trial or license expires it remains accessible read-only. You (or your club) can request a full export or deletion at any time via info@speedlab.be; we complete deletion requests within 30 days.

Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to processing. Contact us at info@speedlab.be — we respond within 30 days. You can also lodge a complaint with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be).

We will update this policy as the product evolves (for example when payments launch) and note the date of the latest revision at the top of this page.