Privacy and personal data

Privacy statement

Last updated: 10 November 2026

Matchio is an online application that football clubs use to manage teams, players, training sessions, matches, lineups and match information. This statement explains which personal data may be processed, why that happens and which rights you have.

1. Who processes your data?

For data that a club enters into Matchio about players, coaches and other people involved, the club usually decides what that data is used for. The club is therefore the controller. Matchio processes that data on behalf of the club as a processor, under the terms of the data processing agreement.

For data needed to manage user accounts, the operation and security of the service and the use of Matchio, Matchio may itself be the controller. The exact division of roles depends on the purpose of the processing and is set out in the agreements with the club.

For privacy questions about processing for which Matchio is itself responsible, you can contact Matchio at matchio.info@gmail.com. For data that a club enters into the application, contact that club.

2. Which data do we process?

Which data is processed depends on how the club uses Matchio and what information it enters.

Player and team data

This may include, among other things:

• first and last name, date of birth and squad number;
• positions, preferred foot, height or size, weight (optional) and previous club;
• strengths and development points that the club enters;
• team, age category, season, squad and lineups;
• attendance status and any reason for absence;
• training and match data, such as date, time and location;
• goals, assists, match events and match notes;
• planned lineups, substitutions and the planned playing time calculated from them;
• photos and videos for a match: not active yet. We will update this statement when they are activated.

Matchio does not have a separate medical record for players. Free-text fields, such as notes or reasons for absence, may still contain information that is sensitive or that reveals something about someone's health. Therefore do not enter medical or other sensitive information unless it is necessary and the club has a valid legal basis for it.

Account and club data

This may include, among other things:

• account data from the chosen sign-in provider, such as name, email address, profile picture and user identifier;
• the role and team or club memberships of a user;
• club name, club address, the email address of the club administrator and other club data;
• messages, events and sponsor information that users enter.

Data when using the AI assistant

When you use the AI assistant, your chat messages and relevant data from Matchio may be processed. This can include first names (for players with a duplicate first name, the first letters of the surname), positions, player notes, strengths and development points, lineups, attendance, goals, match events, match notes, dates and locations. Absence reasons are not sent. What you type in a chat message may also contain personal data.

Technical data

Matchio and the service providers involved may process technical data needed to deliver, secure and manage the service. Examples are user identifiers, network data and technical request data. Which log data is kept, and for how long, depends partly on the configuration of the hosting and cloud services.

3. Why do we process data?

Among other things, the club uses Matchio to:

• manage teams and players;
• plan matches and training sessions;
• keep track of attendance, lineups and match events;
• create match information and club or team messages;
• optionally use the AI assistant for questions and draft texts.

Matchio processes account and technical data to make accounts work, to secure the service and to provide support. The club determines the legal basis for personal data that it enters about players and other people. That basis may differ per club and situation.

For creating and running user accounts (such as signing in and managing roles and memberships), the basis is the performance of the contract with the user or the club (Article 6(1)(b) GDPR). For the operation, security and support of the service (such as technical and log data and abuse or fraud prevention), the basis is the legitimate interest of Matchio and its users in a secure and well-functioning service (Article 6(1)(f) GDPR). Where a legal obligation applies, that obligation is the basis (Article 6(1)(c) GDPR).

4. AI assistant and match information

The AI assistant is only available to club owners and coaches. Team delegates and supporters have no access to it.

When you use the AI assistant, Matchio sends your request and relevant data from the application through the Matchio API to the configured AI service. The provider used may depend on how Matchio is configured.

The AI assistant may also process data about a match location, match date or travel time through external services for weather, route or match information. The providers actually used are: Google (Gemini, through the Generative Language API), Groq and NVIDIA for the AI functionality, depending on the configuration and any fallback in the event of an outage; Open-Meteo for weather information; Komoot (Photon geocoder) and the OSRM routing project, both based on OpenStreetMap data, for route and travel-time information; and the Royal Belgian Football Association (RBFA) for official match calendar and result data when a user shares an rbfa.be link.

In the web app, chat history is stored locally in the browser. The exact retention periods, processing locations and rules on using data to improve models differ per AI provider and may change. Assume that an AI provider may use the data to improve its services. Therefore we send players only by their first name (for a duplicate first name, with the first letters of the surname). An AI provider may process or temporarily store data under the terms and privacy policy that apply to the service used. Therefore do not share unnecessary or sensitive personal data with the AI assistant.

For weather, route and match information, data is requested from Open-Meteo, Komoot (Photon), the OSRM routing project and, when a user shares an rbfa.be link, the Royal Belgian Football Association (RBFA). These services apply their own terms and privacy policies. Matchio has not set a uniform retention period for those services.

AI answers may contain errors. The user decides whether to use or share an answer. Check a report before you distribute it. Matchio does not use the AI assistant to make automated decisions with legal effects for players.

5. Who can receive or view data?

Data may be available to people to whom the club gives access, within the rights set for their account and role. The exact access depends partly on the access settings of the service.

Team delegates keep the match live. They see the team (first name and shirt number), the training sessions and the live matches, including the selection and lineup for those matches, but no notes, player profiles, absence reasons, statistics or AI. A finished match is no longer visible to them. The coach can renew the delegate code and sign out the current delegates; from then on they no longer have access. Supporters see the score, the score per period, goals with the first name of the scorer and the assist, the selection (who is and who is not selected, with first name, without a reason), corners and cards as team totals, the approved report, the first names and shirt numbers and the training schedule. The lineup, substitutions, playing time, rankings, notes and absence reasons are not visible to supporters.

To deliver the service, Matchio uses Firebase for accounts and database, and Microsoft Azure for hosting and the API. Depending on the configuration, it also uses Google (Gemini), Groq or NVIDIA for AI features. For weather, route and match information, Open-Meteo, Komoot (Photon), the OSRM routing project and the RBFA may also be called. These parties process data to the extent needed to provide their services.

Groq, NVIDIA and Google are US companies. Data processed through these AI providers may be processed in the United States of America, outside the European Economic Area. That takes place on the basis of the EU-US Data Privacy Framework or standard contractual clauses (to be checked per provider).

Anyone who creates a new club submits a request. The requester's email address, the club name, the registration number and any address provided are then sent to Matchio's mailbox so the request can be approved or rejected.

The current web version does not create a public report link. Users can still copy or share text themselves with another application. Once data is shared through such an application, the terms of that application also apply.

6. Where is data processed?

Matchio's own infrastructure is in the European Union. The Firestore database (accounts, club data, matches and selections) runs in the Google Cloud region europe-west3 (Frankfurt, Germany). The Azure resources for the API and the web app run in the West Europe region (the Netherlands). Third parties mentioned above process data at their own locations. These may differ per service and configuration and may also be outside the European Economic Area. Where privacy law requires it, appropriate safeguards are applied to transfers.

7. How long do we keep data?

Matchio does not keep data longer than necessary for the purposes for which it was collected, for providing the service to the club and for any legal obligations. The club manages the data it enters and may request export or deletion under the agreements with Matchio. Data is kept until the club deletes it; on request, it is deleted within 30 days.

Chat history may be kept locally in the browser until the user deletes it or clears the browser data. Firestore may also cache data locally to keep the application available during a temporary connection interruption. Data at service providers and in backups is deleted or overwritten according to the applicable configuration, terms and retention policies of those services.

8. Security

Matchio and the club take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. Access to data depends on the account rights and settings of the service. The club is responsible for managing accounts and access rights carefully within its organisation.

9. Minors and photos

Matchio may process data about minor players when a club uses the application for that purpose. The club informs players and, where needed, their parents or legal guardians, and determines the applicable legal basis.

Matchio does not itself record whether consent has been obtained for a photo or video. Before uploading or sharing, the club must check that it has a valid basis for doing so.

10. Browser storage and cookies

The web app uses strictly necessary browser storage for, among other things, sign-in, preferences, selected club and team settings and chat history. Firestore may cache data locally. In the web code reviewed, no analytics or advertising cookie service was found. Sign-in or other external services may use their own cookies or storage technologies.

11. Your privacy rights

Depending on the applicable privacy law, you may request access to, correction, deletion, restriction or portability of your data. In some situations you may object to the processing.

For data that a club enters into Matchio, you should first contact the club. The club handles requests according to the data processing agreement. For processing for which Matchio is itself responsible, you can contact Matchio at matchio.info@gmail.com.

You can also file a complaint with the Belgian Data Protection Authority: gegevensbeschermingsautoriteit.be .

12. Changes

Matchio may update this statement when the service, the service providers used or the applicable obligations change. The current version and date are published on this page. For important changes we inform the clubs concerned through a suitable communication channel.