1. Controller
| Controller | Halim Abdelaziz |
|---|---|
| Address | Johann-Besserer-Weg 17 71277 Rutesheim Germany |
| hello@klyrofootball.com | |
| Service | Klyro |
No data-protection officer has been appointed. Privacy questions and requests may be sent directly to the controller.
2. Data and purposes
| Activity | Data | Purpose |
|---|---|---|
| Website and security | IP address, request time, URL, referrer, browser/device information, response status and security events | Deliver the website, prevent abuse, diagnose faults and protect the service |
| Accounts | Email, verification status, profile settings, account identifiers and security records | Create and secure an account and provide account features |
| Saved football | Saved Stories, followed competitions, teams and players, Story views, likes and shares | Synchronize the user’s library, personalize the Story feed and display account activity |
| Product operations | Story exports, asset version, delivery count, generation status, failure and cost events linked to an account | Provide requested outputs, avoid duplicate processing, apply limits and control operating costs |
| Optional analytics | Aggregate page and device usage supplied by Vercel Web Analytics | Understand use and improve performance, only after consent |
| Contact | Email address, message and information voluntarily supplied | Respond to support, privacy or partnership enquiries |
Klyro does not request payment-card information and does not make decisions producing legal or similarly significant effects solely by automated means.
3. Legal bases
| Processing | Legal basis |
|---|---|
| Website delivery, security, abuse prevention and necessary account operation | Article 6(1)(f) GDPR — legitimate interests in a secure and reliable service; Article 6(1)(b) where processing is necessary to provide requested account access |
| Contact requests | Article 6(1)(b) GDPR for steps requested by the user; Article 6(1)(f) for responding to non-contractual enquiries |
| Optional analytics | Article 6(1)(a) GDPR and section 25(1) TDDDG — consent, withdrawable at any time |
| Legal compliance and legal claims | Article 6(1)(c) GDPR for legal duties; Article 6(1)(f) for establishing, exercising or defending legal claims |
4. Hosting, database and processors
Vercel hosts and delivers the website and provides optional Web Analytics. Neon provides the managed PostgreSQL database used for private account preferences, saved football, activity, quotas and operational records. Public pages use published snapshots and do not query this database. Clerk provides account identity and session security. Email providers process contact messages and operational alerts. Football-data and AI providers receive product-side football inputs and are not intentionally given account identities.
Processors receive personal data only as necessary for their service. Klyro does not sell personal data or use it for third-party advertising.
5. International transfers
Infrastructure or email providers may process data outside Germany or the European Economic Area. Where no EU adequacy decision applies, Klyro relies on an applicable transfer mechanism such as the European Commission’s Standard Contractual Clauses and, where required, supplementary safeguards.
6. Retention periods
| Data | Retention policy |
|---|---|
| Hosting and security logs | Up to 30 days, unless a security incident or legal duty requires longer preservation |
| Consent choice | On the device until changed or cleared |
| Optional analytics data | Up to 6 months, then deleted or aggregated |
| Account and profile | While active; deletion or anonymisation within 30 days after closure, subject to legal exceptions |
| Generation and quota records | Up to 90 days after the related output or account closes, unless needed for abuse investigation or a legal claim |
| Support and privacy correspondence | Until completed, then up to 3 years where reasonably needed to document the response or protect legal claims |
Data is deleted or anonymised earlier when it is no longer necessary and no legal ground requires retention.
7. Your rights
Subject to the GDPR’s conditions, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting processing already carried out lawfully. You may also complain to a supervisory authority, including the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.
8. Requirement to provide data, security and changes
Technical request data is necessary to deliver the website. Required account fields are necessary only if you create an account. Contact fields are voluntary, but Klyro cannot answer without the information needed to understand the request. Klyro uses proportionate technical and organisational safeguards, although no internet service is risk-free.
This policy will be updated before a new processor or materially different purpose is activated.
9. Account identity processor
Clerk processes account registration, email verification, Google sign-in, session management and account-security information on Klyro’s behalf. If a user selects Google, Google also processes the identity request under its own privacy information. Klyro does not receive a user’s Google password and does not store account passwords in its product database.
Clerk and Google may process account information outside Germany or the European Economic Area. Klyro relies on applicable safeguards described in section 5.