Privacy Policy

1. Who we are

Possivo is operated by Saleh Mustafa, registered in Sweden. For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for the personal data described here.

If you have questions about this policy or your data, contact us at privacy@possivo.com.

2. What data we collect

Account data: your name, email address, and the club name you choose to provide when you sign up.

Content you create: teams, players, formations, scenarios, scouting notes, and other tactical data you add to the board.

Payment data: if you subscribe to a paid plan, our payment processor Stripe handles your card details. We do not store full card numbers; we keep a customer and subscription reference to manage your plan.

Usage data: basic technical information such as log data and how you interact with the Service, used to keep it secure and improve it.

3. Player data you enter

Possivo lets you store information about players, which may include names and notes. Where those players are identifiable individuals, that information is personal data, and for it you are the controller and we act as your processor. You are responsible for having a lawful basis to store it and for informing those individuals where required.

We recommend not entering more personal detail about players than you need for tactical work.

4. Why we use your data and our legal basis

We use your data to provide and secure the Service (performance of our contract with you), to process payments (contract and legal obligation), to communicate with you about your account (legitimate interests), and to improve Possivo (legitimate interests). Where we rely on legitimate interests, we balance them against your rights.

We do not use your tactical content to train third-party AI models, and we do not sell your personal data.

5. AI processing

When you use AI analysis or tactical generation, the relevant board state is sent to our AI provider, Anthropic PBC, to generate a response. This is processed to fulfil your request and is subject to that provider’s data terms. Review those terms at anthropic.com/legal/commercial-terms.

6. Who we share data with

We share data only with service providers who help us run Possivo, under appropriate data protection agreements. These currently include Supabase (database and authentication), Stripe (payments), and Anthropic (AI features). We may also disclose data where required by law.

7. International transfers

Some of our providers may process data outside the European Economic Area. Where that happens, we rely on safeguards such as the European Commission’s Standard Contractual Clauses to protect your data. Details are available on request at privacy@possivo.com.

8. How long we keep it

We keep your account and content data for as long as your account is active. If you close your account, we delete or anonymise your personal data within 30 days, except where we must keep certain records (for example, billing records) to meet legal obligations.

9. Your rights

Under the GDPR you have the right to access, correct, delete, and port your personal data, to restrict or object to certain processing, and to withdraw consent where we rely on it. You can exercise most of these directly in your account settings, or by contacting us at privacy@possivo.com.

You also have the right to lodge a complaint with your local data protection authority. In Sweden that is Integritetsskyddsmyndigheten (IMY).

10. Security

We use technical and organisational measures to protect your data, including encryption in transit and access controls. No system is perfectly secure, but we work to protect your information and to notify you and the relevant authority if a breach affects your rights, as the law requires.

11. Changes to this policy

We may update this policy as Possivo evolves. If we make a material change, we will notify you before it takes effect. The date at the top shows when it was last revised.