Privacy policy

Last updated: October 12, 2026

This is a translation for convenience. The Spanish version prevails in case of discrepancy.

This policy explains how personal data is processed in HandBrain (the website www.handbrain.top and the application) and in the commercial contacts we make with clubs and coaches. It has two parts: application data and commercial prospecting.

1. Data controller

• Owner: [pending]
• Tax ID (NIF): [pending]
• Address: [pending]
• Contact and data protection: hello@handbrain.top

We have not appointed a Data Protection Officer because our activity does not require one; any privacy question is handled at the email address above.

2. HandBrain application data

2.1 User and club account

Data: email address, password (stored only as a hash, never in plain text), club name and crest, language, role in the club and open sessions.
Purpose: to create and manage the account and provide the service.
Legal basis: performance of a contract (art. 6(1)(b) GDPR).
Retention: while the account is active. When it is closed, account and club data are deleted, except data we must keep by law (invoicing). Sign-ups that never confirm their email are deleted after 7 days.

2.2 Preventing abuse of the free trial

Data: the IP address used to create the account and a random browser identifier (cookie did; only an encrypted digest is stored in the database, never the value).
Purpose: to stop people from chaining free trial accounts.
Legal basis: legitimate interest in preventing fraud (art. 6(1)(f) and recital 47 GDPR).
Retention: the IP address, 30 days; the encrypted identifier, while the account exists.

2.3 Subscription and payments

Payments are processed by Stripe (Stripe Payments Europe, Ltd., Ireland). Card details are collected and stored by Stripe: HandBrain never sees or stores them. We keep the Stripe customer ID, the subscription status and the invoices.
Legal basis: performance of a contract (art. 6(1)(b) GDPR) and compliance with accounting and tax obligations (art. 6(1)(c) GDPR).
Retention: invoices and accounting records, 6 years (art. 30 of the Spanish Commercial Code), and any period required by tax law.

2.4 Player, team and match data

The data each club enters (players' names or nicknames, shirt numbers, positions, line-ups and statistics) is decided and controlled by the club or user who enters it, who is the data controller. HandBrain acts as a data processor (art. 28 GDPR): it processes that data only to provide the service and on the club's instructions, does not use it for its own purposes or share it, and deletes it when the club asks or closes its account.

If data about minors is recorded, the club must have the necessary legal basis (for example, the authorisation of parents or guardians). We recommend recording only what is essential: name or nickname and shirt number.

2.5 AI assistant, voice and MCP connector

AI features are optional. If the club enables them with its own provider (Anthropic, OpenAI or Azure OpenAI) and its own key, the text of the commands and the match data needed to understand them are sent to that provider, under the club's own terms with it. With voice input, speech recognition is done by the browser or operating system itself (for example, Google in Chrome or Apple in Safari): HandBrain only receives the text, never the audio. If the user connects an external assistant through MCP, that assistant accesses the club data the user authorises.

2.6 Contact form

Data: name, email, club (optional), the message and the IP address (only to curb abuse).
Purpose: to answer the enquiry.
Legal basis: legitimate interest in answering the enquiries we receive and, where the enquiry precedes a contract, pre-contractual steps (art. 6(1)(f) and 6(1)(b) GDPR).
Retention: up to 12 months after the last communication.

2.7 Service emails

We send the emails the service needs: email verification, invitations, password recovery, invoices and payment notices. They are not advertising and are sent while you have an account.

3. Commercial prospecting to clubs and coaches

To make HandBrain known, we contact handball clubs and their coaching staff.

• Data: professional contact details: name, role (coach, coordinator, sporting director), club, category or competition, and the published contact email or phone number.
• Source: publicly accessible sources: the clubs' own websites, federation and competition websites and public professional profiles. We do not buy databases. Our first message states the specific source.
• Purpose: to present HandBrain, a service related to the contacted person's professional activity, and to reply if they are interested.
• Legal basis: legitimate interest (art. 6(1)(f) and recital 47 GDPR), which we have balanced in writing against the rights of the people we contact. We only send commercial emails where electronic communications law allows it (in Spain, art. 21 LSSI; in France, art. L34-5 of the Postal and Electronic Communications Code, which allows business-to-business emails related to the recipient's profession when an opt-out is offered).
• Retention: at most 2 years after the last unanswered contact, or until the person objects. If someone unsubscribes, we keep only their email address on a suppression list so we never write to them again.
• Recipients: our email delivery provider (Resend). We do not share the data with third parties.
• Objection and unsubscribing: at any time, free of charge and without giving reasons, at www.handbrain.top/unsubscribe, by replying “STOP” to any of our emails or by writing to hello@handbrain.top.

4. Providers and international transfers

All of them process data on our behalf under a data processing agreement. Transfers outside the European Economic Area rely on the EU-US Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the European Commission (art. 45 and 46 GDPR).

5. Cookies and browser storage

All of them are technical or security cookies needed for the service you request, so they do not require consent (art. 22(2) LSSI). We do not use analytics, advertising or third-party cookies, and fonts are served from our own server. When you pay, Stripe's checkout page uses its own cookies, under its own policy.

6. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you have given at any time, by writing to hello@handbrain.top and stating which right you are exercising. If we have reasonable doubts about your identity, we may ask you to prove it. We reply within one month at the latest. For player data entered by a club, contact that club; if the request reaches us, we will pass it on.

7. Complaints

If you believe we have not handled your rights properly, you can lodge a complaint with a supervisory authority, in particular:

• Spain: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es
• France: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr

or with the authority of the EU country where you live or work.

8. Security

Connections are encrypted (HTTPS), passwords are stored as hashes, each club's data is kept separate and only that club's people can access it, plus HandBrain staff when needed to provide support.

9. Age

Accounts are intended for clubs, coaches and coaching staff who are adults.

10. Changes

If we change this policy, we will publish the new version here with its date and, if the change is significant, we will notify users by email.