Privacy Policy

Last updated: 13 October 2026

This privacy policy explains how Driblo collects, uses, and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and Danish data protection legislation. Driblo is a website and two phone apps, Driblo Player and Driblo Coach. This policy covers all three.

1. Data Controller

The data controller responsible for your personal data is:

Driblo is the controller for the relationship between you and us: your account, your email address, your sign-in, security logs, and the token that makes it possible to send you a notification. Those are our own purposes, and we decide them ourselves.

For what your club records about its players — injuries, development plans, squad selections, positions and coaches' notes — the club is the controller and Driblo is the processor. The club decides which players are created, what is recorded about them, and why. We provide the tool and process the data on the club's instructions. If you want access to or deletion of that kind of data you may approach either of us; we help the club answer.

2. Data We Collect

2.1 Account Data

When you create an account, we collect:

• Email address
• Full name
• Nickname (optional) – the name shown on the club's graphics. You can set it yourself, and so can your coach and the club's graphics manager
• Phone number (optional)
• Date of birth
• Home address
• Profile photo (optional)

2.2 Physical and Sports Data

Some of this you enter yourself in your profile. The rest is recorded by your coach or your club:

• Height and weight — optional, and entered by you
• Gender — entered by you
• Jersey number — recorded by your coach or a club administrator
• Playing positions — recorded by your coach or a club administrator
• Preferred foot (left, right, or both) — recorded by your coach or a club administrator, and you can change it yourself

2.3 Club and Team Membership

• Club affiliations
• Team memberships
• Role within club (player, coach, administrator)
• Membership dates

2.4 Activity Data

• Training session participation and attendance
• Match participation and attendance
• Activity schedules and calendars

2.5 Health Data (Special Category - Requires Explicit Consent)

Important: Health data is considered a special category under GDPR Article 9 and requires your explicit consent before processing.

If you provide consent, the staff on your team whose role includes injuries — coaches and the physiotherapist — may record:

• Injury reports (type, description, affected body area)
• Injury dates and expected recovery times
• Injury status (ongoing or recovered)

You can withdraw this consent at any time through your profile settings. If you do not consent, coaches will not be able to create injury reports for you.

2.6 Performance and Development Data

• Formation positions in training and matches
• Development plans and progress tracking
• Coach notes and feedback

2.7 Technical Data

• Authentication sessions
• Device information (browser, operating system)
• Usage analytics (anonymized)
• Notification token for your device (only if you turn notifications on)
• Which notifications you have switched off — only the ones you turn off are stored, and only so that both your phone and our server respect the choice

2.8 What the apps ask your phone for

Driblo Player and Driblo Coach ask for access to three things. You can refuse all of them and still use the app.

• Camera and photos — only so you can take or choose a profile picture. The picture you choose is uploaded; the rest of your photo library is never read.
• Face ID or Touch ID (optional) — so you can sign in without waiting for a code by email. The app never receives your biometric data: the phone answers yes or no and nothing else.
• Notifications (optional) — sections 6.5 and 6.6 describe what is sent and to whom.

The apps do not ask for your location, your contacts or your calendar.

3. Legal Basis for Processing

We process your personal data based on:

• Contract performance (Article 6(1)(b)): Processing necessary to provide the Driblo service you have signed up for.
• Legitimate interest (Article 6(1)(f)): Processing necessary for security, fraud prevention, and service improvement.
• Explicit consent (Article 9(2)(a)): Required for health data (injury tracking). You can withdraw consent at any time.

4. How We Use Your Data

We use your personal data to:

• Provide and maintain the Driblo platform
• Manage your account and club memberships
• Enable team management and activity scheduling
• Facilitate communication between coaches and players
• Track attendance and participation
• Record injuries and recovery (with your consent)
• Generate development plans and track player progress
• Improve our services based on usage patterns
• Send notifications about selection, plans and reminders (if you turn them on)

5. Who Can See Your Data

5.1 Within Your Club

• Club administrators: Can view all member data within their club
• Coaches and other team staff: What a member of staff can see and change depends on the roles the club gives them on each team — for example head coach, team manager, physiotherapist or scout — and applies only to the teams they are attached to. A club administrator can adjust it for each person
• Graphics managers with Driblo Studio access: In clubs where Driblo Studio is switched on, can view the team squad — name, nickname, shirt number, position and date of birth — along with fixtures, results and starting line-ups. The club grants this access and it is limited to what the club's social media posts are built from. It does not include health data, contact details or coaches' notes.
• Players: Can view their own personal data and injury records. About the players they share a team or an activity with — including a guest added to a single session — they see only what a squad list shows: name, photo, age, gender, height, weight, nationality and which team they play for. Not contact details, not date of birth, and not a coach's notes — unless the club has granted them one of the accesses above. About the staff of their own team's trainings and matches they see name, photo, role and whether that person is coming. About the teams they play for they see the team's combined figures: results, goals, cards, number of players, average attendance and average age — added up over the whole team, so no teammate's own figures are shown on their own

5.2 Health Data Visibility

If you consent to health data processing:

• Your team's staff whose role includes injuries can view your injury reports — by default the coaches, the physiotherapist, the mental coach and the sporting director — and the coaches and the physiotherapist can create them. Other roles, such as the team manager, the video analyst or a scout, cannot. Your club decides this, and a club administrator can give or remove access for one person
• You can always view your own injury records
• Your teammates can see that you are out of a training session or a game, and that the reason is an injury — one word, and only for the activities you share
• Other staff on your team, such as the team manager, can see that you are out injured — that one word, not the type, the dates or the notes — so they can plan the squad without you
• No other player can see the type of injury, your dates or your coach's notes. Those are for you, your club's administrators and the staff your club has given access

5.3 Driblo's own access

As the provider, Driblo can reach data across clubs. We say so here because nobody could infer it from section 5.1:

• The access is limited to Driblo's own administrator and support accounts
• It is used to run and support the service: fixing faults, helping a club that is stuck, and maintaining the shared content clubs draw playing styles from
• It is not used for marketing, and we do not sell your data

6. Third-Party Services

We use the following third-party services to provide Driblo:

6.1 Supabase (Database & Authentication)

US-based company operating EU servers. Stores your account data and application data. Subject to Standard Contractual Clauses (SCCs) for EU data protection compliance.

6.2 Vercel (Hosting & Analytics)

US-based company operating EU servers. Hosts the Driblo application and provides anonymized analytics. Subject to Standard Contractual Clauses (SCCs).

6.3 OpenAI (AI Features)

US-based company. Used for one feature only: generating tactical animations from a situation you describe in Style of Play. What is sent is your own description of the situation and the positions of players on the pitch — no names, no health data and no personal data about any player. Data sent through OpenAI's API is not used to train its models. Subject to Standard Contractual Clauses (SCCs).

6.4 Anthropic (AI Features)

US-based company. Powers Libero, the assistant available to coaches, and the reading of files you upload — schedules, match reports and exercise documents. An uploaded file is sent exactly as it is, so whatever is written in it is sent too: a match report normally lists both squads by name, shirt number and date of birth. Data sent through Anthropic's API is not used to train its models. Subject to Standard Contractual Clauses (SCCs).

6.5 Apple (notifications on iPhone and iPad)

US-based company. Receives your device’s notification token and the text of each notification sent to an Apple device, so that it can deliver it. The token identifies an app installation rather than a person, and the text is the same sentence you see on your lock screen — no health data and no other player’s details are ever included. Nothing is sent to Apple unless you turn notifications on. Subject to Standard Contractual Clauses (SCCs).

6.6 Google (notifications on Android)

US-based company. Receives your device’s notification token and the text of each notification sent to an Android device, so that it can deliver it. Android devices can only be reached this way. The same limits apply as for Apple above: an installation rather than a person, and never health data or another player’s details. Nothing is sent to Google unless you turn notifications on. Subject to Standard Contractual Clauses (SCCs).

6.7 Resend (outgoing email)

US company. Sends the email Driblo itself sends: sign-in codes, invitations, email address confirmations, welcome messages and trial reminders. Resend receives your email address and the contents of those messages. Transfers to the US are covered by the safeguards described in section 9.

7. AI Features

Driblo uses AI models from Anthropic and OpenAI for the features below. None of them run automatically – a person in the club always starts them, never a schedule. Access follows the feature: Libero and the imports are for coaches and club administrators, while the caption writer requires access to Driblo Studio.

• Libero, the assistant: What the coach writes, the club's team names, the trainings and matches in the dates being discussed, and the club's exercises the conversation is about — their name, description, coaching content and what is drawn on the pitch. When the coach asks about the periodization, the team's plan for the weeks in question is sent – each week's theme, whether it is in or out of possession and whether a coach set it by hand – together with the plan's themes, their descriptions and planned shares; asked how the training divided, the team's total minutes and number of sessions per theme are sent. When the coach asks about the team's statistics, the team's totals for the period are sent: results, goals, cards, attendance in percent, number of players and average age. The totals are added up on Driblo's own servers before anything is sent – no names, no figures for any individual player and no dates of birth, and the average age is left out when fewer than five players' ages are known. Coach notes and player notes are not sent. Available to coaches and club administrators only.
• Schedule import: The uploaded file or spreadsheet, exactly as it is.
• Match report import: Driblo first reads the file on its own servers. When it recognises the format and can read all of it — today the Danish FA's match summary and Wyscout's match report — nothing is sent. Otherwise the text of the file's first five pages is sent, or the file exactly as it is when it has no text, such as a photo or a scan. A match report normally names every player on both teams, with shirt numbers and dates of birth.
• Exercise import: The uploaded file, exactly as it is.
• Tactical animations: The coach's description of the situation and the positions of players on the pitch. No names.
• Caption writing in Driblo Studio: The fields on the open card: opponent, home or away, the score and the outcome, competition, kick-off, venue, and the shirt numbers and short names of the selected players. Not the image itself, not dates of birth and not the rest of the squad. The caption is a suggestion, read and edited by a person before it is used.

Health data is never sent to an AI model. Injury reports, injury status, expected recovery time and everything else in the health category are blocked in the software itself, which refuses to send them.

AI output is a suggestion, never a decision. Nothing an AI model produces is saved to your club until a coach has read it and confirmed it. AI can be wrong, and the coach who confirms remains responsible for what is saved.

We keep a record of which feature sent something, when, and how much — never of what was sent. Those records are deleted after 12 months. Libero conversations are deleted 12 months after the last message in them.

8. Automated Decision-Making

We do not make decisions about you by automated means alone. No feature in Driblo produces a legal effect or otherwise significantly affects you without a person deciding: AI suggests, a coach decides, and nothing is saved until the coach confirms it. You are therefore not subject to automated decision-making or profiling within the meaning of Article 22 of the GDPR. We do not profile you for advertising and we do not sell your data.

9. International Data Transfers

Driblo is operated from Denmark and your data is stored on servers inside the EU. Several of the services in section 6 are companies based in the United States, so your data may be transferred there.

Every one of those transfers is covered by the European Commission's Standard Contractual Clauses together with a data processing agreement with the provider. You can ask us for a copy of the safeguards in place at any time.

10. Data Retention

• Account data: Retained while your account is active. Deleted immediately when you delete your account. Material you created for a club — training sessions, exercises, styles of play, match records — stays with the club, with your name removed from it.
• Activity data: Retained for the duration of your club membership.
• Health data: Retained until consent is withdrawn or account is deleted.
• Technical logs: Retained for 90 days for security purposes.
• AI conversations: Libero conversations are deleted 12 months after the last message in them.
• AI transmission records: Which feature sent something to an AI provider, and when. No content. Deleted after 12 months.
• Animation descriptions: The situation text a coach wrote for an animation is kept with the situation and deleted with it.
• Notification tokens: Deleted when you turn notifications off, when your device stops accepting them, or after 180 days without opening the app.
• Biometric sign-in: The sign-in key is kept in your phone's keychain and never leaves the device. If you sign out with biometric sign-in switched on, the key stays — that is what makes the shortcut a shortcut. It is deleted when you switch biometric sign-in off, when the server refuses the key, or when you delete the app.

11. Your Rights

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data, or delete your account yourself — under Profile → Account on the web, and under Profile → Account → My data in the apps
• Portability: Receive your data in a machine-readable format
• Restriction: Request limited processing of your data
• Objection: Object to processing based on legitimate interest
• Withdraw consent: Withdraw any consent given at any time

You can turn notifications off at any time, in the app’s settings or in your phone’s own settings. That is not a right under the GDPR but a setting you control yourself.

To exercise any of these rights, contact us at play@driblo.io.

12. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for databases
• Row-level security policies ensuring data isolation between clubs
• Regular security audits and updates
• Access controls and authentication

13. Children's Privacy

Driblo is designed for use in sports clubs, including youth teams. The club is the controller for its members and is responsible for having a lawful basis when a player under 18 is created — including involving a parent or guardian where the rules require it. Consent to processing health data is given in the app by the player herself, and the club should make sure a young player understands what she is agreeing to.

AI and young players: the AI assistant is not available to players — only to coaches and club administrators. AI still reaches a young player’s data in one place: when a coach uploads a document such as a match report, the names, shirt numbers and dates of birth printed in it are sent to the AI provider along with the file. Health data is never sent. Section 7 sets out what each feature sends.

14. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any significant changes by email or through the Driblo application. The updated policy will be effective from the date stated at the top of this document.

15. Complaints

If you have concerns about how we process your personal data, please contact us at play@driblo.io.

You also have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet):

16. Contact

For any questions about this privacy policy or our data practices, contact us at: