Twin Sports

Privacy policy

Last updated: 25 October 2026

This policy explains what personal data we process when you visit twinsports.ai or write to us. It covers this website and, until Twin Sports opens, signing in and the waitlist at app.twinsports.ai. The club app will have its own privacy policy before clubs use it.

1. Who is responsible

The controller under the General Data Protection Regulation (GDPR) is:

TWIN SPORTS LTD OOD
(„Туин Спортс“ ООД / Twin Sports Ltd.)
41 Kutlovitsa str.
Sofia 1505, Bulgaria
Email: hello@twinsports.ai
Phone: +359 889 797 678

We have not appointed a data protection officer. For any privacy question, write to hello@twinsports.ai.

2. What this website does and does not do

No cookies and no similar technologies that store anything on your device beyond the current tab.
No advertising, no social media plug-ins, no third-party analytics or tracking.
No content from third parties: fonts, images and videos are served from our own server.
It has forms: “Apply to join”, a club’s application or a parent’s nomination of their club (section 5a), and, for people who asked for news, a short survey (section 5b).
It measures how the pages are used, first-party and without cookies (section 5c).

3. Visiting the website

When you open a page, your browser sends technical data that the server needs to deliver it. Our hosting provider records these requests in log files:

IP address
date and time of the request
the page or file requested and the HTTP status code
the referring page, if your browser sends it
browser type and operating system (user agent)

Purpose: to deliver the website, keep it stable and secure, and detect and stop attacks.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is a website that works and is secure.

Storage: we do not keep these logs ourselves. Our hosting provider stores them only as long as needed for these purposes and then deletes them according to its retention rules.

Hosting provider

The website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA, as our processor under a data processing agreement. We have chosen Frankfurt, Germany, as the region for our project. To deliver pages quickly, Vercel serves them through a worldwide network, so your request may be handled by the server closest to you, and data may be processed in the USA.

Vercel is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Article 45 GDPR). In addition, Vercel's data processing agreement includes the EU Standard Contractual Clauses (Article 46(2)(c) GDPR).

4. Contacting us by email

If you email us, we process your address, your name if you give it, your message and any information you include, so that we can answer.

Legal basis: Article 6(1)(b) GDPR if your message concerns a contract or steps before one; otherwise Article 6(1)(f) GDPR, our legitimate interest in answering enquiries.

Storage: we delete your messages once your enquiry is settled, unless the law requires us to keep them longer, for example for business correspondence under tax and commercial law.

Our email service provider processes these messages on our behalf as a processor.

5. Signing in, the waitlist and news (app.twinsports.ai)

Twin Sports is not open yet. At app.twinsports.ai you can sign in, tell us who you are and join the waitlist.

What we process

your e-mail address and that you confirmed it (the sign-in link)
if you sign in with Google or Facebook: the name, e-mail address and profile picture link the provider sends us, and an identifier of your account there
what you tell us: your name and whether you are interested for a club, as a player or as a parent; on the waitlist optionally your club, sport, function in the club and a message
whether you are on the waitlist and whether you agreed to news by e-mail, with the time, version and wording of the text you agreed to
the confirmation by e-mail (double opt-in): after you tell us your details we send you – however you signed in – an e-mail with a summary and a confirmation link. As proof we keep when we sent it and when you confirmed, with IP address and browser. Without confirmation we send you no news.
technical sign-in data (time, IP address, browser) in the logs of our database provider

Purposes and legal bases

Signing in and your details: steps before a contract you ask for, Article 6(1)(b) GDPR.
The waitlist and choosing pilot clubs: Article 6(1)(b) GDPR; for people representing a club also our legitimate interest in starting with suitable clubs, Article 6(1)(f).
News by e-mail: only with your consent, Article 6(1)(a) GDPR. You can withdraw it at any time on the waitlist page or with the link in every such e-mail; this does not affect what was sent before.
Proof of your confirmation and consent (double opt-in): our duty to demonstrate consent under Article 7(1) GDPR, Article 6(1)(c) and (f) GDPR.
Security and protection against abuse (logs): Article 6(1)(f) GDPR.

Cookies

The sign-in sets cookies that are strictly necessary to keep you signed in and to remember your language. They are not used for tracking, so no consent is needed (Section 25(2) TDDDG, Article 5(3) ePrivacy Directive). The website itself still sets none.

Service providers

Supabase Inc. (database and sign-in; your data is stored in Frankfurt, Germany), as our processor; for any access from outside the EU the EU Standard Contractual Clauses apply (Article 46(2)(c) GDPR).
Vercel Inc. (hosting of the app, region Frankfurt), as described in section 3.
Resend (sending our e-mails from the EU), as our processor, with the EU Standard Contractual Clauses.
Resend also sends us delivery, open and click information for our e-mails.
Venture Garden, operated by Emma Rocket Ltd. (Ема Рокет ООД), UIC 208636237, VAT BG208636237, ul. Kutlovitsa 41, entr. B, apt. 52A, 1505 Sofia, Bulgaria: the platform we run our campaigns and pilot clubs on. It receives the events in section 5c and, once you confirm, your waitlist entry. It is our processor under a data processing agreement. Its database is hosted in the EU (Frankfurt, Germany).
Google Ireland Ltd. and Meta Platforms Ireland Ltd., only if you choose to sign in with them; they process your sign-in under their own privacy policies.

How long we keep your details

Until you delete them or ask us to. If Twin Sports has not started for you, we delete waitlist details at the latest 24 months after your last activity. We keep proof of a consent as long as we may have to show it, for at most three years after it ended.

Deleting your data

On the waitlist page with "Delete all my details", or by e-mail to hello@twinsports.ai. We then also delete your sign-in account. This is also how you have data deleted that we received through signing in with Google or Facebook.

Children

Players sign up themselves from the age of 16; younger players are signed up by a parent or guardian.

5a. Applying to join on this website

Every page of this website has the “Apply to join” button. It opens a form with two ways in: a club applies, or a parent nominates their club. Both create an entry in the same list as at app.twinsports.ai (section 5), with the same double opt-in. What you type stays in your browser until you send it.

What we process

a club’s application, in two steps. Step 1: your e-mail address and your role at the club (youth director, board member, coach, treasurer or membership admin, data protection, or other). When you continue, nothing is saved yet: our server only records that step 1 was completed, as an event without your address (section 5c). Step 2: the club’s name; optionally its country and its number of youth teams (1–3, 4–8, 9–15, 16 or more, or “I don’t know”); your answer, up to 400 characters, to “What matters most to your club in youth football?”; and, optionally, your answer, up to 400 characters, to “How do you support players who aren’t the strongest in their age group?”. We ask you not to name any players in your answers. The whole application is sent and saved with step 2;
a parent’s nomination, in one step: your e-mail address, the name of your club and, optionally, its town or city. We never ask for your child’s name or anything else about your child;
for both: your confirmation that you have read this privacy policy, with the wording you saw; whether you agreed to news by e-mail, with the time, version and wording you agreed to;
the language of the page you applied on, which we use for our e-mails;
where the application or nomination came from: the page, the campaign parameters of the link you arrived by (UTM: source, medium, campaign, content, term), the referral code of the person whose link you used, and your own referral code;
as proof of your consent, as in section 5: time, IP address and browser.

To create your entry we set up a sign-in account for your address. It stays unconfirmed until you sign in yourself. Sent again before you confirm, an application or nomination replaces the earlier one.

Once you confirm your address, we pass your application or nomination to Venture Garden (see the service providers in section 5), where our team reviews applications: your e-mail address, the club’s name, your role, the country, the number of youth teams, the town or city, your answers, whether it is an application or a nomination, your own referral code and the one of the link you used, the page, the language, the campaign parameters, and when you confirmed and whether you agreed to news. Every application is reviewed by people on our team, not decided automatically.

Purposes and legal bases

Reviewing applications and recording nominations: as for the waitlist and choosing pilot clubs in section 5.
Attribution (which page, campaign and referral brought you): our legitimate interest in knowing which channels work, Article 6(1)(f) GDPR.

How long we keep it and how you delete it: as in section 5.

5b. The survey

If you confirmed news by e-mail, we may send you a short survey. Your answers are stored with your entry and deleted with it. Legal basis: your consent to news by e-mail, Article 6(1)(a) GDPR.

Every survey e-mail has a link to unsubscribe from news. Your entry stays.

5c. Measuring the campaign, without cookies

When you open a page, click a button or link, open or start the form, complete step 1 of a club’s application, share a link, book a call or start the survey, the page sends our own server an event. An event holds:

what happened (for example a page opened, a button clicked, the form started);
the page and its path;
the time it arrives;
the language;
the campaign parameters of the link you arrived by;
which version of the page you saw, when we test two versions;
the referral code of the link you arrived by and, once you have signed up, your own referral code;
which button or link was clicked and where on the page; when you share, which link and which channel.

No cookies are set. No name or address is in these events.

Before our server passes events to Venture Garden (see the service providers in section 5), it cuts each one down to a fixed set: what happened, the page, the time, the language and the campaign parameters; for confirming your address and finishing the survey also an id that contains your own referral code, so that each counts only once. The path, the version of the page, where you clicked and the referral code of the link you arrived by are not passed on. Opening and starting the form are not passed on at all.

This website keeps the following in your browser tab's session storage, which is deleted when you close the tab:

the campaign parameters and the referral code of the link you arrived by, so that the form can carry them.

There is no id for your visit: the events are not linked to one another or to you.

For our e-mails, our e-mail provider tells us whether an e-mail was delivered, opened or a link in it clicked.

If your browser sends “Do Not Track” or “Global Privacy Control”, the pages send no such events at all.

Legal basis: our legitimate interest in knowing which pages and e-mails work, Article 6(1)(f) GDPR.

6. Your rights

You have the right to:

access the data we hold about you (Article 15 GDPR)
have incorrect data corrected (Article 16)
have your data erased (Article 17)
restrict processing (Article 18)
receive your data in a portable format (Article 20)
object at any time to processing based on our legitimate interests, on grounds relating to your particular situation (Article 21)

To use these rights, write to hello@twinsports.ai.

You can also complain to a supervisory authority, in particular in the EU country where you live or work, or where you believe the infringement took place (Article 77 GDPR). The authority responsible for us is:

Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia, Bulgaria
www.cpdp.bg

7. Automated decisions

We do not make automated decisions or create profiles through this website.

8. Changes to this policy

We update this policy when the website or the law changes. The current version is always on this page.