Effective 16 October 2026 (previously 28 July 2026 — you can now download or delete your own data yourself, and sections 2, 4, 5 and 8 now describe optional marketing email sent through Brevo) · FullPanel (fullpanel.net), operated by Niall O'Neill, Ireland · support@fullpanel.net
Club member data (players, parents/guardians). When a club uses FullPanel to manage its members — names, dates of birth, guardian contact details, team assignments, schedules, RSVPs, plans, messages and membership payments — the club is the data controller and FullPanel is its data processor under the Data Processing Agreement. If you are a player or parent and want to exercise your data rights over club records, your club is the right first contact (usually the secretary or registrar); we give clubs the tools to answer you and we assist them when asked.
Account data. When you create a FullPanel account of any kind — as club staff, an invited parent/player, or a guest using the free scoreboard — FullPanel is the data controller for that account: your name, email address, sign-in records and notification preferences.
| Data | Purpose | Legal basis |
|---|---|---|
| Account details (name, email, sign-in events) | Creating and securing your account; linking you to your club when it invites your email | Contract |
| How your account started and when it was last used | Against your own account we record which of our own buttons you signed up from (chosen from a fixed list such as “pricing” or “team sheet”), the short campaign label on the link you first arrived by if it had one (a label we write into our own links, such as “oct_whatsapp_push”, the same for everyone who used that link), what you said you were signing up to do, and the date you last opened the app — one date, overwritten each time, plus which part of the product it was. We use it to see where new clubs and coaches get stuck in setup and to offer help to accounts that never got going. It is not a browsing history: no page-by-page record is kept, nothing is stored about visits made before you had an account, and it is never used for advertising | Legitimate interest — improving sign-up and supporting new accounts |
| Club member records (name, date of birth, codes, registration number, guardian contact) | Squad management, age grading, safeguarding and club communication — on the club's instructions | Processed for the club (controller); the club's basis is typically its membership contract and legal duties |
| Vetting register (status, expiry, reference number only) | The club's child-safeguarding duties. We never hold the content of a Garda vetting disclosure | Processed for the club |
| Payment records (fees due/paid, method) | Membership and fundraising collection. Card details go directly to Stripe — we never see them | Contract / processed for the club |
| Messages, schedules, RSVPs, coaching plans | Running the club's teams and communicating with members | Processed for the club |
| Free-tool contact details (email address, and the role and team name if you enter them) | If you choose to give your email address in one of the free tools — the scoreboard, the matchday board, the team-sheet generator or the session planner — we store it, along with which tool you gave it in. Two of those tools use it immediately to email you the thing you just made. Giving it is always optional and every tool works fully without it. We never sell it, and we never share it with anyone. We only send you FullPanel updates if you ticked the separate opt-in box, which is never pre-ticked, and then confirmed it from a one-time email we send to that address: leaving it alone is not consent and never signs you up. Every marketing email we send carries a one-click unsubscribe link, and you can remove yourself at any time at fullpanel.net/unsubscribe or by emailing support@fullpanel.net — whichever you use, we stop sending and set a permanent block, so no future form on the site can re-subscribe you by accident | Legitimate interest to hold the address for the tool you asked for; consent (a separate, unticked opt-in) for any marketing email |
| Marketing email (only if you opt in) | Your name and email address, the date you agreed, the exact wording you agreed to and where you ticked it. Our email provider, Brevo, records whether each email was delivered, opened, which links were clicked, whether it bounced and whether it led you to unsubscribe. Used to send you occasional FullPanel tips and offers and to learn which of them are useful | Consent — a separate box that is never pre-ticked, which also covers the open and click tracking; withdraw at any time with the link in every email, at fullpanel.net/unsubscribe, or by emailing support |
| Club contact details we found ourselves (business outreach) | We may email a GAA club once or a few times to introduce FullPanel, using a contact name and email address the club or the GAA published for club enquiries on their website (for example a club secretary's or chairperson's contact on the club's contact page). We hold the address, the name if one was published, the club and role, where we found it, and whether each email was delivered, which links in it were clicked and whether you unsubscribed. We do not track whether these emails are opened. Every email names who it is from and has a one-click unsubscribe; once you unsubscribe or ask us to stop, we never contact that address again. If you don't reply, we delete the address 12 months after our last email | Legitimate interest — telling clubs about a club-management service, using contact details published for club business. You can object at any time, and we stop |
| Push-notification subscription | Sending you the notifications you switch on | Consent (opt-in, revocable in Account) |
| Assistant & AI-draft prompts | Answering staff questions in-app and drafting plans for a coach to edit | Legitimate interest; don't include personal data you wouldn't put in a plan |
| Scoreboard scores | Stored in your browser only (localStorage) — never transmitted to us. If you tap Share score, the team names and score are packed into the link you send, after the #. That part of a web address is never sent to any server by design, so the score travels from your phone to whoever you sent it to and reaches us at no point — but treat a shared link like any other message: anyone holding it can read the score in it | n/a — never leaves your device except in a link you choose to send |
| Anonymous usage counts | Knowing which free tools, guides and shared links are actually used, and whether anyone comes back, so we build the right things. We keep a running daily total per event type (for example “the board was opened 40 times today”, “12 of those had used it before”) and nothing else — no visitor identifier, IP address, user agent, referrer or cookie is stored, so a count cannot be traced to a person. To tell a repeat visit from a first one, each tool keeps the date you last used it in your own browser — a date, never an id, never sent to us. Detail in section 8 | Legitimate interest — aggregate statistics from which no individual can be identified |
FullPanel is built for clubs whose members include children, and the access rules are fixed, not configurable: under-16s can never log in — only a parent/guardian holds portal access for them; 16–17-year-olds may hold their own login only where the club records guardian consent at invite time; access to children's records inside a club is role-restricted so a coach sees only their own teams, and FullPanel's own support staff are structurally blocked from children's personal data. We collect no more about a child than squad management needs, and never medical data.
Club and member data is stored with Supabase in Ireland (EU), encrypted in transit and at rest, with row-level security so each club can only ever see its own data. We use a small set of sub-processors:
| Provider | Role | Location / transfers |
|---|---|---|
| Supabase | Database & storage | EU (Ireland) |
| Vercel | Application hosting | EU/US — EU SCCs / Data Privacy Framework |
| Clerk | Sign-in & account security | US — EU SCCs / Data Privacy Framework |
| Stripe | Payments (holds card details; we never see them) | EU/US — Stripe's own GDPR programme |
| Resend | Transactional email delivery | US — EU SCCs |
| Brevo (Sendinblue SAS) | Marketing email, only to people who opted in; never club member data | France (EU); some data may be transferred to the US and India under appropriate safeguards (Brevo's data processing agreement) |
| Anthropic | In-app assistant & AI plan drafting (prompt text only; not used to train models) | US — EU SCCs |
Account data is kept while your account is active. You can delete your account yourself (account menu ▸ Delete my account): your sign-in is switched off straight away, and after 14 days, during which we email you a link to cancel, your account, your details and your own coach team spaces are permanently deleted. Records you added to a club stay with the club with your name removed, and payment records are kept where the law requires. We keep a one-way scrambled copy of your email address as a record that the deletion happened, and nothing else. Club member records are kept for as long as the club instructs — clubs can delete a member at any time (Members tab), and payment records may be retained where the club has legal (e.g. financial-records) obligations. The audit trail of administrative actions is kept as safeguarding and GDPR evidence and is not deletable from the app. If you opt in to marketing email, your address stays on our list until you unsubscribe or delete your account; when you unsubscribe we remove you from the list and keep a note that you withdrew, so we never add you again by mistake. An email address given in a free tool is kept until you ask us to remove it (fullpanel.net/forget); a session plan we store so we can email it to you is disposable and purged within days of being sent.
Under GDPR you can ask for access to your data, correction, erasure, portability, or object to processing. For club records, ask your club — its admins can export everything held on a member (Admin ▸ Data & GDPR ▸ Member data export) and delete records; we assist the club with anything they can't self-serve. For your FullPanel account itself, you can download a copy of your data (Download my data) or delete it yourself (Delete my account) from your account menu, or email support@fullpanel.net for anything else. If you gave us an email address in a free tool but have no account, you can have it deleted at fullpanel.net/forget: we email that address a link, and nothing is deleted until it is used. If you're not happy with our answer you can complain to the Irish Data Protection Commission (dataprotection.ie).
Encryption in transit and at rest, per-user sign-in, database-enforced role restrictions (not just hidden buttons), and a server-side audit log of administrative actions. If a breach affecting personal data occurs we will notify affected clubs without undue delay — and in any case within 72 hours of becoming aware — so controllers can meet their own obligations.
We use only the cookies needed to keep you signed in (set by Clerk, our sign-in provider). No advertising or cross-site tracking cookies, no analytics identifiers sold or shared.
We use no third-party analytics service — no Google Analytics, no Meta pixel, no Hotjar, no session recording, nothing of that kind, on any page. Instead we keep our own counters in our own database (Supabase, Ireland). For each day we add one to a number held against an event type — for example “free board opened”, “guide viewed”, “shared tactic link opened”. That total is the entire record: we do not store or work out a visitor identifier, IP address, user agent, referrer, device fingerprint or profile, so these figures are volumes only. They cannot be linked to you, joined into a journey, or followed from one page or site to another — by us or by anyone else. Where a count relates to a shared tactic or team-sheet link it counts openings of that link, never who opened it. The free tools set a single on/off flag in your browser's session storage so one visit isn't counted twice; it holds no identifier and disappears when you close the tab. No cookie is involved in measurement, no new sub-processor is involved, and none of it is shared with or sold to anyone.
Telling a first visit from a return. Each free tool also keeps one small note in your browser's local storage: the date you last used that tool, and nothing else. Next time you open it we compare that date with today, add one to either “opened” or “opened again”, and overwrite the date. It is how we can tell whether anyone comes back, which is the difference between a tool worth building on and one nobody needed.
A date is not an identifier: every browser that used the team sheet yesterday holds the very same text. Nothing about the note is ever sent to us — it decides only which of two counters gets a +1, and what reaches us is still an event name added to a daily total, with nowhere in it for a person. The note is kept per tool, so it cannot show that the same browser used two of them; it is not a cookie and is never sent to any other site; and it is discarded after 180 days. Because it lives in the browser, these are counts of browsers coming back and never of people: a shared family tablet counts as one, and your phone and your laptop count as two. Clearing your browser data removes it, and the tools work exactly the same afterwards.
Signed-in accounts are a separate, smaller record — and the two are never joined. Once you have an account we keep, against that account: which of our own buttons you signed up from (a fixed list of our own labels, never a web address or a referrer), what you told us you were signing up to do, and the date you last opened the app together with which part of it. The last-used date is written at most once per browser session and overwritten, so it answers “has this account been back this month” and cannot answer “what did they look at on Tuesday” — there is no history table behind it. The anonymous counters described above hold nothing that could identify you, which also means we cannot connect a visit you made before signing up to the account you later created; we do not attempt to, and the design makes it impossible rather than merely against policy. None of this is shared with anyone, sold, or used for advertising, and you can ask us to delete it with your account (section 6).
Email. Our marketing emails are sent through Brevo. If you opted in to our updates, Brevo adds a tiny image and tracked links to each one, so we can see whether an email was opened and which links were clicked; you agreed to this when you ticked the box, and it stops when you unsubscribe. Introduction emails to club contacts who have not opted in (see section 2) use tracked links only, so we see clicks but never opens. None of this applies to the website itself. Links in our emails carry a short label (for example email_campaign or outreach_email) that is the same for every recipient, so we can count sign-ups per campaign.
If we make material changes to this policy we'll update this page and note the new effective date; clubs are notified of sub-processor changes under the DPA.