Effective 28 July 2026 (previously 26 July 2026 — section 8 now also covers repeat-visit counting and shared score links, and section 2 now describes the optional email address the free tools ask for) · FullPanel (fullpanel.net), operated by Niall O'Neill, Ireland · support@fullpanel.net
Club member data (players, parents/guardians). When a club uses FullPanel to manage its members — names, dates of birth, guardian contact details, team assignments, schedules, RSVPs, plans, messages and membership payments — the club is the data controller and FullPanel is its data processor under the Data Processing Agreement. If you are a player or parent and want to exercise your data rights over club records, your club is the right first contact (usually the secretary or registrar); we give clubs the tools to answer you and we assist them when asked.
Account data. When you create a FullPanel account of any kind — as club staff, an invited parent/player, or a guest using the free scoreboard — FullPanel is the data controller for that account: your name, email address, sign-in records and notification preferences.
| Data | Purpose | Legal basis |
|---|---|---|
| Account details (name, email, sign-in events) | Creating and securing your account; linking you to your club when it invites your email | Contract |
| How your account started and when it was last used | Against your own account we record which of our own buttons you signed up from (chosen from a fixed list such as “pricing” or “team sheet”), what you said you were signing up to do, and the date you last opened the app — one date, overwritten each time, plus which part of the product it was. We use it to see where new clubs and coaches get stuck in setup and to offer help to accounts that never got going. It is not a browsing history: no page-by-page record is kept, nothing is stored about visits made before you had an account, and it is never used for advertising | Legitimate interest — improving sign-up and supporting new accounts |
| Club member records (name, date of birth, codes, registration number, guardian contact) | Squad management, age grading, safeguarding and club communication — on the club's instructions | Processed for the club (controller); the club's basis is typically its membership contract and legal duties |
| Vetting register (status, expiry, reference number only) | The club's child-safeguarding duties. We never hold the content of a Garda vetting disclosure | Processed for the club |
| Payment records (fees due/paid, method) | Membership and fundraising collection. Card details go directly to Stripe — we never see them | Contract / processed for the club |
| Messages, schedules, RSVPs, coaching plans | Running the club's teams and communicating with members | Processed for the club |
| Free-tool contact details (email address, and the role and team name if you enter them) | If you choose to give your email address in one of the free tools — the scoreboard, the matchday board, the team-sheet generator or the session planner — we store it, along with which tool you gave it in. Two of those tools use it immediately to email you the thing you just made. Giving it is always optional and every tool works fully without it. We never sell it, and we never share it with anyone. We only send you FullPanel updates if you ticked the separate opt-in box, which is never pre-ticked: leaving it alone is not consent and never signs you up. Every marketing email we send carries a one-click unsubscribe link, and you can remove yourself at any time at fullpanel.net/unsubscribe or by emailing support@fullpanel.net — whichever you use, we stop sending and set a permanent block, so no future form on the site can re-subscribe you by accident | Legitimate interest to hold the address for the tool you asked for; consent (a separate, unticked opt-in) for any marketing email |
| Push-notification subscription | Sending you the notifications you switch on | Consent (opt-in, revocable in Account) |
| Assistant & AI-draft prompts | Answering staff questions in-app and drafting plans for a coach to edit | Legitimate interest; don't include personal data you wouldn't put in a plan |
| Scoreboard scores | Stored in your browser only (localStorage) — never transmitted to us. If you tap Share score, the team names and score are packed into the link you send, after the #. That part of a web address is never sent to any server by design, so the score travels from your phone to whoever you sent it to and reaches us at no point — but treat a shared link like any other message: anyone holding it can read the score in it | n/a — never leaves your device except in a link you choose to send |
| Anonymous usage counts | Knowing which free tools, guides and shared links are actually used, and whether anyone comes back, so we build the right things. We keep a running daily total per event type (for example “the board was opened 40 times today”, “12 of those had used it before”) and nothing else — no visitor identifier, IP address, user agent, referrer or cookie is stored, so a count cannot be traced to a person. To tell a repeat visit from a first one, each tool keeps the date you last used it in your own browser — a date, never an id, never sent to us. Detail in section 8 | Legitimate interest — aggregate statistics from which no individual can be identified |
FullPanel is built for clubs whose members include children, and the access rules are fixed, not configurable: under-16s can never log in — only a parent/guardian holds portal access for them; 16–17-year-olds may hold their own login only where the club records guardian consent at invite time; access to children's records inside a club is role-restricted so a coach sees only their own teams, and FullPanel's own support staff are structurally blocked from children's personal data. We collect no more about a child than squad management needs, and never medical data.
Club and member data is stored with Supabase in Ireland (EU), encrypted in transit and at rest, with row-level security so each club can only ever see its own data. We use a small set of sub-processors:
| Provider | Role | Location / transfers |
|---|---|---|
| Supabase | Database & storage | EU (Ireland) |
| Vercel | Application hosting | EU/US — EU SCCs / Data Privacy Framework |
| Clerk | Sign-in & account security | US — EU SCCs / Data Privacy Framework |
| Stripe | Payments (holds card details; we never see them) | EU/US — Stripe's own GDPR programme |
| Resend | Transactional email delivery | US — EU SCCs |
| Anthropic | In-app assistant & AI plan drafting (prompt text only; not used to train models) | US — EU SCCs |
Account data is kept while your account is active and deleted on request. Club member records are kept for as long as the club instructs — clubs can delete a member at any time (Members tab), and payment records may be retained where the club has legal (e.g. financial-records) obligations. The audit trail of administrative actions is kept as safeguarding and GDPR evidence and is not deletable from the app. An email address given in a free tool is kept until you ask us to remove it; a session plan we store so we can email it to you is disposable and purged within days of being sent.
Under GDPR you can ask for access to your data, correction, erasure, portability, or object to processing. For club records, ask your club — its admins can export everything held on a member (Admin ▸ Data & GDPR ▸ Member data export) and delete records; we assist the club with anything they can't self-serve. For your FullPanel account itself, email support@fullpanel.net. If you're not happy with our answer you can complain to the Irish Data Protection Commission (dataprotection.ie).
Encryption in transit and at rest, per-user sign-in, database-enforced role restrictions (not just hidden buttons), and a server-side audit log of administrative actions. If a breach affecting personal data occurs we will notify affected clubs without undue delay — and in any case within 72 hours of becoming aware — so controllers can meet their own obligations.
We use only the cookies needed to keep you signed in (set by Clerk, our sign-in provider). No advertising or cross-site tracking cookies, no analytics identifiers sold or shared.
We use no third-party analytics service — no Google Analytics, no Meta pixel, no Hotjar, no session recording, nothing of that kind, on any page. Instead we keep our own counters in our own database (Supabase, Ireland). For each day we add one to a number held against an event type — for example “free board opened”, “guide viewed”, “shared tactic link opened”. That total is the entire record: we do not store or work out a visitor identifier, IP address, user agent, referrer, device fingerprint or profile, so these figures are volumes only. They cannot be linked to you, joined into a journey, or followed from one page or site to another — by us or by anyone else. Where a count relates to a shared tactic or team-sheet link it counts openings of that link, never who opened it. The free tools set a single on/off flag in your browser's session storage so one visit isn't counted twice; it holds no identifier and disappears when you close the tab. No cookie is involved in measurement, no new sub-processor is involved, and none of it is shared with or sold to anyone.
Telling a first visit from a return. Each free tool also keeps one small note in your browser's local storage: the date you last used that tool, and nothing else. Next time you open it we compare that date with today, add one to either “opened” or “opened again”, and overwrite the date. It is how we can tell whether anyone comes back, which is the difference between a tool worth building on and one nobody needed.
A date is not an identifier: every browser that used the team sheet yesterday holds the very same text. Nothing about the note is ever sent to us — it decides only which of two counters gets a +1, and what reaches us is still an event name added to a daily total, with nowhere in it for a person. The note is kept per tool, so it cannot show that the same browser used two of them; it is not a cookie and is never sent to any other site; and it is discarded after 180 days. Because it lives in the browser, these are counts of browsers coming back and never of people: a shared family tablet counts as one, and your phone and your laptop count as two. Clearing your browser data removes it, and the tools work exactly the same afterwards.
Signed-in accounts are a separate, smaller record — and the two are never joined. Once you have an account we keep, against that account: which of our own buttons you signed up from (a fixed list of our own labels, never a web address or a referrer), what you told us you were signing up to do, and the date you last opened the app together with which part of it. The last-used date is written at most once per browser session and overwritten, so it answers “has this account been back this month” and cannot answer “what did they look at on Tuesday” — there is no history table behind it. The anonymous counters described above hold nothing that could identify you, which also means we cannot connect a visit you made before signing up to the account you later created; we do not attempt to, and the design makes it impossible rather than merely against policy. None of this is shared with anyone, sold, or used for advertising, and you can ask us to delete it with your account (section 6).
If we make material changes to this policy we'll update this page and note the new effective date; clubs are notified of sub-processor changes under the DPA.