Gianjass Privacy Policy

1. Data controller and contact details

The data controller for the Gianjass project is Gianfranco Giannotta, Mergozzo (VB), Italy.

For privacy, rights and security: gianfranco.giannotta1@gmail.com or +39 351 773 4848. No data protection officer (DPO) has been appointed.

2. Data processed

Depending on the role and the features actually enabled, we may process:

• name, email address, role, date of birth and technical data required for authentication and security;
• football and school profile, activities, progress, XP, goals and voluntary check-ins;
• parent–child links, safeguarding requests, consent records and versions of accepted documents;
• clubs, teams, staff roles, calendar, communications, documents and private files when Club Hub is enabled;
• questions voluntarily submitted to AI, subject, derived age range, level, moderation outcome and minimal metadata; Gianjass does not save the text of the question or answer in its own database;
• orders, amounts, payment status and refunds when sales are enabled; full card details remain with the payment provider;
• security logs, audits and reports needed to prevent abuse and protect users.

The app does not request location, microphone or camera access. It uses neither advertising SDKs nor advertising identifiers in the code verified for this Beta.

3. Purposes and legal bases

• Providing requested accounts and features: performance of the service and steps taken before entering into a contract.
• Safeguarding minors, security and abuse prevention: legal obligations and legitimate interests in providing a safe environment.
• Payments and records: performance of a contract and accounting or legal obligations, only when sales are active.
• Optional features or media publication: specific, revocable consent when required.
• Support and protection of rights: performance of the service, legitimate interests and legal obligations.

A parent’s authorisation of a minor’s account is separate from each optional privacy consent.

4. Providers and disclosures

For enabled features, we use the providers listed in the current version. Supabase may manage authentication, databases and private files; OpenAI will be used only when AI for adults is active; Stripe only when payments are enabled; and Google Play only when Android distribution begins.

When the AI feature for adults is active, OpenAI will receive the content entered by the adult and the minimal data described above. Requests will be sent with store:false; this is not the same as Zero Data Retention, and the provider’s abuse-monitoring logs may be kept for up to 30 days unless a different approved agreement applies. Data will not be used to train models by default, unless the OpenAI account holder provides separate consent. While the service is inactive, no content is sent to AI; if enabled, it will remain disabled for minors.

Some providers may process data outside the European Economic Area. Before enabling a feature in production, we verify the contract, region and applicable safeguard, such as an adequacy decision or standard contractual clauses.

5. Retention and deletion

Profile data is retained while the account is active and for the time strictly necessary to handle outstanding requests, security needs and applicable obligations. On deletion, access is suspended, links and consents are revoked, and some data is deleted or made no longer attributable to the user.

Proof of acceptance, pseudonymised audit data and essential accounting information may be retained for the period required by law or needed to protect rights. Providers and backups follow separate technical deletion cycles. We do not promise immediate deletion from backups.

Full instructions are available on the Account deletion page.

6. Your rights

You may request access, rectification, erasure, restriction, portability and object to processing; you may withdraw consent without affecting processing carried out beforehand. You may also lodge a complaint with the Italian Data Protection Authority.

Write to gianfranco.giannotta1@gmail.com. We may ask for proportionate identity verification, without requesting passwords or access codes by email.

7. AI and automated decisions

When AI is active, it may make mistakes and will not replace parents, teachers, coaches, doctors or other professionals. Gianjass will not use it for decisions with legal or similarly significant effects concerning the selection, discipline or worth of a child.

When the feature is available, you will be able to report an answer through the app tools or support. The report will retain the category and necessary metadata, not the full text of the answer in the Gianjass database.