Last updated: 23 July 2026
The Directors' Box ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal data when you use The Directors' Box platform ("the Service"). We comply with the UK GDPR and the Data Protection Act 2018.
Account data: Your name, email address, and football club name when you register.
Club data: Information you enter about your club, including player records (names, dates of birth, contract details, wages), financial transactions, match data, sponsor details, committee member information, and scouting reports.
Payment data: Subscription payments are processed by Stripe. We do not store your card details - Stripe handles all payment information securely.
Usage data: Information about how you interact with the Service, such as login times and features used, collected automatically.
We use your data to: (a) provide and maintain the Service; (b) process subscription payments; (c) communicate with you about your account; (d) provide AI-generated insights based on your club data; and (e) improve and develop the Service. We do not sell your personal data to third parties.
We process your personal data under the following legal bases: (a) contract - to provide the Service you have subscribed to; (b) legal obligation - to comply with applicable laws; and (c) legitimate interests - to improve and secure the Service, where these do not override your rights.
Your data is stored on secure cloud servers. We use encryption in transit (TLS) and at rest. Access to your data is restricted to authorised personnel and is controlled by row-level security, meaning your club's data is only visible to users within your account. Payment information is handled entirely by Stripe and is never stored on our servers.
The Service includes AI-powered features that analyse your club data to generate strategic insights, reports, and recommendations. Your data is sent to third-party AI providers (such as language model APIs) solely for the purpose of generating these insights. We do not permit these providers to use your data for training their models.
We retain your data for as long as your account is active. If you cancel your subscription, your data is retained for 30 days to allow for export or reactivation, after which it is permanently deleted. You may request earlier deletion at any time.
Under UK GDPR, you have the right to: (a) access your personal data; (b) correct inaccurate data; (c) erase your data ("right to be forgotten"); (d) restrict or object to processing; (e) data portability; and (f) withdraw consent where processing is based on consent. To exercise these rights, contact us through the Service.
You may enter personal data about third parties (e.g. players, committee members, sponsors). You are responsible for ensuring you have a lawful basis to process and store this data, including obtaining necessary consents. We act as a data processor for this information, and you act as the data controller.
The Service uses essential cookies to function correctly (e.g. maintaining your login session). We do not use advertising or tracking cookies. Analytics cookies, if used, are used solely to understand and improve Service performance.
Your data may be processed on servers located outside the UK/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses, to protect your data in accordance with UK GDPR.
We may update this Privacy Policy from time to time. We will notify you of significant changes via email or within the Service. Continued use after changes take effect constitutes acceptance of the revised policy.
If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us through the support channels provided within the Service.