BaseFlow Privacy Policy

Last Updated: September 2026 Document Version: 1.1

BaseFlow ("we", "our", or "us") is committed to protecting your personal data in compliance with applicable data protection laws, including Singapore's Personal Data Protection Act (PDPA).

This Privacy Policy explains how we collect, use, disclose, and retain your information when you use BaseFlow.

1. Information We Collect

Personal Data: Name, email address, phone number, profile pictures, and authentication IDs.
Player Performance & Biometrics: Weight/biometric progression entries, jersey numbers, positional preferences, and match performance statistics.
User Content: Payment proof screenshots, team photos, and match event timestamps.
Placeholder Information: Name and optional email added by club captains for unregistered teammates.
Session Guests: A captain-entered name for drop-in players at Club Hub sessions. We do not collect a guest phone number. A guest (or the club, acting on their request) may ask us to remove that name; session statistics and payment lines are retained in de-identified form so other players' records stay intact.

2. How We Use Your Information

To operate the Platform, deliver Player Passport career profiles, and manage squad rosters.
To process subscription billing via third-party processors (Stripe).
To send operational notifications, match RSVP reminders, and account verification updates via push notifications or email.

3. Information Disclosure & Sharing

BaseFlow does not sell your personal data. We disclose data only to trusted service providers who assist us in operating the platform:

Database & Storage: Supabase
Subscription Billing: Stripe
Email & Notifications: Resend and OneSignal
Media Processing: Cloudflare / Edge Storage

4. Data Retention & Automatic Purging Schedules

To ensure PDPA compliance and data minimization, we enforce strict retention schedules:

Payment Screenshots: Automatically deleted 30 days after approval or rejection.
Inactive Placeholder Profiles: Permanently anonymized (ANON-XXXX) after 24 months of total club inactivity.
Session Guest Names: Overwritten on request (ANON-XXXX). We do not hard-delete a guest record, because it is referenced by other players' session stats and payment lines.
Registered Accounts: Active registered accounts and verified league records remain intact until an explicit account deletion request is submitted by the user. A guest who has claimed their stats into an account follows this registered-account path.

5. Your Rights & Account Deletion

You have the right to request access to, correction of, or deletion of your personal data. You may delete your account at any time via Account Settings or by contacting support.

To remove a session-guest name without deleting related stats, contact the club captain or legal@baseflowapp.com. We overwrite the name on request as described in §1 and §4.

6. Contact Us

For data privacy inquiries or to exercise your rights, contact us at legal@baseflowapp.com.