Privacy Policy

The data controller responsible for your personal data is:

We collect the following personal data when you use SquadWeft:

We process your personal data on the following legal bases:

• Contract performance — processing necessary to provide the SquadWeft service you signed up for
• Legitimate interests — improving our platform, preventing fraud, and ensuring security
• Consent — for optional communications such as email notifications (you can withdraw consent at any time)
• Legal obligation — where required by applicable law

• To create and manage your account
• To display your profile to other users on the platform
• To facilitate squad creation, applications, and team collaboration
• To send transactional emails (welcome, application updates, notifications)
• To ensure the security and integrity of our platform
• To comply with legal obligations

We do not sell your personal data to third parties. We do not use your data for advertising purposes.

We share your data only with the following trusted service providers who process data on our behalf:

• Resend — email delivery service. Only your email address and name are shared for the purpose of sending transactional emails.
• Railway / Cloud hosting provider — infrastructure hosting. Your data is stored on servers located in the European Union.

All service providers are contractually bound to process your data only as instructed and in compliance with GDPR.

We retain your personal data for as long as your account is active. If you delete your account:

• Your profile, squads, applications, and posts are permanently deleted within 30 days
• Server logs containing technical data are retained for up to 2 years for security purposes
• Backups containing your data are deleted within 90 days

As a data subject under GDPR, you have the following rights:

• Right of access — request a copy of all personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your personal data ("right to be forgotten")
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to restrict processing — request that we limit how we use your data

To exercise any of these rights, contact us at support@squadweft.com. We will respond within 30 days.

You also have the right to lodge a complaint with the French data protection authority: CNIL (cnil.fr).

SquadWeft uses browser local storage to store your authentication token (JWT) to keep you logged in between sessions. This is technically necessary for the service to function.

We do not currently use tracking cookies or third-party analytics cookies. If this changes, this policy will be updated and you will be informed.

We implement appropriate technical and organizational measures to protect your personal data:

• Passwords are hashed using bcrypt with a minimum of 12 rounds
• All data transmission is encrypted via HTTPS/TLS
• Database access is restricted and authenticated
• Regular security reviews and dependency updates

SquadWeft is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at support@squadweft.com and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by displaying a prominent notice on our platform. The "Last updated" date at the top of this page indicates when the policy was last revised.

For any questions about this Privacy Policy or to exercise your rights, contact us at: