The application runs on Netlify, a US-based platform providing a global CDN and serverless functions. The database runs on Supabase (PostgreSQL hosted on AWS us-east-1). All connections use TLS 1.2 or higher.

• Hosting. Netlify edge network with automatic HTTPS, DDoS mitigation, and atomic deploys.
• Database. Supabase (PostgreSQL on AWS), with automatic daily backups and point-in-time recovery.
• Transport. TLS 1.2+ enforced on every connection between clients, application servers, and the database.
• Serverless. API routes execute in isolated serverless functions, reducing the attack surface of the runtime environment.

• Encryption at rest. All data stored in Supabase is encrypted with AES-256 via AWS managed keys.
• Encryption in transit. TLS secures all data moving between the browser, our servers, and the database.
• Client briefs. Stored in Supabase with row-level security (RLS) policies. Each client can only query their own records.
• Report PDFs. Generated reports are stored encrypted and accessible only to the purchasing account.
• Secrets management. API keys and credentials are stored in environment variables managed by Netlify, never committed to source code.

• Authentication. Handled by Supabase Auth with support for email/password and OAuth providers.
• Authorization. Role-based access control enforced at the database level through Supabase RLS policies.
• Production access. No employee has direct database access in production without an audit trail.
• Session management. JWT-based sessions with automatic expiry and refresh token rotation.

All payments are processed by Stripe. Football Analytics AI never stores, processes, or has access to card numbers or payment credentials. Stripe is PCI DSS Level 1 certified, the highest level of payment industry security.

• GDPR. We handle personal data in compliance with the General Data Protection Regulation.
• DPA. A Data Processing Agreement is available on request for enterprise clients.
• No data sales. We do not sell, rent, or share client data with third parties for their own purposes.
• Cookies. Analytics cookies require explicit user consent before activation.
• Data subject rights. EU data subjects can exercise access, rectification, erasure, portability, and objection rights per the privacy policy.

• GDPR. Data collection, processing, and retention practices follow GDPR requirements.
• Subprocessors. We use Supabase (database), Netlify (hosting), Stripe (payments), and Anthropic (AI). Each maintains its own compliance certifications.

• Client data. Retained for 3 years after the last active session, or until deletion is requested.
• Report PDFs. Retained for 1 year after delivery, then permanently deleted.
• Deletion requests. Processed within 30 days. Contact us at the address below to request deletion.

Football Analytics AI, Inc., registered in Dover, Delaware, USA.