Legal & Policies

Agenoz ("Agenoz", "we", "us" or "our") is a multi-tenant CRM platform for sports agencies and agents. This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website or use our services.

Agenoz is currently operated as an independent personal project and not as a registered company. For any privacy-related matter, including how your personal data is handled, you can contact us at support@agenoz.com.

We collect the following categories of personal data:

• Account data: name, email address, password (stored encrypted), profile photo and language preferences, provided when you register or sign in (including via Google).
• Workspace and CRM content: information you and your team add to the platform, such as players, contacts, clubs, deals, documents, calendar events, tasks, comments and notes.
• Billing data: subscription plan, seat count and billing history. Card and payment details are collected and processed directly by Stripe; Agenoz never stores full card numbers.
• Technical and usage data: IP address, device and browser type, log data, and information about how you interact with the platform, used for security, debugging and service improvement.
• Communications: messages you send us (for example support requests) and email-delivery metadata.

Agenoz is a tool that lets you manage information about athletes, contacts and other individuals ("CRM Data"). With respect to that data, you (or the agency you belong to) act as the data controller and Agenoz acts as a data processor, processing it solely on your instructions to provide the service.

You are responsible for having a valid legal basis (such as a contract, consent or legitimate interest) to upload and process the personal data of these individuals, and for informing them about such processing where required by law.

We process personal data for the following purposes and under the following legal bases of the GDPR:

• To provide and operate the platform and your account — performance of a contract (Art. 6.1.b).
• To process subscriptions, payments and invoicing — performance of a contract and legal obligation (Art. 6.1.b and 6.1.c).
• To send service-related and transactional emails (verification, invitations, notifications, security alerts) — performance of a contract.
• To keep the service secure, prevent fraud and abuse, and debug issues — legitimate interest (Art. 6.1.f).
• To improve our features and understand product usage — legitimate interest.
• To send commercial communications, where applicable — your consent (Art. 6.1.a), which you may withdraw at any time.

We do not sell your personal data. We share data only with the providers strictly necessary to run the service, acting as our processors under appropriate agreements:

• Google Firebase (Google Ireland/LLC): authentication, database, file storage and hosting infrastructure.
• Vercel: application hosting and content delivery.
• Stripe: payment processing and subscription billing.
• Resend: delivery of transactional emails.
• API-Football: retrieval of public club and competition data (no personal data of yours is sent to this provider).
• Competent authorities, where we are legally required to disclose information.

Some of our providers may process data outside the European Economic Area. Where this happens, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision, ensuring a level of protection equivalent to that of the EU.

We keep personal data for as long as your account is active and as needed to provide the service. When you delete your account, it is first soft-deleted and access is disabled, and your data is retained for a grace period (at least 30 days, and not less than any paid period already invoiced) so that you can reactivate it.

After the grace period your account is permanently purged. We may retain certain information for longer where required to comply with legal, accounting or tax obligations, or to resolve disputes and enforce our agreements.

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict or object to certain processing.
• Data portability — receive your data in a structured, commonly used format.
• Withdraw consent at any time, without affecting prior lawful processing.

To exercise these rights, contact us at support@agenoz.com. You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or your local supervisory authority.

We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls scoped per workspace, authentication safeguards and infrastructure provided by leading cloud vendors. No system is completely secure, but we work continuously to protect your data and will notify you and the relevant authorities of any breach as required by law.

The platform is intended for professional use by agencies and agents and is not directed to children. We do not knowingly collect account data from minors. Note that CRM Data managed by our users may relate to athletes who are minors; the user remains responsible for the lawful processing of such data.

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date. Significant changes will be communicated through the platform or by email.

For any question about this Privacy Policy or your personal data, contact us at support@agenoz.com.