Privacy Policy

1. Who the data controller is

The controller of the personal data processed through GoalingBreak (the goalingbreak.com website and the iOS and Android apps) is:

Wayku SL — tax ID (NIF) B76742675
Apartado de correos 153, 38660 Costa Adeje, Santa Cruz de Tenerife (España)
goalingbreak.com

For any privacy question or to exercise your rights, write to info@goalingbreak.com.

2. Who this notice is for

This notice applies to:

• anyone who visits the website or uses the app, even without an account;
• anyone who creates an account and uses the community, games and notifications;
• anyone who joins the partner programme;
• anyone who receives our emails;
• footballers, coaches and other people we publish sports information about (see the dedicated section).

Processing follows Regulation (EU) 2016/679 (“GDPR”), the Spanish data protection act (Ley Orgánica 3/2018) and, for cookies and email, the Spanish information society services act (Ley 34/2002, “LSSI”).

3. What data we process and where it comes from

Account and profile

• Email sign-up: email, password (stored only as a cryptographic hash, never in clear), language.
• Sign in with Apple: the identifier Apple assigns to your account, your email (including the private relay address, if you choose to hide yours) and your name, if you choose to share it.
• Sign in with Google: the identifier Google assigns to your account, your name and your email (only if Google gives it to us as verified). If an account with the same email already exists, Sign in with Google is linked to it. If you delete your account, the Google identifier is deleted with it.
• Telegram login: the numeric identifier of your Telegram account. Telegram also sends us your name, username and photo: we use the username as a suggestion for your GoalingBreak username and do not keep the rest.
• Profile: username (public) and the ones you used before, display name, bio, profile photo, favourite team, language, sign-up date and last visit.

What you post

• Posts, comments and voice messages in the Curva and in SocialBreak, reactions, poll votes, predictions and the other game actions of the community, pinned posts.
• Who you follow, who you block, the reports you make and the ones you receive.
• Live voice chat: audio travels live through our server to the other participants and is not recorded. People in the room see your username and photo.

Games and activity

• Quiz answers and scores, FantaBreak line-ups and results, challenges, curva points, XP, ranks, trophies, streaks, and the teams, leagues and players you follow.
• Your notification and promotional email preferences.

Assistant

The questions you ask the assistant, typed or spoken, and its answers. We do not link them to your account and do not store them in our database (see the section on artificial intelligence).

Device and technical data

• IP address: used on the fly for security, anti-abuse limits and to estimate your country; we do not store the address in our database, at most the country code.
• Device and browser type (user agent), browser language, time zone, the site you came from (domain only) and any campaign parameters in the link.
• Push notification addresses (phone token or browser subscription) and a random code identifying the app installation.

Phone notifications without an account

If you use the app without an account and allow notifications on your phone, we store the token your phone gives us for notifications, linked to the random code of the installation (not to your name or phone number), the app language and the teams, matches and players you add to your favourites on the phone: we need them to know which alerts to send you (for example your teams’ goals). If you then create an account or log in, the phone moves to your account and your favourites become the account’s.

Usage statistics

We build our statistics in-house, with no third-party analytics tools, for everyone: visitors without an account included.

• Identifiers: on the website, a random code stored in your browser that stays until you delete it (gb_vid) and one that lasts for a single visit (gb_sid); in the app, the random installation code. If you are logged in, statistics are also linked to your account.
• What we measure: pages and screens opened, time spent, scrolling, clicks and taps with their position on the screen, errors.
• Session recordings on the website: for a share of visits we reconstruct how the page is used (movements, clicks, scrolling). All fields you type in, other fans’ messages in the curva and your conversation with the assistant are masked and not recorded; account, partner area, login and sign-up pages are never recorded.

We do not use this data for advertising profiling and do not pass it to third parties.

Feedback and surveys

If you answer a survey or send us feedback from the website or the app (always optional), we collect your answers, any text you write and the technical context needed to understand them (page, device, app version), linked to your account if you are logged in. We use them to understand what to improve.

Invites and partner links

• If you arrive through an invite or partner link we store that person’s code (cookie “gb_ref”, 90 days) and record the visit with a non-reversible hash of IP address and browser, to recognise invites and prevent abuse.
• If you then install the app, we credit the partner with the installation. On Android the store passes us the partner’s code. On iPhone we match the tap on the link with the app’s first launch using technical network data: an encrypted, non-reversible hash of the network you connect from (never the address in clear), the iOS version and the time. The match only works within 48 hours and the tap data is deleted after 7 days.

Partners

If you join the partner programme: email, partner codes, request status, commissions earned and the payout method you choose — PayPal email, account holder and IBAN, or crypto wallet address — stored encrypted, with the payout history.

Linked services of the same company

From the website and the app you can open other Telegram services of Wayku SL (LiveSuperBot, MatchSuperBot, SuperTennisBot). When you do, the link carries only a random code; if you then sign up or buy, that service tells us the type of event, the amount and the currency, to calculate the commission of the partner who invited you. We do not exchange emails or Telegram identifiers.

When you write to us

The content of your messages and your address, so we can reply.

We do not intentionally process special categories of data (health, political opinions, religion…). Please don’t put them in public content: other people can see it.

4. Why we process it and on what legal basis

• Providing the service — account, profile, Curva, SocialBreak, voice chat, quizzes, FantaBreak, rankings, assistant, followed matches and teams. Basis: contract (art. 6.1.b GDPR), i.e. these Terms.
• Service emails and notifications — address confirmation, password recovery, welcome, rank-ups, curva decisions, weekly digest, match notifications. Basis: contract; push notifications also need the permission you give on your phone or browser.
• Phone notifications without an account — alerts about what you follow even if you have not created an account. Basis: the permission you give on your phone (consent, art. 6.1.a), which you can withdraw at any time from your phone settings. Now and then we may also send you a reminder to create an account: you turn it off from Profile in the app.
• Security, moderation and enforcing the rules — anti-abuse limits, profile photo checks, handling reports, anti-fraud checks on invites. Basis: legitimate interest in keeping the platform safe (art. 6.1.f) and legal obligations on illegal content (art. 6.1.c).
• Internal statistics, feedback and surveys — understanding which features are used, what doesn’t work and what to improve. Basis: legitimate interest in improving the service and keeping it secure (art. 6.1.f). You can object at any time by writing to info@goalingbreak.com: from then on, statistics linked to your browser or account stop.
• Content suited to your country — we estimate your country from your IP address to show content consistent with your country’s rules. Basis: legitimate interest and legal obligations.
• Invites, partner programme and sign-up attribution. Basis: contract with the inviter and the partner; legitimate interest in correctly crediting whoever brought a new user.
• Partner payouts and accounting and tax obligations. Basis: contract and legal obligation (art. 6.1.c).
• Promotional communications — emails, on-site notices and notifications about GoalingBreak news and the other services of Wayku SL, always marked as promotional. Basis: for GoalingBreak users, legitimate interest in offering products similar to those they already use (art. 6.1.f GDPR and art. 21.2 LSSI); for people in touch with us through another Wayku SL service, the consent given or relationship established with the controller on that service. In both cases you can object with one click from the link in every email.
• Defending our rights and answering authorities. Basis: legitimate interest and legal obligation.

5. Artificial intelligence and automated decisions

Some features use an artificial intelligence model from Google (Gemini), through its paid business service. Under that service’s terms, Google does not use this data to train its models.

• Profile photo check: before publication, the photo is examined automatically to rule out nudity, violence, hate symbols and similar content. If it does not pass, it is neither published nor kept: you can upload another one or write to us to have a person review it.
• Assistant: your question (text, or audio to transcribe) and the ongoing conversation are sent to the model to prepare the answer, without your name or email.

We do not take decisions based solely on automated processing that produce legal effects or similarly significantly affect you (art. 22 GDPR). Two measures are automated but temporary or limited: the profile photo check described above and, in the “For you” feed, the suspension of a post that receives 2 or more reports, which stays hidden until a moderator decides. The final decision on removals and suspensions is always taken by a person on our team or, in the curva, by the Leaders with the powers set out in the Terms.

6. Who receives the data

Other users

Username, display name, photo, bio, favourite team, rank, points, trophies and what you post are visible to other users and to visitors of the platform. Personal profile pages are not offered to search engines.

Providers working for us

They process data only on our behalf and following our instructions:

• Hetzner Online (Germany): the servers running the website, app, database and voice chat, where voice messages are stored.
• Amazon Web Services (Frankfurt data centre, Germany): private storage for profile photos.
• Google: artificial intelligence (Gemini), Sign in with Google and delivery of notifications to Android phones (Firebase Cloud Messaging). For Sign in with Google its own privacy policy also applies: policies.google.com/privacy.
• Apple: Sign in with Apple and delivery of notifications to iPhones.
• Brevo (France): sending emails.
• Telegram: Telegram login and internal alerts to our team (for example a report in the voice chat or a request to access the partner area, with the username involved).
• Browser notification services (from Google, Mozilla, Apple or Microsoft, depending on your browser), which receive web notifications in encrypted form.

Images hosted by third parties

Some images (crests, player photos, news images) are loaded directly from the servers hosting them: as with any image on the web, that server receives your device’s IP address and browser data.

Others

• The other services of Wayku SL, within the limits described above (random code, events and amounts).
• Legal, accounting and tax advisers, when needed.
• Public authorities, when required by law.

We do not sell your data and do not pass it to advertising networks.

7. Transfers outside the European Union

Our servers and the photo storage are in the European Union (Germany). Some providers — Google, Apple and Amazon — are US companies and may process data in the United States; Telegram is based outside the Union. In these cases the transfer relies on the European Commission’s adequacy decision on the EU-US Data Privacy Framework, for companies that participate in it, or on the standard contractual clauses approved by the Commission.

For information on the safeguards used, write to info@goalingbreak.com.

8. How long we keep it

• Account and profile: while the account is active. If you delete it, within 30 days we delete or anonymise the data that identifies you, except what we must keep by law.
• Posts, comments and voice messages: until you delete them, moderation removes them or you delete your account.
• Live voice chat: not recorded, nothing to keep.
• Assistant: we do not store conversations; an answer stays in a temporary cache for less than a minute, to avoid repeating the same work.
• Profile photo: until you change or remove it; a photo rejected by the check is not kept.
• Login session: 30 days from last use. Email confirmation link: 7 days. Password reset link: 30 minutes.
• Anti-abuse counters tied to the IP address: from one minute to one day.
• Usage statistics: raw data (browser events, page views, taps and clicks, sessions) is kept for 90 days, after that only totals that identify no one.
• Session recordings on the website: 30 days; if you delete your account, those made while you were logged in are deleted straight away.
• Account events (sign-up, logins, posts, games played): 13 months, then only in aggregate form.
• Feedback and surveys: 24 months, then only in aggregate form; if you delete your account, the text you wrote is deleted straight away.
• Proof of your choice on statistics, if we ask for your consent: 5 years.
• Installation attribution: link tap data 7 days; the link between installation and partner as long as the account exists.
• In-app notifications: 90 days.
• Phone notifications without an account: token, language and favourites as long as the token is valid (if you uninstall the app or withdraw the permission, the token stops working and we delete it) and in any case no longer than 90 days without opening the app. If you create an account they move to your account and the account rules apply.
• Partner and payout data: for the whole relationship and then for the time required by Spanish accounting and tax law (usually 6 years).
• Opting out of promotional email: we keep the address on a suppression list, precisely to respect your choice.
• Server technical logs: 30 days.
• Database backups: 30 days.

9. How we protect data

Encrypted connections (HTTPS), passwords stored only as a cryptographic hash, partner payout data encrypted, profile photos in private storage and stripped of metadata (such as GPS location) on upload, system access limited to the people who need it. No system is 100% secure: if a data breach put your rights at risk, we would notify you as the law requires.

10. Your rights and how to exercise them

Under articles 15-22 GDPR you can ask us at any time to:

• access your data and get a copy;
• rectify it if it is inaccurate or incomplete;
• erase it;
• restrict its processing;
• receive it in a machine-readable format and transmit it to another controller (portability);
• object to processing based on legitimate interest and, always and without giving reasons, to promotional communications;
• withdraw consent, where processing is based on consent, without affecting what was done before.

By yourself, in the product

• Edit username, name, photo, bio and favourite team from your profile.
• Choose which notifications you get in the notification settings; turn them all off from your phone or browser. Without an account, you turn off the reminders to create one from Profile in the app.
• Stop promotional emails from the link at the bottom of every email.
• Delete your account from the Account page on the website or from Profile in the app. Instructions are also on the Delete your account page.

By writing to us

For everything else, including a copy of your data, write to info@goalingbreak.com from the address linked to your account (or tell us your username). We reply free of charge within one month, extendable by two more for complex requests: in that case we let you know. If we have reasonable doubts about your identity we may ask for one more piece of information.

11. Complaints to the supervisory authority

If you think we are processing your data incorrectly, you can lodge a complaint with a supervisory authority. As Wayku SL is based in Spain, the lead authority is the Agencia Española de Protección de Datos (AEPD, C/ Jorge Juan 6, 28001 Madrid — www.aepd.es).

You can also contact the authority of the country where you live or work — in Italy, the Garante per la protezione dei dati personali (www.garanteprivacy.it). If you like, write to us first: we can often sort things out faster.

12. Minors

GoalingBreak is for people aged 16 or older. We do not knowingly collect data from younger people: if you are a parent and believe your child has signed up, write to us and we will delete the account.

13. Data about footballers and other people in sport

We publish sports information about footballers, coaches, referees and other people known for their sporting activity: name, photo, nationality, date of birth, position, team, statistics, line-ups, transfers and unavailability (for example injuries or suspensions). This information has already been made public by clubs, competitions and the media, and we process it to inform the public about sport, on the basis of legitimate interest and freedom of information (art. 85 GDPR).

If some of this information concerns you and you want to correct it or object to its publication, write to info@goalingbreak.com: we assess each request by balancing your rights against the public’s interest in information.

14. Cookies and similar tools

What we store in your browser and in the app, and why, is explained in the Cookie Policy.

15. Changes to this notice

We may update this notice when the service or the law changes. The date at the top shows the latest version; if the changes are significant we will tell you in advance, on the platform or by email.