Version française

Privacy policy

Version of 8 October 2026

Lapelio helps clubs know who has paid. The club decides which member data it puts in Lapelio: it is responsible for that data, and we process it on its behalf. We sell no data, show no ads and never hold your money. The French version prevails.

On this page
  1. Who is responsible for what
  2. Member data (processed for the club)
  3. Club account data (Lapelio is controller)
  4. Visitors of public pages
  5. Card payments
  6. WhatsApp messages and emails
  7. Retention
  8. Our subprocessors
  9. Cookies
  10. Security
  11. Your rights
  12. Minors
  13. Changes

Who is responsible for what

  • Member data (and data of parents who pay for them): the club is the controller. Lapelio is its processor under GDPR article 28 and follows the data processing agreement.
  • Club account data (owner, coaches, Lapelio subscription): Sidahmed Larbi Youcef EI (nom commercial : Deep Moats), publisher of Lapelio, is the controller.

Members and parents: for any request about your data (see, correct, delete), ask your club first. We help it answer. You can also write to us and we'll pass it on.

Member data (processed for the club)

What the club can record:

  • identity and contact: first and last name, phone, email, whether a minor, who pays (often a parent), emergency contact;
  • club life: plan, belt and stripes, attendance, bookings, federation licences, event registrations, shop orders, poll votes, coach notes;
  • payments: amounts due and paid, method (cash, cheque, transfer, card…), dates, receipts, acceptance of the club's rules;
  • documents the club or the member uploads (parental consent, medical certificate…). A medical certificate is health data: the club only asks for it when needed, and only the club and the member can open it;
  • reminders: template used, channel, date and delivery status, agreement or refusal to receive messages.

Why: running memberships and dues, knowing who has paid, sending payment reminders, tracking attendance. Legal basis (chosen by the club): performance of the membership contract and the club's legitimate interest; consent for messages unrelated to membership.

How long: as long as the club keeps them. When the club deletes a member or closes its account, the data is erased (see “Retention”). Payment lines may be kept in anonymised form so the club's totals stay right.

Club account data (Lapelio is controller)

  • Email, name, role (owner or coach), two-factor sign-in

    Why
    Create and secure the account
    Legal basis
    Contract (art. 6.1.b)

  • Club name, address and settings

    Why
    Run the service, the club's public page if you publish it
    Legal basis
    Contract

  • Lapelio subscription and invoices

    Why
    Billing, accounting
    Legal basis
    Legal obligation (art. 6.1.c)

  • Technical and security logs (no record content)

    Why
    Detect abuse and outages
    Legal basis
    Legitimate interest (art. 6.1.f)

  • App usage (pages, actions), if enabled

    Why
    Improve the product
    Legal basis
    Legitimate interest, you can object

  • Notifications on your phone

    Why
    Tell you about a payment or the evening recap
    Legal basis
    Consent (you turn them on)

Visitors of public pages

Club public page, trial class booking, events, pay links: we process what you enter (name, phone or email) on behalf of that club. To limit abuse we keep a non-reversible fingerprint of your IP address for 24 hours at most.

Card payments

Card payments go through Stripe, on the club's own Stripe account. Lapelio never holds the money and never sees your full card number.

We read the amount, the date and the email or phone entered at checkout from Stripe, to put the payment on the right record. After paying, the confirmation page shows the club's name, the amount, the period, the date and the card brand with its last 4 digits. That is read from Stripe when the page is shown, not stored by Lapelio, and your name is not on it.

WhatsApp messages and emails

For each reminder we keep the template, channel, date and delivery status. When a member replies on Lapelio's WhatsApp number, the text of the reply is not kept: we only check whether they ask to stop receiving messages (STOP) and record that. If we ever keep reply texts, it will be for 30 days at most, and this page will be updated first.

Retention

  • Club account and member data: while the account is open. After closing, you can export your data for 30 days, then everything is erased. Technical backups age out within days.
  • Lapelio invoices: 10 years (French accounting law).
  • Security logs: 12 months at most.
  • IP fingerprints (anti-abuse): 24 hours.
  • WhatsApp reply texts: not kept.

Our subprocessors

We use these providers, each bound by a data protection agreement. Rows marked “if enabled” receive nothing until the feature is on. We tell clubs 30 days before adding or changing a subprocessor.

  • Supabase, Inc.

    What for
    Database, sign-in, files
    Where
    EU (Ireland)
    Safeguards
    DPA, data stays in the EU

  • Vercel Inc.

    What for
    Hosting of the site and server functions
    Where
    EU (Dublin); US company
    Safeguards
    DPA, Standard Contractual Clauses (SCCs), Data Privacy Framework (DPF)

  • Stripe

    What for
    Card payments, on the club's own Stripe account
    Where
    EU (Ireland) and US
    Safeguards
    The club has its own contract with Stripe; SCCs/DPF

  • Resend

    What for
    Service emails (sign-in codes, digests)
    Where
    US
    Safeguards
    DPA, SCCs

  • Google

    What for
    Maps and addresses (Maps/Places), Sign in with Google
    Where
    EU and US
    Safeguards
    DPA, SCCs/DPF

  • Meta (WhatsApp)

    What for
    Automatic WhatsApp messages, if the club turns them on
    Where
    EU and US
    Safeguards
    WhatsApp Business terms, SCCs/DPF

  • PostHog (Cloud EU)

    What for
    App usage statistics, if enabled
    Where
    EU (Germany)
    Safeguards
    DPA, data stays in the EU

  • Anthropic

    What for
    Recognising the columns of an imported file, if enabled: only headers and masked samples, never full records
    Where
    US
    Safeguards
    Commercial terms with DPA, SCCs

When data leaves the European Union, it is covered by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

Cookies

Today Lapelio uses strictly necessary cookies only, which need no consent: keeping you signed in, securing the Stripe connection, remembering the language and theme you picked, recognising the club's front-desk tablet. No advertising cookies, no audience-measurement cookies. If that changes, we will ask for your consent first.

Security

Encrypted connections everywhere, mandatory two-factor sign-in for clubs, each club sees only its own data (enforced in the database itself), encrypted keys and tokens, logs without personal data. If there is a data breach, we tell the affected clubs straight away so they can notify their supervisory authority within 72 hours.

Your rights

You can ask to access, correct or erase your data, restrict its use, object to processing based on legitimate interest, get your data in a readable format (portability), and withdraw consent at any time.

Club data: write to TODO_FOUNDER@example.com. Member data: write to your club (or to us, we'll pass it on). We answer within one month.

If you think your rights are not respected, you can complain to the French data protection authority, the CNIL: cnil.fr/plaintes, or to the authority of your country.

Minors

Lapelio is for clubs, not children. A minor's data is entered by the club, and messages go to the person who pays (often a parent).

Changes

If this policy changes in a significant way, we email clubs at least 30 days before. The version date at the top shows the last update.