Last updated: October 2026
Compteam is a SaaS platform for BJJ gym management, operated by a private individual resident in Andorra. For questions about this policy, contact us at info@compteam.io.
Because the operator is established in Andorra, the personal data we handle is governed primarily by Andorran law — Llei 29/2021, qualificada de protecció de dades personals (LQPD) — which is closely aligned with the EU GDPR (Andorra benefits from an EU adequacy decision and is a party to Convention 108+). Where this policy cites GDPR articles, the equivalent LQPD provisions apply.
When you create a Compteam account (as a branch admin or athlete), we collect your email address, name, and any profile information you provide. We use this to operate your account and deliver the service. Legal basis: Art. 6(1)(b) GDPR — performance of a contract.
Subscription payments are processed by Stripe. We store your subscription status and plan tier. Card numbers and payment details are held exclusively by Stripe. Legal basis: Art. 6(1)(b) GDPR.
When you buy a Compteam supporter T-shirt, Stripe processes your payment, selected size and quantity, delivery address, contact details, tax, and shipping information. Compteam may use the order details Stripe makes available to us to fulfil the order manually, provide support, and keep required accounting records. Legal basis: Art. 6(1)(b) GDPR.
Gyms (branch admins) are the data controllers for the personal data of their athlete members — names, dates of birth, training records, belt history, competition results, and billing mandates. Compteam processes this data as a data processor under Art. 28 GDPR on behalf of the gym. See our Data Processing Agreement.
Some of this data may be entered by your gym rather than by you directly (for example when a coach imports an existing roster). Where your data was not obtained from you, its source is your gym (LQPD Art. 17).
If you connect your Compteam account to the Compteam plugin in ChatGPT, OpenAI handles the conversation and requests to the plugin under its own privacy terms. Compteam receives the requests needed to answer them, including your Compteam account identity and, when you choose an action, the class or linked child involved. The plugin returns limited club, schedule, membership, payment-status, and attendance information to ChatGPT so it can answer you. It does not send bank account numbers, card details, or full billing records.
If you submit a free trial inquiry, Compteam receives the name, email, phone number, date of birth, and optional message entered in the form and shares the inquiry with the selected club so it can contact you. Cloudflare Turnstile performs a security check in that form and may process browser or device signals. ChatGPT may also process information you type in the conversation or form. You can disconnect the plugin from ChatGPT at any time; this does not by itself delete records already needed by Compteam or the club for an inquiry or attendance change. Contact info@compteam.io to exercise your data rights.
If you request account-connected access for a non-OpenAI MCP client, Compteam receives the contact, organization, client, OAuth, redirect-URI, privacy, security, intended-use, and data-retention details submitted in the registration form. We use this information to review the request, configure an approved client, and respond to the requester. Cloudflare Turnstile performs a security check and may process browser or device signals. Requests are delivered by Resend and retained in business correspondence for as long as needed to review, support, and document the integration. Do not submit passwords, client secrets, or API keys. Contact info@compteam.io to exercise your data rights.
We use Google Analytics 4 to understand how visitors use the site. Analytics cookies are only set after you give consent via the cookie banner. Legal basis: Art. 6(1)(a) GDPR — consent. You can withdraw consent at any time via the footer's Cookie Settings link.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database hosting and authentication | EU (Frankfurt) |
| Stripe | Payment processing | EU/US |
| Resend | Transactional and service email delivery | US (transfers under SCCs / EU-US DPF) |
| Anthropic / Google / OpenRouter | AI assistant ("agent mode"), where a gym enables it | US (transfers under SCCs / EU-US DPF) |
| Google Analytics | Anonymised usage analytics (consent-only) | US (data governed by DPF) |
| OpenAI | ChatGPT plugin hosting and user-requested tool interactions | Subject to OpenAI's applicable privacy terms |
| Cloudflare | Turnstile security checks for public forms, including trial inquiries and MCP client requests | Subject to Cloudflare's applicable processing terms |
Transfers to US sub-processors rely on appropriate safeguards (Standard Contractual Clauses and/or EU-US Data Privacy Framework participation), recognised under LQPD Articles 42–45.
Under GDPR you have the right to:
To exercise any right, contact info@compteam.io.
Minors: the personal data of a person under 16 is only processed with the consent of their legal representative (LQPD Art. 8). Where a member is under 16, registration is completed through a guardian-consent step.
Platform account data is retained for as long as your account is active. When you delete your account, your personal data is erased, subject to legal retention obligations described below. For athlete-member data that Compteam processes on behalf of a gym, the gym is the data controller. At least five business days before the service ends, the gym must tell Compteam in writing whether it chooses to have the data returned or deleted. When the service ends, Compteam follows that instruction and deletes existing copies, unless applicable law requires retention. Where applicable law requires records to be retained — for example, financial records kept for statutory accounting obligations — the related personal data is blocked so it cannot be used for any other purpose, kept only for the applicable legal period, and then destroyed (LQPD Art. 30). Analytics data is retained per Google Analytics defaults (14 months).
We will notify users of material changes by email. The "last updated" date at the top of this page reflects the most recent revision.