Privacy policy

Epona Solutions Ltd, trading as Dossier, is the data controller for the Dossier service.

• Legal operator: Epona Solutions Ltd, trading as Dossier
• Registered office: supplied on invoices and on request while the service remains in beta.
• General contact: [email protected]
• Privacy contact: [email protected]

Personal data we collect

We collect the details needed to sell and deliver reports: email address, name where supplied, purchase records, Stripe session identifiers, sign-in tokens, report unlock tokens, commissioned report requests, coach match-upload links and permissions, adult-match confirmations, newsletter coverage-alert sign-ups, and support messages. For security and diagnostics we may process server logs such as IP address, user agent, requested URL and timestamps.

How we use it

We use personal data to take payment, deliver reports, provide the My reports portal, process coach match uploads, improve Dossier's football-analysis systems where the free upload permission applies, watermark unlocked reports, send requested newsletter coverage alerts, answer support and refund requests, prevent abuse, maintain records, and understand site performance.

Lawful bases

Most purchase and delivery processing is necessary for our contract with you. Accounting records are kept to meet legal obligations. Security, fraud prevention, watermarking, basic analytics and service improvement are handled under legitimate interests. Marketing email is only sent where we have a lawful basis to do so.

Report subjects

Reports may discuss players, clubs, coaches or officials using information already in the public domain. We avoid private, sensitive or speculative material. If a report contains inaccurate or inappropriate information about you, email [email protected] and we will review it.

Processors and transfers

We use service providers including Stripe for payments, Cloudflare for network protection, our hosting provider for the application and database, Resend or another email provider for transactional email, and Umami for privacy-focused analytics. Some providers may process data outside the UK or EEA under their own safeguards.

Retention

Purchase and accounting records are kept for as long as needed for tax, legal and customer-support reasons. Magic-link sign-in tokens expire quickly. Unlock cookies and sign-in cookies expire automatically. Coverage-alert emails and support emails are kept only as long as needed to handle the request or maintain a reasonable record.

Your rights

You can ask to access, correct, delete or restrict your personal data, and you can object to some processing. Email [email protected]. You can also complain to the UK Information Commissioner's Office at ico.org.uk.