Privacy Policy

benchli Privacy Policy

Effective date: 1 October 2026 Last updated: 1 October 2026 Product: benchli (mobile apps + web) Data controller: Mitbolas GmbH Registered address: Asylstrasse 26, 8800 Thalwil, Switzerland Privacy contact: benchli_operations@benchli.com

This Privacy Policy explains how benchli collects, uses, stores, shares, and protects personal data when you use the benchli apps, websites, APIs, support tools, and related services (together, the "Service").

benchli is a sports team operations platform for players, team managers, clubs, leagues, and organizers.

This Privacy Policy applies to users of the benchli apps, websites, and related services.

---

1. Who is responsible for your personal data

The data controller responsible for your personal data is:

Mitbolas GmbH Address: Asylstrasse 26, 8800 Thalwil, Switzerland Email: benchli_operations@benchli.com

Team data is different. When a team, club, league, or organization (a "Club") uses benchli to manage its members, the Club decides which people to invite, what information to enter about them, how to use RSVP and participation data, and how long to keep the team. For that team data the Club is the controller and benchli is its processor, under the benchli Data Processing Addendum (the "DPA"), which the Club accepts when it creates a team. If a Club is not a legal person (for example, a group of friends without a registered association), the person who created the team is the controller of its team data.

For everything else described in this Privacy Policy, including your own account, your player card, your consent records, your billing details where you pay benchli, and the security records of your own activity, Mitbolas GmbH is the controller.

Questions about how a Club uses your team data go to that Club first; benchli helps the Club answer them and passes on any request it receives about team data.

---

2. Summary

benchli collects personal data to provide team sports management functionality.

This may include account information, profile information, team membership, RSVP status, availability, event participation, team communications, support messages, payment-related information, uploaded photos, app usage data, and optional notes or feedback.

We use this data to:

• provide the app;
• manage accounts and authentication;
• support team and player workflows;
• process invitations and RSVPs;
• enable team communications;
• support payments and subscriptions;
• improve security;
• provide support;
• generate analytics and insights;
• power optional AI-assisted features;
• comply with legal obligations.

We do not sell your personal data.

---

3. Personal data we collect

3.1 Account and identity data

We may collect:

• first name;
• last name;
• email address;
• phone number, if supported;
• authentication identifiers;
• login verification status;
• preferred language;
• account status;
• user ID;
• device or session identifiers;
• role information.

3.2 Player profile data

We may collect:

• profile photo;
• year of birth;
• preferred jersey number or numbers;
• team membership;
• player status;
• jersey size;
• position or role, if supported;
• player preferences;
• self-managed profile fields.

3.3 Team and organization data

We may collect:

• team name;
• sport type;
• team logo;
• team settings;
• team roles;
• team membership records;
• manager and owner information;
• league, club, or organization relationships;
• team subscription status;
• team configuration data.

Team discoverability. Team names and their home association (for example the club or league they belong to) are discoverable by other benchli teams so that opposing teams can find each other to schedule games. Discoverability is on by default; the person who creates a team can switch it off during team creation, and owners can change it at any time in team settings. If a team name contains a personal name, switching discoverability off removes it from search.

3.4 Game, event, and participation data

We may collect:

• games;
• events;
• tournaments;
• fixtures;
• locations;
• schedules;
• RSVP status;
• availability;
• attendance;
• participation history;
• statistics;
• game notes;
• event notes;
• team feedback;
• poll responses;
• task activity;
• team feed activity.

3.5 Communications data

We may collect:

• support messages;
• feedback submissions;
• team messages;
• announcements;
• comments;
• replies;
• notification preferences;
• email delivery metadata;
• push notification tokens;
• in-app communication records.

3.6 Photos, media, and uploaded content

We may collect:

• profile images;
• team logos;
• uploaded documents;
• written notes;
• voice notes;
• audio recordings, if supported;
• transcriptions;
• translations;
• generated summaries;
• image validation metadata.

Where a profile photo is uploaded, we run a basic check that it appears to be a suitable headshot (see Section 8). This is not facial recognition and does not create biometric data.

3.7 Payment and billing data

Where paid features are used, we may collect:

• subscription status;
• plan type;
• billing contact details;
• transaction IDs;
• invoice references;
• payment provider references;
• currency;
• amount;
• payment status;
• refund status;
• platform fee metadata;
• tax-related metadata where required.

We do not normally store full card details. Payment card data is generally processed by third-party payment providers or app stores.

3.8 Device, technical, and usage data

We may collect:

• device type;
• operating system;
• app version;
• browser or webview data;
• IP address;
• approximate location derived from IP address;
• language settings;
• crash logs;
• diagnostic logs;
• API request metadata;
• authentication events;
• security logs;
• feature usage;
• performance metrics.

3.9 Data we do not collect

benchli does not collect or process:

• biometric data, facial-recognition templates, or other special-category biometric identifiers;
• health, medical, physiological, or heart-rate data;
• sensor, wearable, or edge-device measurements.

benchli is not a medical service. Profile-photo handling is limited to confirming that an uploaded image appears to be a headshot (see Section 8) and does not involve facial recognition, biometric matching, or identity verification.

---

4. How we collect data

We collect data when:

• you create or update an account;
• you verify your email or login;
• you join or create a team;
• a team manager invites you;
• you RSVP to a game or event;
• you submit availability;
• you upload a profile photo;
• you post notes, feedback, or support messages;
• you use polls, tasks, feeds, or team tools;
• you interact with notifications;
• you make or manage payments;
• you contact support;
• you use the app or website;
• third-party services provide data necessary for integrations.

Some information may be entered by team managers, owners, league organizers, or other authorized users.

If someone adds you to a team. A team manager may enter your name and e-mail address to invite you before you have an account. The invitation you receive tells you who benchli is and links to this Privacy Policy, so you know who holds that data and how to object or ask for it to be deleted. If you never accept the invitation, the invitation record is deleted or anonymized as described in Section 12.

---

5. Why we use personal data

We use personal data for the following purposes.

5.1 To provide the Service

This includes:

• account creation;
• authentication;
• team membership;
• player profiles;
• game and event management;
• RSVP tracking;
• availability tracking;
• team communications;
• statistics;
• player history;
• team feeds;
• polls;
• tasks;
• marketplace functionality;
• mobile app functionality.

5.2 To manage teams, leagues, and organizations

This includes:

• team setup;
• role management;
• manager permissions;
• league or club administration;
• roster management;
• team settings;
• participation records;
• team-level analytics.

5.3 To provide payments and subscriptions

This includes:

• subscription management;
• payment confirmation;
• invoicing;
• refunds;
• fraud prevention;
• account status management;
• tax and accounting support;
• payment provider integration.

5.4 To provide support and handle feedback

This includes:

• responding to support requests;
• investigating issues;
• managing incidents;
• triaging requests;
• improving knowledge base content;
• analyzing product feedback;
• prioritizing fixes and enhancements.

The ideas board. When you submit an idea, it stays private until a member of the benchli team has reviewed it. If we publish it, its title, description, category, sport, tags, status, vote count, the dates it was submitted and last updated, any note we add about its progress, and links to similar ideas it was combined with can be seen and voted on by every signed-in benchli user, not only your team. We do not show your name, your teams, your country or your contact details with a published idea, and before we publish an idea we remove any personal details about anyone that appear in what you wrote. We record who voted on each idea so that everyone gets one vote, and we let you know in the app when an idea you submitted or voted on is planned, built, released, declined or combined with a similar idea. You can ask us to take a published idea down at any time through support.

5.5 To provide AI-assisted features

benchli may use AI or automated processing to support:

• support triage;
• feedback classification;
• knowledge base recommendations;
• game retrospectives;
• translation;
• transcription;
• summarization;
• RSVP and roster risk insights;
• marketplace suggestions;
• operational analytics.

AI outputs may be reviewed, logged, corrected, or improved for quality, safety, and auditability.

5.6 To keep the Service secure

This includes:

• fraud detection;
• abuse prevention;
• audit logging;
• access control;
• rate limiting;
• incident response;
• identity verification;
• suspicious activity detection;
• account protection.

5.7 To improve the Service

This includes:

• product analytics;
• performance monitoring;
• crash analysis;
• usability improvements;
• feature planning;
• quality control;
• testing;
• debugging.

5.8 To comply with legal obligations

This includes:

• tax and accounting obligations;
• regulatory requirements;
• legal claims;
• law enforcement requests where valid;
• data protection obligations;
• consumer protection obligations;
• fraud and security investigations.

---

6. Legal basis for processing

Where Swiss data protection law applies, we process personal data in accordance with the Swiss Federal Act on Data Protection.

Where the GDPR applies, we rely on one or more of the following legal bases:

Where we rely on legitimate interests, we balance our interests against your rights and freedoms.

---

7. AI, automated processing, and profiling

benchli uses a third-party AI service — Amazon Web Services (AWS) Bedrock, currently running the Amazon Nova Lite and Amazon Nova 2 Lite models, in the EU — to power a small set of automated, assistive features. Requests start in Frankfurt (eu-central-1), and AWS may process them in another of its EU regions (Stockholm, Ireland, Paris, Milan or Spain) to balance load. AWS processes this data on benchli's behalf under our instructions and contractual data-protection terms; the data stays within the EU and is not used to train third-party foundation models.

Today these uses are mostly operational and assistive, for example:

• support-request triage and feedback classification (including duplicate detection);
• knowledge-base and help suggestions;
• summaries and retrospectives;
• translation and transcription;
• moderation assistance.

The main user-facing use is the optional "propose a lineup" suggestion, which a manager can trigger to receive a suggested team lineup. Any such output is advisory — a manager reviews it and decides.

No solely-automated decisions with legal or similarly significant effect. benchli does not use AI to make decisions that produce legal effects concerning you, or similarly significantly affect you, without human involvement (in GDPR terms, Article 22). We do not use AI for credit, eligibility, safeguarding, or disciplinary decisions, and we do not carry out invasive profiling or special-category inference.

AI-generated outputs may be inaccurate or incomplete and should be reviewed before being relied upon. Content you submit to an AI-assisted feature is processed only to provide that feature.

---

8. Profile photos (headshot check)

benchli allows users to upload a profile photo, which should be a headshot so teammates can recognise each other.

To keep photos appropriate, benchli runs a basic automated check (using AWS Rekognition, EU region) on whether an uploaded image appears to be a headshot (face-presence and image quality) and screens it for inappropriate content; it may generate technical metadata such as a validation status, a generated thumbnail, image-quality indicators, and a moderation status. Only the pass/fail result is kept — the analysis itself is transient.

This is not facial recognition or biometric processing. benchli does not:

• create, store, or compare facial-recognition templates or biometric identifiers;
• identify or verify a person's identity from their photo;
• match faces across teams, accounts, or other services;
• sell or share facial or biometric data.

The check only assesses whether the picture looks like a suitable headshot — nothing more. (Any device-level face unlock, such as Face ID, is performed by your device's operating system, not by benchli.) Where local law nonetheless requires consent for this kind of image handling, benchli will seek consent or offer an alternative.

---

9. Children and younger users

benchli is intended for users aged 18 and above, unless a higher minimum age applies in a particular country or feature.

We do not knowingly allow children below the applicable minimum age to create accounts.

If you believe a child has provided personal data in breach of this policy, contact us at benchli_operations@benchli.com.

Teams, clubs, leagues, and organizers are responsible for ensuring that their use of benchli complies with applicable child protection, safeguarding, consent, and sports governance rules.

---

10. Sharing personal data

We may share personal data with the following categories of recipients.

10.1 Team members and team managers

Depending on your role and team settings, some data may be visible to other users, such as:

• name;
• profile photo;
• team role;
• RSVP status;
• availability;
• player status;
• jersey number;
• statistics;
• comments or notes you choose to share;
• team feed activity.

Team managers may have broader access to team-related information.

If a team suspends you, managers of your other teams can see that you have an active suspension elsewhere and how many — never which team suspended you, why, or for how long. You can always see the same indicator about yourself in your own profile. We record every time this indicator is accessed.

Team discoverability (see §3.3) also affects what other teams can see: a discoverable team's name and home association can be found by other benchli teams.

Ideas you submit to the ideas board can be seen by every signed-in benchli user once we publish them, without your name (see §5.4).

10.2 Clubs, leagues, and organizations

Where your team is part of a club, league, tournament, or organization, relevant data may be shared with authorized organizers for administration, scheduling, participation, competition management, billing, compliance, or reporting.

10.3 Service providers

We may share data with service providers that help us operate the Service, including providers of:

• cloud hosting;
• databases;
• authentication;
• email delivery;
• push notifications;
• payment processing;
• analytics;
• crash reporting;
• customer support;
• AI processing;
• transcription;
• translation;
• image processing;
• security;
• logging;
• monitoring.

These providers may process data only as necessary to provide services to us, subject to contractual obligations.

10.4 Payment providers and app stores

If you make payments, relevant transaction data may be shared with:

• payment processors;
• card networks;
• banks;
• Apple App Store;
• Google Play;
• tax or accounting service providers;
• refund or dispute handling providers.

10.5 Integration partners

If you or your team use optional integrations, we may share data with integration partners as needed to provide the selected functionality.

Examples may include:

• calendar integrations;
• insurance partners;
• travel partners;
• sports technology providers;
• league management integrations;
• analytics integrations.

We will only share data necessary for the relevant integration.

10.6 Legal, safety, and compliance recipients

We may share data where necessary to:

• comply with law;
• respond to valid legal requests;
• protect users;
• prevent fraud or abuse;
• enforce our Terms;
• investigate security incidents;
• protect the rights, property, or safety of benchli, users, or others.

10.7 Business transfers

If benchli is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal data may be transferred as part of that transaction, subject to appropriate protections.

---

11. International data transfers

benchli is based in Switzerland. Core processing and storage take place in the EU — Amazon Web Services, Frankfurt (eu-central-1) — covering authentication, databases, file storage, email, image checks, and the AI features described in Section 7. Requests to the AI features described in Section 7 may be processed in another AWS EU region (Stockholm, Ireland, Paris, Milan or Spain); this stays within the EU and is not a transfer outside it.

A limited number of sub-processors may process some personal data outside Switzerland/the EU — for example Stripe (payments) and Google (the optional digital-player-card wallet pass) may involve transfers to the United States. The named sub-processors and their regions are listed in Appendix A.

Where personal data is transferred internationally, we apply appropriate safeguards where required, such as:

• adequacy decisions (e.g. the Swiss–US / EU–US Data Privacy Framework);
• standard contractual clauses;
• data processing agreements;
• technical and organizational safeguards;
• transfer risk assessments where required.

---

12. Data retention

We keep personal data only as long as needed for the purposes described in this Privacy Policy, and then delete or anonymize it. The periods below apply unless a longer period is required by law or by an ongoing dispute, investigation, or safeguarding matter.

When a period ends, we delete the data or anonymize it so that it no longer identifies you. Anonymized team history (for example, a game result without player names) may be kept.

---

13. Your rights

Depending on your location and applicable law, you may have rights to:

• access your personal data;
• correct inaccurate data;
• delete your data;
• restrict processing;
• object to processing;
• withdraw consent;
• receive a copy of your data;
• request data portability;
• object to direct marketing;
• challenge certain automated decisions;
• lodge a complaint with a data protection authority.

To exercise your rights, contact us at benchli_operations@benchli.com.

We may need to verify your identity before responding. We respond within 30 days of receiving your request; if a request is complex we tell you within that time how long it will take.

For team data controlled by a Club (Section 1), we pass your request to the Club and help it respond.

Some data may not be deleted immediately where retention is required for legal, billing, security, audit, dispute, or legitimate team administration purposes.

---

14. Account deletion

You may request account deletion through the app, where available, or by contacting us at benchli_operations@benchli.com.

When your account is deleted:

• your login access may be disabled;
• your profile may be removed or anonymized;
• your personal profile photo may be deleted or detached;
• some records may remain where necessary for legal, audit, billing, dispute, security, or team history purposes;
• team records may continue to show historical participation in an anonymized or limited form where needed.

If you are a team owner or billing administrator, deletion may require transfer or closure of team ownership responsibilities.

---

15. Marketing communications

We may send marketing communications where permitted by law.

You can opt out of marketing emails by using the unsubscribe link or contacting us.

Even if you opt out of marketing, we may still send service-related communications, such as security notices, login codes, billing notices, team invitations, and important account updates.

---

16. Push notifications

With your permission, benchli may send push notifications to your device.

These may include:

• game reminders;
• RSVP reminders;
• team updates;
• support messages;
• event changes;
• invitations;
• task updates;
• payment or subscription notices;
• security alerts.

You can manage push notification permissions in your device settings or in the app where available.

---

17. Cookies, analytics, and similar technologies

The mobile app and related websites may use cookies, SDKs, local storage, device identifiers, or similar technologies.

These may be used for:

• authentication;
• session management;
• security;
• analytics;
• crash reporting;
• app performance;
• remembering preferences;
• fraud prevention;
• feature improvement.

Where required by law, we will request consent for non-essential cookies or similar technologies.

---

18. Security

We use technical and organizational measures designed to protect personal data.

These may include:

• access controls;
• authentication;
• encryption in transit;
• encryption at rest where appropriate;
• audit logging;
• security monitoring;
• role-based permissions;
• least-privilege access;
• secure cloud infrastructure;
• backup controls;
• incident response procedures.

No system is completely secure. You are responsible for keeping your device, email account, and login methods secure.

If you believe your account or data has been compromised, contact us immediately at benchli_operations@benchli.com.

---

19. Data breaches

If a data breach occurs and notification is required by applicable law, we will notify the relevant authority and/or affected users as required.

The Swiss revised data protection framework requires prompt notification to the Federal Data Protection and Information Commissioner in certain data security breach situations. ---

20. App store privacy disclosures

If benchli is distributed through Apple App Store or Google Play, we may be required to provide privacy and data safety disclosures to those platforms.

Apple requires developers to identify data collected by the app and third-party partners and keep app privacy responses accurate and up to date. Google Play requires developers to explain what user data is collected, transmitted, used, and shared. The app store privacy labels or data safety sections are summaries. This Privacy Policy provides the fuller explanation.

---

21. Third-party links

The Service may contain links to third-party websites, services, payment pages, app stores, support tools, partner services, or integrations.

We are not responsible for the privacy practices of third parties that we do not control.

You should review their privacy policies before using their services.

---

22. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

If changes are material, we will take reasonable steps to notify users, such as through the app, email, or website.

The updated version will apply from the effective date stated above.

If you continue using the Service after the updated Privacy Policy takes effect, your personal data will be handled according to the updated version.

---

23. Complaints

If you are concerned about how we handle your personal data, please contact us first at:

benchli_operations@benchli.com

You may also have the right to contact a data protection authority.

For Switzerland, this may be the Federal Data Protection and Information Commissioner.

For EU/EEA users, this may be your local supervisory authority.

---

24. Contact

For privacy questions, data rights requests, or complaints, contact:

Mitbolas GmbH Email: benchli_operations@benchli.com Address: Asylstrasse 26, 8800 Thalwil, Switzerland Website: https://benchli.com/

---

Appendix A — Sub-processors

benchli uses the three providers below to process personal data on our behalf. Each processes personal data only as needed to provide the Service and under a data-processing agreement. Core infrastructure runs on Amazon Web Services in Frankfurt (eu-central-1, EU). This list is maintained and may change; we give team owners at least 30 days' notice of a new or replaced sub-processor, as described in Section 22 and in the Data Processing Addendum.

Other services we use that do not receive your personal data.

Region-specific or optional integrations that are off by default are enabled only when a team turns them on, and are disclosed at that point. We do not use advertising networks or third-party behavioural-tracking SDKs.