ClanManager Privacy Policy

The data controller is:

• Owner: Javier Díaz Permuy
• Tax ID (NIF): 32692536Z
• Address: C/ Sánchez Calviño, Ferrol, A Coruña, Spain
• Contact email: legal@clanmanager.app
• Website: cr.clanmanager.app
• Trade name: ClanManager

Hereinafter, the Controller, ClanManager, the Platform or the Service.

For any question relating to the processing of your personal data you can write to legal@clanmanager.app.

This Privacy Policy applies to personal data processed as a result of:

• Browsing the website.
• Using forms (contact, access request, clan claim, etc.).
• Registering and authenticating on the Platform (email, Google, Discord or other providers).
• Using the public and private clan management features.
• Consulting and synchronising clan and player data through the official Clash Royale API.
• The user entering notes, tags, kick reasons, evaluations or other information about clan members.
• Subscribing to informational or operational communications about the Service.
• Interacting with ClanManager's social profiles, campaigns or communications.

This Policy does not apply to third-party websites, platforms or services accessed via external links or integrations outside ClanManager (for example, Supercell, the Clash Royale game itself, Google, Discord or other networks).

When processing personal data we apply the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability, in accordance with Regulation (EU) 2016/679 and Spanish data protection regulations.

Depending on your relationship with ClanManager, we may process the following categories of data:

4.1. Identification and contact data: name or alias, email, country, language, avatar from the social provider if you use Google or Discord.

4.2. Account and authentication data: user identifier, authentication provider used, technical credentials managed by the authentication provider, date and time of registration and access, IP address, device, browser, operating system and language settings.

4.3. Role data within a clan: clan claimed or managed, associated clan and player tags, assigned role (super-admin, admin, collaborator, etc.), history of enrolments, removals and role changes.

4.4. Data from the official Clash Royale API (Supercell): public information on clans and players needed for functionality, such as clan name and tag, description, badge, declared location, type, entry requirements, number of members, trophies, wars, donations, participation in battle days, promotions and demotions, player cards and levels, Path of Legends ranks, war history, last-seen times and similar data.

4.5. Data entered by the user in the Platform: private notes about members, tags and classifications, kick or exit reasons, internal evaluations, war targets, alert configuration, internal messages, access requests and other internal communications by the admin team.

4.6. Communications and support data: queries sent, email messages, tickets or incidents reported, communication history and information necessary to resolve requests.

4.7. Browsing, analytics and cookies data: IP address, cookie identifiers, pages visited, time spent, traffic source, device, browser, operating system, conversion events and interaction with forms. Their use is governed by the Cookie Policy.

4.8. Technical data and Platform logs: synchronisation logs, errors, latency, results returned by the Supercell API, security events, usage limits, audit of administrative actions and logs necessary for security, support and abuse prevention.

ClanManager does not request or need to process special categories of personal data (health, ideology, religion, trade union membership, sexual orientation, racial or ethnic origin, biometric data or data relating to criminal convictions or offences).

The user undertakes not to enter such data on the Platform, in particular in private notes, tags or kick reasons. If unauthorised sensitive data is detected, ClanManager may delete, block or request its withdrawal.

We process personal data for the following purposes:

6.1. Managing the website and responding to requests: handling queries, contact forms, support requests or user communications.

6.2. Creating and managing user accounts: enabling registration, authentication (via email or external providers such as Google or Discord), identification, management of technical credentials and account cancellation or modification.

6.3. Providing the clan management service: enabling public clan consultation, clan claiming through in-game verification, role assignment, periodic synchronisation with the official Clash Royale API, generation of statistics, automatic performance evaluations, pending-attack alerts, war history, donation tracking, ex-member management and operational notices.

6.4. Internal notes, tags and evaluations: enabling the clan's admin team to record private notes, tags, kick reasons and evaluations about members, for the sole purpose of managing the clan itself.

6.5. Security, fraud prevention and prevention of abuse: protecting the Platform, detecting unauthorised access, preventing improper clan claims, avoiding spam, protecting accounts, monitoring errors, auditing technical logs and ensuring the stability of the Service.

6.6. Product improvement and internal analytics: processing usage data, aggregated metrics or technical information to improve the Platform, detect errors, optimise features and design new modules. Where possible, such analyses will be carried out on aggregated or anonymised data.

6.7. Operational and informational communications: sending communications necessary to provide the Service (email verification, account changes, security notices, legal changes) and, where a legal basis exists, informational communications about product updates.

6.8. Legal compliance and defence against claims: complying with legal obligations, attending to administrative or judicial requests, protecting our rights and defending against claims.

The legal basis depends on the specific purpose:

7.1. Performance of a contract or pre-contractual measures: creation and management of the account, provision of the clan management service, support related to the Service, management of clan claims and assigned roles.

7.2. Consent of the data subject: subscription to informational communications when no other basis applies, acceptance of non-essential cookies, authorisation of certain external authentication providers or optional permissions. Consent may be withdrawn at any time, without affecting the lawfulness of prior processing.

7.3. Compliance with legal obligations: tax, accounting and data protection obligations, as well as attending to legal or administrative requirements.

7.4. Legitimate interest: ensuring the security of the Platform, preventing fraud, abuse or unauthorised access, improving the Service, analysing feature usage, keeping technical records, defending rights or legitimate interests and preventing use contrary to the legal terms. Where processing is based on legitimate interest, you may object under the terms provided by applicable law.

ClanManager queries the official Clash Royale API (Supercell) to display and organise public information about clans and players.

This data is offered by Supercell through a public API and mainly relates to information visible within the game itself. ClanManager processes it solely to provide clan management features (statistics, war, donations, rankings, history, etc.).

The user acknowledges that:

• The availability, accuracy, refresh cadence and structure of the API are managed exclusively by Supercell.
• The data may vary, contain errors or be out of date.
• Supercell applies its own terms and policies to the processing of game data, available through its official channels.

If a player wishes their data to no longer appear in clans managed through ClanManager, they may leave the clan in the game. For additional requests concerning their data they may write to legal@clanmanager.app.

ClanManager allows a clan's admin team (super-admin, admin, collaborators) to enter private notes, tags, evaluations, kick reasons or other internal information about clan members, solely for the purpose of managing the clan itself.

In these cases:

• The clan (represented by its admin team) determines what information is entered and for what internal purpose.
• The user entering such information undertakes to do so in a proportionate, respectful manner and in accordance with applicable regulations.
• Insults, threats, discriminatory comments, unnecessary personal data or sensitive data must not be entered.
• The user must, to the extent that corresponds to them, attend to the rights of the persons affected by such data.
• ClanManager may delete, block or limit content when it detects signs of illegality, infringement of rights or abusive use.

These notes and tags are not public: they are only visible to the corresponding clan's admin team.

Claiming a clan requires in-game verification (for example by pasting a temporary code in the clan or player description). During this process we may process the clan tag, the player tag and the technical data necessary to verify ownership.

Improper, fraudulent or unauthorised claims will result in the revocation of the role, the deletion of the data associated with that claim, and may entail account suspension and any legal action that may apply.

ClanManager may use automated processes to compute a per-member performance score (weighting war, donations, activity and tenure), generate pending-attack alerts, suggest kick candidates or prioritise tasks for the admin team.

These processes have an operational purpose and support clan management. Unless expressly stated otherwise, ClanManager does not make automated decisions producing legal effects on users or similarly significantly affecting them. Decisions about kicks, promotions or sanctions within the clan are taken by the clan's human admin team, which must review and validate the results before acting.

Personal data will be kept for as long as necessary to fulfil the purpose for which it was collected and, thereafter, for the periods required by applicable regulations or necessary to attend to potential liabilities.

As a guideline:

• Contact data: while the query is being handled and, thereafter, for the period necessary to address possible liabilities.
• Account data: for as long as the account remains active.
• Clan and player data synchronised from the official API: while the clan is being managed through the Platform or until deletion is requested, without prejudice to the original data continuing to be public in Supercell's own API.
• Internal notes, tags and evaluations: while the clan is being managed through the Platform or until the admin team deletes them.
• Ex-member history: for the time necessary to enable detection when they rejoin the clan, unless deletion is requested.
• Support data: for the time necessary to handle the incident and address possible liabilities.
• Informational communications data: until the user withdraws consent or requests to unsubscribe.
• Technical data and logs: for the time necessary for security, auditing, fraud prevention or incident resolution.

When data is no longer necessary, it may be deleted, anonymised or blocked in accordance with applicable regulations.

As a general rule, ClanManager does not sell, rent or transfer personal data to third parties for their own purposes without sufficient legal basis.

However, in order to provide the Service, certain data may be processed by external providers acting as processors or as necessary service providers.

The following may have access to personal data as applicable: providers of hosting and infrastructure, authentication, database, storage, transactional email, analytics, monitoring, fraud prevention, support, legal, tax or accounting advice and any technology provider necessary for the operation of the Platform.

Data may also be disclosed to public administrations, courts, tribunals, law enforcement authorities or other competent bodies when there is a legal obligation or valid request.

To provide the Service, ClanManager uses, among others, the following technology providers:

• Supabase: backend infrastructure, database, authentication, storage and related services.
• Lovable: development, deployment, hosting and technical integration of the application.
• Supercell (Clash Royale API): official source of the clan and player data from the Clash Royale game.
• External authentication providers (Google, Discord or others): when the user chooses to use them to sign in.
• Transactional email provider: sending operational emails (verification, password recovery, magic link, system notices).
• Analytics provider, if used: measuring use of the website and Platform, events, performance and product improvement.
• Security, monitoring, logs or backup providers: maintenance, abuse prevention, error detection and Platform security.

The specific list of providers may be updated periodically for technical, operational, legal or commercial reasons. The user may request up-to-date information by writing to legal@clanmanager.app.

Some technology providers may be located outside the European Economic Area or may process data from third countries.

Where international data transfers take place, ClanManager will endeavour to ensure they are carried out with appropriate safeguards in accordance with applicable regulations, such as European Commission adequacy decisions, standard contractual clauses, additional contractual, technical and organisational measures or adherence to recognised frameworks where applicable.

The user may request additional information about international transfers affecting their data by writing to legal@clanmanager.app.

ClanManager applies reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration, improper disclosure, destruction, fraudulent use or unauthorised processing.

Such measures may include, among others: HTTPS encryption for communications, role-based access control, secure credential management, row-level security (RLS) policies in the database, backups, activity logging, permission limitation by clan role, technical monitoring and incident response procedures.

However, no system connected to the internet can guarantee absolute security. The user must also take reasonable measures to protect their account, in particular by using strong passwords, safeguarding credentials and controlling internal access to the clan's admin team.

In the event of a security breach affecting personal data, ClanManager will act in accordance with applicable regulations.

Where the breach entails a risk to the rights and freedoms of natural persons, it will be notified to the competent supervisory authority under the terms established by law. Where it may entail a high risk, it will also be communicated to the affected data subjects, unless a legal exception applies.

Data subjects may exercise the following rights:

• Access: to know whether we are processing your data and to obtain information about that processing.
• Rectification: to request the correction of inaccurate or incomplete data.
• Erasure: to request the deletion of your data when it is no longer necessary, you withdraw consent or another legal ground applies.
• Objection: to object to processing in certain circumstances.
• Restriction of processing: to request that we restrict processing in certain cases.
• Portability: to receive the data you have provided to us in a structured, commonly used and machine-readable format, where legally applicable.
• Not to be subject to automated decisions with legal or similar effects, where applicable.
• Withdrawal of consent at any time, without affecting the lawfulness of prior processing.

You may exercise your rights by writing to legal@clanmanager.app.

Your request must include your name, the email associated with the account or request, the right you wish to exercise, the information necessary to identify your request and, where applicable, documentation to prove your identity if necessary.

A copy of an identification document will not be requested unless strictly necessary to verify the identity of the requester.

You may also modify certain data directly from your user account, when the Platform allows it. We will respond to your request within the deadlines established by applicable regulations.

If you consider that the processing of your personal data does not comply with the regulations or that your rights have not been properly addressed, you may lodge a complaint with the competent supervisory authority.

In Spain, the competent authority is the Spanish Data Protection Agency (www.aepd.es).

Use of ClanManager is aimed at persons of legal age. Minors are not authorised to register or to use the administration features of the Platform without the consent and supervision of their legal representatives.

If ClanManager detects that data has been collected from a minor without valid authorisation, it will take reasonable steps to delete such data.

ClanManager may send operational communications necessary for the provision of the Service (email verification, password recovery, magic link, security notices, legal changes) without additional consent, as they are essential for the contractual relationship.

Where informational or product update communications exist, they will only be sent where a legal basis exists. The user may object or unsubscribe at any time via the link included in the communication or by writing to legal@clanmanager.app.

The website uses cookies and similar technologies for technical and, where applicable, analytical or personalisation purposes, as detailed in the Cookie Policy.

The user may configure or refuse non-essential cookies via the management system enabled on the website. For more information, please consult ClanManager's Cookie Policy.

ClanManager may have a presence on social networks or external platforms, and the website may contain links to third-party services (for example, Supercell, the official Clash Royale website or community tools).

Data processing within each social network or external service is governed by the terms and privacy policies of that platform. ClanManager is not responsible for processing carried out directly by third parties. Before providing personal data on third-party sites, the user should review their privacy policies.

ClanManager reserves the right to modify this Privacy Policy to adapt it to regulatory, technical, commercial, operational or functional changes.

When the changes are relevant, we will endeavour to inform users via a notice on the website, an email or an in-Platform notification. The version in force will be the one published on the website at any given time.

For any query regarding this Privacy Policy or the processing of your personal data, you can contact us at:

• Email: legal@clanmanager.app
• Owner: Javier Díaz Permuy
• Address: C/ Sánchez Calviño, Ferrol, A Coruña, Spain
• Service: ClanManager
• Website: cr.clanmanager.app