1. Who we are
Boundary Social is a poster studio for cricket clubs operated from the United Kingdom. We are the data controller for the personal data described in this notice. For data-protection questions or to exercise any of the rights set out in section 8, email clubs@boundarysocial.co.uk.
2. What we collect, and why
When you fill in the contact form
- Your name · so we know who we're replying to.
- Your email address · the only way we can reply.
- Your league or association (optional) · to tailor the conversation.
- The size of your club network (optional) · to gauge how we can help.
- Your message · so we know what you're asking.
Lawful basis: consent (UK GDPR Art. 6(1)(a)) · you tick the box on the form, we use the data to reply, you can withdraw consent at any time by emailing us.
When you create a Studio account
- Your email address · used to sign you in and send password-reset / magic-link emails.
- A password hash (we never see your actual password · it's salted and hashed by our auth provider before storage).
- The club identity you create (club name, sponsors, palette, fixtures, designs).
- An "is platform admin" flag if you are a member of the Boundary Social team.
Lawful basis: contract (UK GDPR Art. 6(1)(b)) · this data is necessary to provide the Studio service you signed up for.
When you subscribe to the Done For You service
When your club hires us to create matchday graphics, you send us match information · fixtures, results, scorecards, player names, sponsor logos and (for adult players) photographs. We use that information solely to produce the social media graphics you've contracted us to deliver, and we deliver them back to you for approval.
Our role under UK GDPR is data processor; your club is the data controller. That means your club decides what we work with, what gets published, and when. We act on your documented instructions, never independently. We do not pull match data from any third-party platform. We do not enrich, sell or share what you send us.
Photographs · strict policy. We never include photographs of anyone under 18 in any graphic we produce. No exceptions. Junior achievements are recognised with name and stat graphics only. For adult players, your club is responsible for ensuring it holds the necessary consents before supplying images to us. Photographs you send us are deleted within 30 days of delivering the final graphic · we do not build or retain a player image library.
We will also refuse to produce graphics that include: injury or medical detail, disciplinary or banned-player content, named opposition juniors, or unverified allegations. We will politely suggest a safer alternative.
What we don't collect
- We don't use third-party analytics or advertising cookies (no Google Analytics, no Meta Pixel, no fingerprinting).
- We don't track you across other websites.
- We don't ask for, or store, payment card details ourselves · if and when paid plans launch, a regulated payment processor will handle them.
- We don't ask for personal information about your club members · the designs you create with the Studio are yours and may contain such data, but we treat them as your data and don't read or mine them.
3. How long we keep your data
- Contact-form enquiries · kept for 12 months from your last reply, then deleted, unless you become a Studio customer in which case it merges into your account record.
- Studio account data · kept for as long as your account is active. If you ask us to close your account, we delete your sign-in record and all associated club designs within 30 days. We may keep an anonymised audit-log entry (no personal data) for security and abuse-investigation purposes.
- Backups · operational database backups are kept for 30 days and then overwritten. Your data will be removed from backups in the normal rotation after that period.
4. Who we share data with
We are a small team and we keep the list of sub-processors short. Each one is contractually bound to UK GDPR-equivalent protections.
- Supabase (Singapore, with EU data residency for our project) · database + authentication. supabase.com/privacy
- Vercel (USA · operates a global edge network) · website hosting. vercel.com/legal/privacy-policy
- Resend / Amazon SES · transactional email delivery (sign-up confirmations, password resets, reply-to-contact-form). resend.com/privacy-policy
- GitHub (USA, Microsoft) · source-code hosting (does not hold customer data).
Where data leaves the UK, we rely on the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, plus each provider's own technical safeguards. We do not sell personal data to anyone, ever.
5. Cookies
We use only strictly-necessary cookies: an authentication session token set by our auth provider when you sign in to the Studio. This token is used to keep you logged in and to enforce row-level security in our database. It expires when your session ends.
We do not use analytics, advertising, or fingerprinting cookies, so we are not required to show a consent banner under PECR. If that changes, we will add one before any non-essential cookie is set.
6. Security
- All traffic is served over HTTPS (TLS 1.2+) with HSTS preload.
- Database access is enforced via row-level security policies that prevent cross-tenant access · even if our application code had a bug, the database itself refuses to return another club's data.
- Passwords are hashed with bcrypt by our auth provider and a leaked-password check (HaveIBeenPwned) is enforced on sign-up.
- We do not have, store, or transmit any service-role API keys in client code. All privileged operations go through SECURITY DEFINER database functions with explicit permission checks.
- If we suffer a personal-data breach that risks your rights and freedoms, we will notify the ICO within 72 hours and email you without undue delay.
7. Children & safeguarding
Boundary Social's services are intended for cricket-club administrators (typically adults). We do not knowingly collect personal data directly from children under 13. If you believe we have collected such data in error, email us and we will delete it.
For graphics we produce for paying clubs, we follow a strict no-photos-of-under-18s policy. We never publish a photograph of anyone under 18 in any graphic, regardless of consent supplied. Junior achievements (first wicket, half-century, squad selection) are recognised with name and stat graphics only · no faces. This aligns with ECB Safe Hands guidance and reduces safeguarding risk to the lowest practical level.
Club administrators supplying us with junior player names and performance information warrant they are authorised to do so for the purpose of club social media. If you have any concern about how a junior is represented in a graphic we have produced for your club, contact us and we will withdraw or amend it the same working day.
8. Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you
- Rectify data that is inaccurate or incomplete
- Erase data ("the right to be forgotten") · subject to legal retention obligations
- Restrict how we process your data
- Object to processing
- Data portability · receive your data in a structured, machine-readable format
- Withdraw consent at any time, where consent is the lawful basis
To exercise any of these, email clubs@boundarysocial.co.uk. We will respond within one calendar month.
You also have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
9. Changes to this notice
We will update this notice if our practices change. Material changes will be flagged on the home page and emailed to active Studio account holders at least 14 days before they take effect. The "Last updated" date at the top of the page is always the canonical version.
10. Contact
Questions? Email clubs@boundarysocial.co.uk. We reply within 24 hours, weekdays. Most weekends too · we're cricketers.