Pi Privacy Policy

Pi (Partnership Insight) is a service provided by Bomba Events (hereafter “we” or “us”), registered with the Dutch Chamber of Commerce (KvK) under number 91844851, with its registered address at Maasstraat 106-3, 1078 HN Amsterdam, the Netherlands. This privacy policy explains what data we process, why, how long we retain it, and what rights you have.

Pi is an analytics platform for sports sponsorship. Sports clubs use Pi to make the performance of their social media content visible to their sponsors. To do this, we process data from the social media accounts of clubs that have explicitly authorized it.

1. Who is responsible for your data

The data controller is Bomba Events. For questions about this privacy policy or about your data, you can contact us at privacy@getpi.app.

2. What data we process

a) User account data
When a club employee creates an account or logs in, we process their name, email address and login credentials (stored encrypted). For brand partners who are granted dashboard access, we process name and email address.

b) Social media data from connected accounts
When a club connects a social media account (for example Instagram, Facebook, TikTok or YouTube), we process the following via the official APIs of these platforms:

• account-level statistics (reach, impressions, views, follower counts);
• content-level statistics (likes, comments, shares, views per post);
• post metadata (publication date, post type, caption, media URLs).

We process this data only after an authorized administrator of the relevant account has granted permission through the official authorization flow (OAuth).

c) Access tokens
To retrieve data periodically without requiring you to log in each time, we store the access tokens the platforms provide us. These tokens are stored encrypted (encrypted at rest). The encryption key is kept separate from the database.

d) Technical data
Like most services, we process limited technical data (IP address, browser type, time of access) for security and the proper functioning of the service.

3. What we use your data for

We use the data solely to:

• deliver the Pi service: displaying social media statistics in dashboards;
• enable clubs to report the performance of their content to sponsors;
• authenticate users and secure the service;
• maintain and improve the service.

We do not sell your data and do not use it for advertising.

4. Legal basis

We process data on the basis of:

• consent, for connecting social media accounts and retrieving the associated data;
• performance of a contract, for delivering the service to clubs and their users;
• legitimate interest, for security and the proper functioning of the service.

5. Sharing with third parties

We share a club’s social media statistics only with the brand partners that the club has explicitly granted access to the relevant dashboard. In addition, we use the following categories of processors, which act solely on our behalf:

• hosting provider and database (for storing and delivering the service);
• the social media platforms themselves (Meta, TikTok, Google/YouTube), as the source of the data.

We do not provide data to any other parties unless legally required to do so.

6. Use of platform data (Meta, TikTok, Google)

Our use of data received via the APIs of Meta (Facebook, Instagram), TikTok and Google (YouTube) complies with the respective platform terms, including the Meta Platform Terms and the Google API Services User Data Policy. We use this data solely to deliver the functionality described above and for no other purpose.

7. Retention

We do not retain data longer than necessary:

• account data: for as long as the account is active;
• social media statistics: for as long as the club uses the service and the account remains connected, to enable historical reporting;
• access tokens: until the account is disconnected or the token expires.

When an account is disconnected or a customer ends the service, we delete the associated data within 30 days, unless a legal retention obligation requires otherwise.

8. Deleting your data

You can request deletion of your data at any time. See our data deletion page or send a request to privacy@getpi.app. You can also disconnect a connected social media account yourself at any time within the Pi environment; doing so withdraws the consent you gave and we stop retrieving new data.

9. Security

We take appropriate technical and organizational measures to protect your data, including encrypted storage of access tokens, encrypted connections (HTTPS) and access control at the database level.

10. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, and objection. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). To exercise your rights, contact us at privacy@getpi.app.

11. Changes

We may update this privacy policy from time to time. The current version is always available on this page, with the date of the last change shown at the top.