Privacy policy

Last updated 8 August 2026

This page explains what AgentFlow collects, why, how long it is kept and who else processes it. It is written to be read, not to be survived. If anything here is unclear, write to contact@agentflowsports.com and a human will answer.

Who is responsible

AgentFlow is operated by a FIFA-licensed football agent. For any question about this page, about your data, or to exercise your rights, write to contact@agentflowsports.com.

What we collect, and why

Your account

Email address and password to sign you in. The password is hashed by our authentication provider and is never visible to us. Optionally your name, phone number, postal address, agency and country, which are used to prefill the agent section of the mandates you create.

Licence verification, if you request it

Your FIFA Agent ID, a copy of your licence and an identity document. These exist for one purpose: letting us check that you are who you say you are. Your identity document is deleted as soon as the check is decided, whether it is approved or rejected. We never keep it. Your licence is kept only if you are verified, so that you can download it again from your account; it is a professional credential already published in FIFA’s own register. If your check is rejected, both files are deleted.

The mandates you create

The player’s name, date of birth, address and optionally a photograph, along with the commercial terms: dates, services, percentages, exclusivity, territories, governing law.

Players are usually not our users. We process their data on your instructions, so that the document you are drafting can exist. Informing your player that their data appears in AgentFlow, and obtaining whatever consent your own obligations require, is your responsibility as their agent. If a player contacts us directly we will help them exercise their rights, and we will tell you.

Signatures

When a mandate is signed, we record the signer’s name, email address, the signature image, the date and time, the IP address and the browser used. This is the proof that the signature happened, and it is embedded in the resulting PDF. It cannot be removed without destroying the value of the document itself.

Payment

Card details are handled entirely by Stripe and never reach our servers. We store your Stripe customer and subscription identifiers, your plan, its status and its renewal date.

The free mandate generator

If you use the public generator without an account, we store the email address you enter to send you the PDF, the player name, and the draft itself, so that the mandate can be moved into your account if you later sign up with the same address.

Technical data

Request counters per account, to enforce rate limits. Error reports, which may incidentally contain technical context about a failed request.

The public FIFA agent registry

We hold a copy of the publicly published FIFA football agent registry: licence number, name, agency, country and status. It is used to enrich a verified agent’s profile with their official details. If you appear in it and would rather not, write to us and we will remove your entry.

Cookies and tracking

We run no analytics and no advertising trackers. Your session is kept in your browser’s local storage so that you stay signed in. Stripe sets its own cookies on the payment form for fraud prevention. That is all, which is why you are not being asked to accept anything.

How long we keep things

• Mandates and their signatures: five years after the mandate’s end date, which is the window in which a dispute over a commission can realistically arise.
• Identity document: deleted as soon as the verification is decided, always. Licence: kept while your account exists if you are verified, deleted otherwise.
• Account data: for as long as your account exists.
• Free generator drafts and lead emails: until you ask us to delete them, or the draft is claimed by an account.
• Error reports: as long as our error provider retains them, currently 90 days.

Who else processes your data

We use a small number of providers, each for one job:

• Supabase, database, authentication and document storage.
• Vercel, hosting of the website and its API.
• Stripe, payments and subscription management.
• Resend, transactional email delivery.
• ImprovMX, forwarding of email sent to our own addresses.
• Sentry, error monitoring.

Some of these are established outside the European Union. Where that is the case, transfers rely on the European Commission’s standard contractual clauses. We do not sell data, and we do not share it with anyone else.

Your rights

You can ask for a copy of your data, correct it, delete it, take it elsewhere, or object to a particular use. Write to contact@agentflowsports.com and we will answer within one month.

One honest limit: a signed mandate is a contractual record and cannot simply be erased on request while it is still enforceable. We will explain what can be removed and what cannot, and why.

If our answer does not satisfy you, you can lodge a complaint with your national data protection authority. In France that is the CNIL.

Minors

AgentFlow is for licensed professionals, so our users are adults. Mandates, however, can concern minor players. Their data receives the same treatment as any other data described here, and the additional protections owed to a minor under the FIFA regulations and applicable national law are your responsibility as their agent.

Security

Data is encrypted in transit. Verification documents are stored in a private bucket that only their owner and the administrator can reach, and only for as long as the check is running. Access to production data is limited to the operator of the service.

Changes

If this policy changes in a way that matters, we will say so by email rather than quietly changing the date at the top.