DebutoryPrivacy Policy
This policy is in force. Sections marked “not yet in effect” describe processing that begins when we publish our first player profile — we have not published one yet. That part of the text is with a lawyer for review, and we will update this page before it starts to apply.
Who we are
Debutory is operated by KC Horology LLC, a company registered in the United Arab Emirates. We operate the Instagram account @debutory and this website. This Policy explains what data we collect, what we do with it, where it goes, and how long we keep it.
Information we collect
When you message or interact with @debutory, we process your Instagram username, basic profile information and the content of your messages via the Meta Graph API. If you leave your email address on our website, we store that address, the page you left it on and the date — nothing else. On the website we also collect technical and usage data and cookies. We do not ask anyone to send us a child's name, age or club through a form, and our forms have nowhere to put them.
Use of AI
We use AI tools to generate content and to help draft or automatically send replies. A reply from @debutory may be generated by an AI system and is provided for general information only.
Children and minors
A young player is featured only with the consent of a parent or legal guardian, given before anything is published. The guardian signs the consent, not the player. We collect only the minimum data necessary and never knowingly collect unnecessary data about children. A guardian may withdraw consent at any time, and withdrawal takes the profile down.
Public player profiles (not yet in effect)
When we feature a player, their profile is published on a permanent page on this website, accessible to anyone and indexed by search engines. That is a separate decision from posting on Instagram, and it requires its own separate consent: agreeing to appear in a post is not agreeing to a permanent public page.
Long-term monitoring (not yet in effect)
After a profile is published we continue to follow publicly available information about that player's career — transfers, debuts, call-ups, match statistics, public social media following — and update the profile with it. This continues until consent is withdrawn.
Derivative products and licensing (not yet in effect)
Material we produce may be used in printed and digital products and may be provided to third parties under licence, but only where the consent we hold covers that specific use. Consent is recorded as separate permissions — public profile, merchandise, licensing, use in datasets — and each can be granted or refused on its own.
Legal basis
For minors, and for any material we produce about a player, our legal basis is consent given by a parent or legal guardian. For publicly available information about professional sporting activity, our legal basis is legitimate interest. Where we rely on consent, you may withdraw it at any time, and withdrawal does not affect processing that already happened.
How long we keep it
Published material and the record of what we published, and when, are kept indefinitely as a historical archive — that permanence is the point of the record. The exception is withdrawal of consent: on withdrawal we take the profile down and delete the material as described on our Data Deletion page. Email addresses left on the website are kept until you ask us to remove them.
Where your data is processed
The company is registered in the United Arab Emirates. Data is processed in the European Union (our database is hosted by Supabase in the eu-north-1 region) and in the United States (website hosting by Vercel, and Meta for Instagram). The UAE does not have a European Commission adequacy decision, so transfers there rely on an appropriate safeguard under Chapter V of the GDPR. Ask us at privacy@debutory.com and we will tell you which mechanism applies to your data.
Representative in the European Union
Article 27 of the GDPR requires a company established outside the EU that processes the data of people in the EU to appoint a representative there. We are arranging this, and the representative's name and address will be published in this section before we publish our first player profile.
Your rights
If the GDPR applies to you, you have the right of access to your data, and rights to rectification, erasure, restriction of processing, data portability, and objection to processing. Where processing is based on consent, you may withdraw that consent at any time. You also have the right to lodge a complaint with your national supervisory authority. To exercise any of these, write to privacy@debutory.com; see also our Data Deletion page.