Terms of service.

1. Who we are

gelvik is a service of owise UG (haftungsbeschränkt) i.Gr., Bennigsenstraße 30, 31275 Lehrte, Germany, email: [email protected] ("we"). These terms apply to the use of the gelvik app at app.gelvik.com and to every plan, for consumers and for businesses.

2. What gelvik does

A team sets up its logo, colours and roster once. gelvik turns every match into finished graphics in several formats, to download or to post to Discord. What each plan includes is shown in the pricing section of gelvik.com and on the app’s Billing page. Features listed there as "coming soon" are not part of the contract until they are available.

3. Account and team

You must be at least 16 to have an account. An account can be in several teams. Every team has at least one owner; only an owner can buy, change or cancel a paid plan. Keep your sign-in to yourself: whoever signs in with your sign-in link acts in your account.

4. Plans and prices

There is a free plan (Free) and paid plans (currently Pro and Org), monthly or yearly. Prices are shown in the pricing section in euros excluding VAT; tax is added at checkout for your country. Free puts a small gelvik badge on the graphics. There is no trial: Free is the trial, and where it can the app shows paid features beforehand as a preview with a watermark.

5. Purchase through Paddle

Paid plans are sold by Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom ("Paddle"), as reseller and Merchant of Record: your purchase of a plan is made with Paddle, which takes the payment, issues the invoice and handles VAT. Paddle’s buyer terms apply to the purchase as well (https://www.paddle.com/legal/buyer-terms). These terms apply to the use of gelvik itself. You enter payment details only at Paddle; we neither see nor store them.

6. Term, renewal and cancellation

A paid plan runs for one month or one year and renews automatically for the same period until it is cancelled. An owner can cancel at any time on the Billing page. The plan then runs until the end of the paid period; after that the team is on Free. Until then the cancellation can be taken back.

7. Changing plans

A change from monthly to yearly always takes effect at once. Otherwise: a dearer plan takes effect at once, and Paddle charges the difference for the rest of the period; a cheaper plan, or yearly to monthly, takes effect when the paid period ends, and nothing is charged until then. Moving to a smaller plan deletes no data: members above the new number of seats stay members; only new invitations wait until a seat is free.

8. Failed payments

If a payment fails, Paddle tries again automatically and sends reminders by email, and the plan stays meanwhile. If the payment does not come, the paid plan ends, usually after about 30 days, and the team is on Free.

9. Refunds

Within 14 days of a payment we refund it without asking why, through Paddle. This applies to every payment, renewals included. Details are in the refund policy. Statutory rights, such as a consumer’s right of withdrawal, are not affected.

10. Your content

Logos, colours, names, player data, sponsor logos and match data that a team uploads or enters remain the team’s content. The team grants us the rights we need to store them and to make the graphics from them, for the team only. The team confirms that it holds the rights to its logos and sponsor logos and that it may use its players’ data; a player photo requires the team admin to confirm consent (once player photos are available). The team is responsible for its players’ data; we process it on the team’s behalf. The data processing agreement in Annex 1 applies to this; it is concluded by accepting these terms.

11. Finished graphics

The team may use the finished graphics freely, commercially too, for example for sponsors. On Free they carry the gelvik badge, which must not be removed.

12. What is not allowed

gelvik must not be used for unlawful content, for content that infringes others’ rights, or for logos and marks the team may not use. Automated access to the app outside its interface is not allowed. On a breach we may remove content and, after notice, suspend an account or team.

13. Availability and changes

We work to keep gelvik available but do not promise a particular availability. We keep developing gelvik and may change features. What a paid plan included when it was bought is not taken away during the paid period.

14. Liability

We are liable without limit for intent and gross negligence, for injury to life, body or health, and under the German Product Liability Act. For slight negligence we are liable only for breach of an essential contractual duty, limited to the foreseeable damage typical for the contract.

15. Deleting an account or team

An owner can delete a team in the app. Every member can delete their own account once they have handed over or deleted any team of which they are the only owner. When an owner deletes a team with a paid plan, the plan ends at once; if Paddle cannot end it, the team is not deleted. The rest of the paid period is not refunded pro rata, except within the 14 days of section 9. What we keep afterwards, and for how long, is in the privacy policy.

16. Changes to these terms

If we change these terms, we tell the owners by email at least six weeks before the changes apply. Until then an owner can object; they may then cancel a paid plan as of that day at no cost, and we may end the contract as of that day too. If nobody objects, the changes apply from the day named; the email points this out.

17. Law and jurisdiction

German law applies. For consumers this applies only insofar as it does not deprive them of the protection of mandatory provisions of the country where they live. If the team is a business, a legal entity under public law or a special fund under public law, the place of jurisdiction is the registered office of owise UG (haftungsbeschränkt).

Annex 1: Data processing agreement (Art. 28 GDPR)

Between the team, represented by its owners ("controller"), and owise UG (haftungsbeschränkt) i.Gr. ("processor", "we").

1. Subject and duration

We process personal data the team enters in gelvik so that gelvik makes graphics from it, stores them, makes them available for download and, when the team asks, posts them. The agreement applies as long as the team uses gelvik and ends when the team is deleted.

2. Types of data and data subjects

The data subjects are the team’s players, including players under 18. Processed are: handles, roles, the "under 18" flag, a match’s lineup, match data that names players, and the graphics made from them. Player photos, once available, only after the team admin confirms consent. gelvik does not ask for real names.

3. Instructions

We process the data only on the team’s instructions. The instructions are this agreement and what an owner or member does in the app (entering, changing, deleting, downloading, posting). Further instructions come by email to [email protected]. If we consider an instruction unlawful, we tell the team.

4. Confidentiality

Everyone at our end with access to the data is bound to confidentiality.

5. Technical and organisational measures

We take the measures under Art. 32 GDPR described in Annex 2.

6. Sub-processors

The team agrees to these sub-processors:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany: servers, database and storage, in data centres in Nuremberg and Falkenstein.
• Backblaze, Inc., USA: backups in the region eu-central-003 (Amsterdam, the Netherlands). A transfer to the USA relies on the European Commission’s Standard Contractual Clauses (Art. 46 (2) (c) GDPR, Module Two), which are part of Backblaze’s data processing addendum.
• Cloudflare, Inc., USA: passes requests to the app through and protects it; keeps no copy of the content. Certified under the EU-US Data Privacy Framework.
• Sand Dune Mail Ltd (SMTP2GO), 96–106 Manchester Street, Christchurch 8011, New Zealand: sending the app’s emails, through servers in the EU; New Zealand has an adequacy decision of the European Commission.

We announce a new sub-processor to the owners by email at least four weeks in advance. An owner can object; they may then cancel a paid plan as of that day at no cost.

7. Assistance

We assist the team with requests from data subjects (access, correction, erasure), with the security of processing and with notifications to authorities. Much of this the team can do itself in the app: change and delete players, delete matches, delete the team.

8. Personal data breaches

If we learn of a breach of the team’s personal data, we tell the owners by email without undue delay, with what we know about it.

9. Deletion

When the team deletes a player, a match or itself, we delete the data in the database at once and uploaded files (logos) within 30 days. Graphics are made when they are needed; their cache keeps them for at most 30 days. The data remains in the database backups for up to about 35 days, after which it is deleted. Uploaded files are backed up encrypted every night; deleted files remain in these backups for up to about 31 days. Error reports, from which email addresses and, as far as they are recognised, names of teams and players are removed before they are sent, are kept for 90 days, and in the backups of the server that receives them for up to about six months. We keep no other copies unless the law requires it.

10. Evidence

On request we give the team the information it needs to show that this agreement is kept. An inspection on site is agreed with the team in advance.

Annex 2: Technical and organisational measures (Art. 32 GDPR)

1. Locations

The app and its database run on servers of Hetzner Online GmbH in Nuremberg, Germany. Error reports and monitoring run on Hetzner servers in Falkenstein, Germany. The database backups are stored at Backblaze in the region eu-central-003 (Amsterdam, the Netherlands).

2. Physical access

Hetzner runs the data centres; we have no physical access of our own.

Hetzner is certified to ISO/IEC 27001 for its hosting services and its data centres in Nuremberg and Falkenstein.

3. Access to the servers

• Administrative access to the servers only through a private network (VPN) whose sign-in expires after 24 hours, or through the hoster’s console with the founder’s account.
• SSH with keys only; password sign-in is switched off. Signing in as administrator (root) is possible with a key only, too.
• Only one person, the founder, has access. Tools he uses for it work only with his access and in his session. A separate access for releases can only upload releases.
• A firewall on the app’s server and on the database server refuses everything not expressly allowed. No port is open to the outside: the app is reached only through a Cloudflare tunnel, the database only in the private network and only from the app's server.

4. Access in the app

• Every query is limited to one team; a team sees no other team's data.
• Two roles, owner and editor; members, channels and deleting the team for owners only.
• Sign-in without a password through a one-time link; a session ends after at most 30 days; the session cookie cannot be read by scripts and is sent over HTTPS only.
• Sign-ins and invitations are rate-limited.
• A security log records who did what in which team, with ids only and no addresses; it is deleted after 90 days.

5. Transfer

• Connections to the app are encrypted with TLS.
• The connection from the app to the database is encrypted with TLS (1.2 or higher); the app checks the database server's certificate and name and makes no connection without both.
• Database backups are encrypted with AES-256 before they are uploaded.
• The app's emails go through SMTP2GO's servers in the EU.

6. Separation

• Teams' data is separated by team in every query.
• Credentials are kept in a self-hosted secrets manager, production's in a project of its own; a release reads them only when it is deployed.

7. Availability

• The database is backed up in full every week and differentially every day, its changes continuously (at least every minute).
• Uploaded files are backed up encrypted every night; deleted files remain in these backups for up to about 31 days.
• Each database backup file is locked against deletion and change for 7 days after upload.
• From November 2026, restoring the database is tested automatically every month; an alert reports when the last test is more than 35 days old.
• Monitoring reports by email to the founder: the app or the database unreachable, disks more than 85 % full, certificates about to expire, failing archiving of changes, a backup that is too old and a restore test that is too old.
• On the app’s server and the database server, operating system security updates are installed automatically every day.

8. Deletion and data minimisation

• gelvik does not ask for real names; players are recorded by handle, and photos are not needed.
• Deleting a team deletes its data in the database at once and its uploaded files (logos) within 30 days; the data remains in the database backups for up to about 35 days.
• Graphics are made when they are needed; their cache keeps them for at most 30 days.
• Email addresses and, as far as they are recognised, names of teams and players are removed from error reports before they are sent; they are kept for 90 days, in the backups of their server for up to about six months.
• The app's web server writes no access log. On an error it records the request concerned, with the caller's address, in the system log, which is deleted after 30 days.
• Operational metrics contain no teams' data and are kept for 30 days.