Maiden is a cricket-club administration tool operated by Core Integrations Ltd, a company registered in England and Wales. This notice explains what personal information we collect when you or your club uses Maiden, why we collect it, and the choices you have about it.
We are the data controller for information we collect about club admins and club members in our role as the service provider. Where a cricket club uses Maiden to manage its own members, the club is the data controller for that member roster and Maiden acts as a data processor on the club’s instructions.
1. What we collect
From club admins (people who sign in)
- Name and email address (via Clerk, our authentication provider).
- The clubs you administer, your role at each, and when you joined.
- Audit trail of actions you take in the app (creating fixtures, editing members, etc.).
- Billing details if your club pays for Maiden (handled by Stripe; we never see your card number).
From club members
- Name, email, phone, age, cricketing role, sides — whatever the club admin enters or imports.
- RSVP history, selection history and ball-by-ball scoring records.
- Payment history when the club collects fees via Maiden.
- Web Push subscription tokens if a member opts in to notifications on their device.
From everyone visiting the site
- Standard request logs (IP address, user agent, timestamp) held by our infrastructure provider Cloudflare.
- No third-party analytics, no advertising trackers.
2. Why we use it
- Run the service. Authenticate sign-ins, render the right club’s data to the right people, send transactional notifications a club asks us to send on its behalf.
- Bill paid clubs. Process subscription payments via Stripe.
- Process member payments. When a club has connected Stripe, transfer member dues to the club’s connected account.
- Keep the service secure. Detect abuse, rate-limit AI suggestion endpoints, audit administrative actions.
- Improve the product. Aggregate, non-identifying statistics about feature usage. We don’t profile individuals.
3. Who we share it with
We use a small number of subprocessors who handle data on our behalf:
- Cloudflare — hosting, edge network, database (D1), storage (R2).
- Clerk — authentication, sign-in / sign-up flows.
- Stripe — subscription billing and member payments.
- Resend — transactional email delivery (member invites, receipts).
- Anthropic — AI-powered commentary suggestions (only the scoring context for the current ball is sent, no PII).
We do not sell personal data, and we don’t share it for advertising purposes. We will hand over information when legally required (e.g. a valid court order), and we’ll tell the affected club where we are permitted to do so.
4. International transfers
Most of our infrastructure runs on Cloudflare’s edge network. Data may be processed in countries outside the UK / EEA. Where that is the case, transfers are covered by Standard Contractual Clauses or the UK’s equivalent IDTA.
5. How long we keep it
- Account data — for as long as you have an active account. When you delete your account we remove it from our database; backups age out within 30 days.
- Cricket history — fixtures, results, scoring records are kept for the lifetime of the club, since clubs reasonably expect their match history to outlive any individual admin.
- Audit logs — 24 months.
- Payment records — 7 years to satisfy UK financial-record requirements.
6. Your rights
Under UK GDPR you can ask us to access, correct, delete or export the personal data we hold about you, or restrict how we use it. To exercise any of these rights, email privacy@vitako.co.uk. We aim to respond within 30 days. If you’re a club member, your first port of call is usually the club itself (since they hold the relationship); we can step in if the club doesn’t respond.
You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk).
7. Children
Maiden is used by junior cricket programmes. Where members are under 13 we expect the club to be operating with parental consent and to use the guardian-proxy feature so a parent (not the child) holds the login. Clubs are responsible for obtaining appropriate consent before adding anyone under 13 to their roster.
8. Changes to this notice
We’ll post material changes here with a new effective date and, where appropriate, notify club admins by email. Continued use of the service after a change indicates acceptance of the updated notice.
9. Contact
Core Integrations Ltd · hayden@vitako.co.uk