Privacy Policy

1. Scope and our role

Athletic Connect provides software to sports organizations. Our responsibilities depend on which of two roles we are in, and the difference determines who you contact to exercise your rights.

• Controller. For this website, demo requests, sales contacts, and the administrator accounts we hold directly, we determine the purposes and means of processing. This policy governs that processing.
• Service provider and processor. For everything an organization enters into the platform, including rosters, registrations, schedules, evaluations, payment records, and uploaded media, the organization is the controller. We process it only on that organization's documented instructions and for no independent purpose of our own. Parents, guardians, participants, and staff should direct requests about that data to their organization, which can act on it directly in the platform. We support the organization in responding.

2. Information we collect

Account and business contacts. Name, work email, phone number, organization, role, credentials, and authentication and audit logs.

Participant and family records, entered by the organization. Participant name, date of birth, gender, program and team assignments, guardian names and contact details, emergency contacts, registration form responses, waivers and consents, attendance, coach evaluations, and photographs or video the organization uploads.

Transaction records. Invoices, amounts, dates, status, payment method type, the last four digits of the instrument, refunds, payment plans, and coach payout records.

Technical data. IP address, device and browser type, timestamps, pages and actions within the platform, and diagnostic logs.

We do not collect government identification numbers, health records, or precise geolocation. We do not require an organization to collect any category of information it does not need.

3. Minors

Records about minors are integral to this platform. Our commitments are specific:

• We do not collect personal information directly from children. Records about a participant are created by the organization or by a parent or guardian, and platform accounts are held only by adults aged 18 or over.
• We rely on the organization to obtain any verifiable parental consent required before entering a participant's information, and the organization warrants that it has done so.
• We do not send marketing to minors, use minors' information for advertising or profiling, or make it available to third parties for their own purposes.
• Access is limited by role. A coach sees the participants assigned to them, not the organization's full membership.
• A parent or guardian may review, correct, or request deletion of their child's records through the organization. Where an organization does not respond, contact us and we will engage with the organization directly.

4. How we use information

• To provide, maintain, and secure the platform and the features an organization has enabled
• To process registrations, invoices, payments, refunds, and coach payouts
• To send transactional communications, including receipts, schedule changes, and account and security notices
• To provide support and investigate faults
• To detect, prevent, and investigate fraud, abuse, and security incidents
• To comply with legal, tax, and accounting obligations
• To produce aggregated, de-identified statistics used to improve the platform. We do not attempt to re-identify this data and do not permit others to.

Where the law requires a legal basis, we rely on performance of a contract, our legitimate interest in operating and securing the service, compliance with legal obligations, or consent where consent is required.

5. We do not sell or share personal information

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use it to train third-party models. We have not done so in the preceding twelve months. There is no advertising on the platform.

6. Disclosure

We disclose personal information only as follows:

• Within the organization, to administrators, coaches, and staff according to their assigned role.
• To sub-processors engaged to run the service: cloud hosting, payment processing, transactional email and messaging, error monitoring, and customer support tooling. Each is bound by written terms limiting them to processing on our instructions, and is subject to confidentiality and security obligations no less protective than those in this policy.
• To comply with law, in response to a legally valid request. Where we are permitted to notify the affected organization, we will.
• In a corporate transaction, where the business or the relevant assets are acquired, subject to the acquirer honoring commitments no less protective than these.

7. Payments

Card and bank details are collected and stored by our third-party payment processor under its own terms. We do not receive or store full payment instrument numbers. We retain the transaction records an organization needs for its own accounting.

8. Retention

We retain platform data for as long as the organization's account is active and thereafter as the organization instructs. On termination, an organization may export its data for 30 days, after which the account data is scheduled for deletion. Deleted records may persist in encrypted backups for up to 35 days before those backups expire. We retain transaction and tax records for the period applicable law requires, and security logs for up to 12 months.

9. Security

We encrypt data in transit and at rest, enforce role-based access control and least-privilege access for our own personnel, log administrative access, and separate each organization's data. Access to production data is limited to staff who require it and is logged.

No system is perfectly secure. In the event of a personal data breach affecting an organization's data, we will notify that organization without undue delay and in any case within 72 hours of becoming aware, with the information the organization needs to meet its own notification obligations.

10. Your rights

Subject to your jurisdiction, you may have the right to access, correct, delete, port, or restrict processing of your personal information, to object to processing, and not to be discriminated against for exercising these rights.

If the information sits in an organization's account, contact the organization first. For information we hold as controller, write to hello@athleticconnectapp.com. We will acknowledge within 10 days and respond substantively within 30 days, extending only where the law permits and telling you if we do. We will verify your identity before acting, and we will not charge you unless a request is manifestly unfounded or excessive. You may use an authorized agent where the law allows.

You can unsubscribe from marketing email at any time. Transactional and security messages about your account and your child's programs are not marketing and will continue.

11. Cookies

We use cookies strictly necessary for authentication, session integrity, and security, and a limited set of first-party analytics to understand feature usage. We do not use advertising or cross-site tracking cookies. We honor Global Privacy Control signals, though in any event we do not sell or share personal information.

12. International transfers

We process and store data in the United States. Where we receive personal information from another jurisdiction, we rely on an appropriate transfer mechanism and apply this policy regardless of where the information originated.

13. Changes

We will post any revision here and update the date above. For a material change we will notify account administrators in advance of the effective date.

14. Contact

Privacy questions, rights requests, and security reports: hello@athleticconnectapp.com.