Privacy Policy
Last updated: Sunday, May 10
This Privacy Policy explains how SportSYNC collects, uses, and shares personal data when you use the Service. We act as a data "controller" for some processing (e.g. our marketing site, account signup) and as a "processor" on behalf of the academy when you use the Service for academy operations — see our Data Processing Agreement for the latter.
1. Data we collect
Account data: email address, name, role, academy assignment, hashed password. Profile data (academies provide): players' names, dates of birth, parent/guardian contacts, photos, notes, medical records (allergies, conditions, emergency contacts), evaluations, attendance, payments, requests. Usage data: error reports, IP address, request paths, user-agent string. Cookies and similar: see our Cookie Policy.
2. How we use your data
We use personal data to (a) provide and operate the Service, (b) authenticate users and enforce permissions, (c) communicate about service-related events (password resets, billing, security), (d) detect and prevent fraud or abuse, (e) comply with legal obligations, (f) improve the Service through aggregated analytics. We do not sell personal data, ever.
3. Legal basis (GDPR)
We rely on the following legal bases under GDPR: contract (operating the Service), legitimate interest (security, fraud prevention, product improvement), legal obligation (tax, accounting, child-protection compliance), and consent (only where explicitly requested, such as marketing email opt-in).
4. Sub-processors
We use the following third-party processors to operate the Service: Vercel (application hosting; United States), Neon (PostgreSQL database; United States), Cloudflare R2 (file storage), Sentry (error tracking), Upstash (rate limiting). All sub-processors are bound by contractual confidentiality and data-protection obligations. The current list and any changes are published in the DPA.
5. International data transfers
Some of our sub-processors may host data outside your country. Where required, we rely on Standard Contractual Clauses or equivalent mechanisms to lawfully transfer personal data internationally. [REVIEW: confirm SCC arrangements per region with counsel.]
6. Data retention
Account data is retained for as long as your account is active and for 30 days after deletion. Operational data (attendance, evaluations, invoices) may be retained by the academy as long as they require it for academy operations or to meet legal obligations. Marketing-site signup data (Lead model) is retained for 24 months unless you ask us to delete it sooner.
7. Your rights (GDPR)
You have the right to: access your personal data, correct inaccurate data, request deletion ("right to be forgotten"), restrict or object to processing, request data portability (machine-readable export), and lodge a complaint with your supervisory authority. To exercise any of these rights, visit Settings → Privacy or email hello@sportsync.app. We respond within 30 days.
8. Children's data
The Service is used by academies to manage data about children. The academy is the data controller for children's data; we are the processor. We require academies to obtain parental consent before adding children's data, and we apply enhanced safeguards (encryption at rest and in transit, role-based access, audit trails for medical records). Parents may exercise their child's GDPR rights by contacting their academy or us at hello@sportsync.app.
9. Security
We protect personal data using industry standards: TLS 1.2+ in transit, AES-256 at rest, hashed passwords (bcrypt), rate-limited authentication, principle-of-least-privilege access, and continuous error/security monitoring (Sentry). No system is 100% secure; in the event of a personal-data breach we will notify affected users and supervisory authorities within 72 hours per GDPR Article 33.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify users of material changes by email or in-app notice at least 14 days before they take effect.
11. Contact us
Privacy questions or rights requests? Email hello@sportsync.app. [REVIEW: For EU users, designate a Data Protection Officer if processing volumes warrant; confirm with counsel.]