Privacy Policy

1. Controller

ProProspect, Portugal. Contact: privacy@proprospectapp.com.

2. What we collect

• Account data: name, email, role, date of birth, country, language.
• Athlete profile: sport, position, club, seasonal stats, biometrics, highlights, documents (academic/medical when required by a program).
• For minors under 16: parent name, parent email, and a Stripe payment record proving parental consent (GDPR Art. 8).
• Usage: pages viewed, features used, contact quotas, device/browser metadata.
• Communications: messages exchanged inside the platform, support tickets.

3. Legal bases (GDPR Art. 6)

• Contract: to operate your account and deliver paid features.
• Consent: for optional marketing/social features (weekly-winner reuse), analytics cookies.
• Legal obligation: tax records, GDPR Art. 8 parental consent proof, SafeSport MAAPP records for U.S.-facing contact.
• Legitimate interest: fraud prevention, platform security, quota enforcement.

4. Minors (under 16)

We enforce a hard age-gate. Accounts of users under 16 are invisible to third parties by default. Any communication with an agent or International Program requires prior parental approval via the parent portal. We collect proof of parental consent through a Stripe micro-charge of €0.50, refunded immediately. Records are retained for the minor's account lifetime + 3 years to demonstrate compliance.

5. SafeSport / MAAPP (U.S. contact)

When a U.S. coach or program communicates with a minor, we retain those communications for 7 years as required by the U.S. Center for SafeSport MAAPP.

6. Sharing

• Coaches, agents and programs you contact or that your parent has approved.
• Stripe (payments), Supabase (hosting/database, EU region), Mailgun (email), Cloudflare (edge/CDN).
• Authorities when legally required.
• We never sell personal data.

7. International transfers

Data is primarily processed in the EU. Where subprocessors operate outside the EEA, we rely on EU Standard Contractual Clauses.

8. Retention

• Active account: kept until you delete it.
• Deleted account: 30 days grace, then hard-deleted, except records required by law (tax, minors consent, SafeSport).
• Highlights and documents: deleted with the account unless a program has an active pending case.

9. Your rights (GDPR Art. 15–22)

• Access, rectification, erasure, restriction, portability, objection.
• Withdraw consent at any time (does not affect prior processing).
• Complain to the Portuguese CNPD (www.cnpd.pt) or your local authority.

10. Security

Encryption in transit (TLS) and at rest, row-level security on all tables, private storage buckets for academic/medical docs (signed URLs only), least-privilege service keys, audit logs for admin actions.

11. Contact

privacy@proprospectapp.com · legal@proprospectapp.com