Privacy

1. Who is responsible for the data

Your Academy is the controller of the data it enters about you and your children, and of what is created inside its academy. Elite Academy processes it as a processor, under a data processing agreement with the club.

Elite Academy is the controller of: login credentials and login history, billing, security logs and support correspondence.

Data protection contact: privacy@joineliteacademy.com.

2. What data we hold

• Parent: name, email, phone; linked children; attendance answers; availability periods; read status; device and app version. Source: the Academy, then the Parent.
• Player: name, date of birth; team for the season; attendance, appearances, goals, assists; chosen focus; slider readings; reflections (recording or text, and transcript); XP, streaks, stickers; profile photo (if approved); username (never an email). Source: the Academy (name, date of birth), the Player, the Parent (activation).
• Coach and Team Admin: name, email, phone; team assignments; voice recordings and transcripts; reflections, feedback, private notes; match records. Source: the Academy, then the person.
• Club Admin: name, email, phone; console actions (logged).
• Everyone: login history, IP address, device identifiers.

We do not ask for special-category data (such as health). A reflection may contain anything the child says — we treat it as the most sensitive thing we hold (section 5). Reasons for absence come from a fixed list with no health category.

3. Purposes and legal bases

• Running the Academy (enrolment, teams, seasons, schedule, attendance, call-ups, results): legitimate interest and the contract with the family.
• Account and login: contract; Elite Academy is the controller.
• The Player's growth loop: the Parent's consent for a child under 16, given at account activation.
• Coach voice note, feedback, team reflection: the Academy's legitimate interest in developing players.
• Monthly report and parent guidance: the Parent's consent (and, once paid, the contract).
• The Player's profile photo: the Parent's consent, which can be withdrawn separately.
• Match photos: the image consent the Academy holds; showing them to the team in the app is a legitimate interest.
• Notifications: contract; marketing messages only with consent.
• Security and abuse prevention: Elite Academy's legitimate interest.

4. Children

• In Poland a person may consent to online data processing on their own from the age of 16. For every Player under 16 the Parent consents. In the pilot every Player's account is activated by the Parent, whatever their age.
• A child never gives an email address. They sign in with a username and reset a password only through the Parent.
• If a child's account exists without a Parent behind it, we suspend it and contact the Academy.
• A child's voice, words or content never appear in any marketing material — in any form, anonymised or not.

5. Reflections, recordings and assessments

Written to be read by a fourteen-year-old.

• Your reflection is yours. No person reads it: not your coach, not your parent, not the club. A machine reads it and writes a short summary of themes. Your coach sees which focus you chose and how you rated your effort. That is all.
• Your parent sees that you are doing it, not what you said: attendance, appearances, goals and assists, and once a month a report that describes themes — never your words.
• Your coach's notes about you are seen by you, your parent and your coach. Never by the club office.
• Nothing is used to judge you. You get XP for closing the loop, not for how you rated yourself. Nobody is selected or ranked on reflections.
• When you leave the club, your reflections are erased.

Reflections and coach assessments are not sold, not used for advertising, not used to train any AI model and not shared with any other Academy.

6. Who sees your data

Inside the service — as set out in section 7.5 of the Terms. Outside it — nobody, except the processors in section 7 and authorities where the law requires. We do not sell data and have no advertisers. There are no ads in Elite Academy.

7. Processors and where data lives

• Supabase — database, sign-in, files, system emails to adults. Frankfurt (EU).
• Supabase Edge Functions — the AI gateway; recordings pass through in transit. Frankfurt (EU).
• OpenRouter, Inc. (USA) — the intermediary for transcription and AI features; processing in the EU, data processing agreement in force.
• OpenAI (OpenRouter's sub-processor) — transcription and text analysis; EU endpoints.
• Stripe — online payment of club fees, when the club turns it on.

Rules: hosting in the European Economic Area; AI processing in the EU; a contractual ban on training models on our data; recordings are not kept by the provider. Clubs are told [30] days before the list changes.

8. How long we keep data

• Voice recordings (reflections and coach notes): only until transcribed, then deleted at once — also after a failed attempt.
• Reflection transcripts and slider readings: while the Player is in the Academy; erased when they leave.
• Feedback, team reflections, reports: while the Player is in the Academy; then erased.
• The Player's name, date of birth, attendance and results: [N months] after they leave; the Academy may export them before.
• Match photos: the current season and the next.
• Profile photo: until consent is withdrawn or the Player leaves; erased within [30] days.
• Parent or staff account: until closed; erased within [30] days, billing kept as tax law requires.
• Security logs: [12] months; they contain nothing about a child.

The rule: the shortest period the law requires.

9. Your rights

You have the right to access, correct and erase your data, to restrict processing, to data portability and to object, as well as to withdraw consent and to complain to the Polish supervisory authority (Prezes UODO). Send requests to the Academy or to us — we pass them on within [3 business days] and help answer within a month. A Parent exercises the rights of a child under 16; a Player aged 16 or over may do so themselves. In the app you can remove a child, withdraw photo consent and close your account. A request to erase a child's reflections is honoured without argument.

10. Security

Database-level access control enforcing the rules in the Terms; encrypted connections; encryption at rest; hashed passwords; single-use, time-limited activation codes; logged staff access. We tell the Academy about a breach within [24] hours, and the authority within 72 hours where required.

11. Analytics and phone permissions

We use no third-party advertising or analytics tools and no crash reporting.

• Microphone — the coach's voice note, the player's reflection. Asked at first use.
• Photos — profile photo. Asked at first use.
• Location — not requested. Directions to the pitch open your phone's maps app.
• Contacts and calendar — not requested.