EHA Connect

1. Information We Collect

We collect the following categories of personal information:

1.1 Information You Provide Directly

• Account Information: When you create an account, we collect your name, email address, and password (or Google OAuth credentials).
• Athlete Profile Data: For player profiles, we collect the athlete's first and last name, date of birth, graduation year, school name, height, weight, positions, academic information (GPA), and photographs.
• Parent/Guardian Information: For accounts managing minor athletes, we collect the parent or legal guardian's name, email address, and relationship to the athlete.
• Payment Information: When you purchase a subscription, payment information (credit card number, billing address) is collected and processed directly by Stripe, Inc. We do not store full payment card details on our servers.
• Recruiting Communications: When you use the recruiting email feature, we collect the content of messages sent to college coaches and maintain a log of recruiting correspondence.
• Club and Team Information: Program directors and coaches provide organization names, team rosters, and event registration details.
• Media Uploads: Photographs, highlight video links, and other media files uploaded to the Platform.
• Phone Numbers: When you provide a mobile phone number during account registration, profile setup, or contact import, we collect it for the purpose of sending SMS notifications related to EHA events, schedules, and platform updates.

1.2 Information Collected Automatically

• Device and Browser Information: We collect information about the device and browser you use to access the Platform, including device type, operating system, browser type, and screen resolution.
• Usage Data: We collect information about how you interact with the Platform, including pages visited, features used, and the date and time of your activity.
• IP Address: Your Internet Protocol address is collected automatically when you access the Platform.
• Cookies and Similar Technologies: We use cookies and similar technologies for authentication, session management, and to remember your preferences. See Section 7 for more information.

1.3 Information from Third Parties

• Google OAuth: If you sign in with Google, we receive your name, email address, and profile picture from Google.
• Exposure Events: We may receive team rosters, game schedules, and event information from the Exposure Events tournament management system for events administered through their platform.
• Stripe: We receive confirmation of payment status and subscription information from Stripe, Inc. We do not receive or store your full payment card details.

2. How We Use Your Information

We use the personal information we collect for the following purposes:

• Platform Operations: To create and maintain your account, manage athlete profiles, process subscriptions, and deliver the core features of the Platform.
• Athletic Performance Tracking: To record, display, and aggregate game statistics, leaderboard rankings, and career performance data for athletes participating in EHA events.
• Recruiting Services: To facilitate communication between athletes (or their parents/guardians) and college coaching staff through the Platform's recruiting tools.
• Event Administration: To manage tournament registrations, game schedules, live scoring, bracket management, and results reporting.
• Communications: To send transactional emails related to your account, including guardian invitations, recruiting correspondence, password resets, and subscription confirmations.
• SMS Notifications: To send text messages to users who have provided a phone number and opted in, including event reminders, schedule updates, game notifications, and general organization announcements. Messages are sent via Twilio. Message frequency varies. Message and data rates may apply. You may opt out at any time by replying STOP to any message, or reply HELP for assistance.
• Security and Fraud Prevention: To protect the Platform and its users from unauthorized access, fraud, and other harmful activity.
• Legal Compliance: To comply with applicable laws, regulations, and legal obligations.
• Platform Improvement: To analyze usage patterns and improve the functionality, performance, and user experience of the Platform.

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

3.1 Athlete Profile Visibility

Athlete profiles are visible to other Platform users based on the following access rules:

• Basic profile information (name, school, graduation year, position) is publicly visible on the Platform.
• Detailed performance statistics are accessible to the athlete's guardians, club directors with the athlete on their roster, users with an active subscription, and Platform administrators.
• Approved college recruiters may view athlete profiles for legitimate recruiting purposes as described in our Terms of Service.

3.2 Service Providers

We share information with third-party service providers who perform services on our behalf, including:

• Stripe, Inc.: Payment processing for subscriptions and one-time purchases.
• Resend: Transactional email delivery.
• Vercel: Web application hosting and file storage.
• Cloudinary: Image processing and delivery.
• NeonDB: Database hosting.
• Twilio: SMS text message delivery.
• Exposure Events: Tournament and event management synchronization.

These service providers are contractually obligated to use your information only to perform the services we have engaged them to provide and in accordance with applicable data protection laws.

3.3 Legal Requirements

We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a valid legal process.

3.4 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, your personal information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

4. Children's Privacy (COPPA Compliance)

The Platform is designed to serve youth athletes. We take the privacy of children seriously and are committed to compliance with the Children's Online Privacy Protection Act (“COPPA”), 15 U.S.C. §§ 6501–6506.

4.1 Parental Consent Required

The Platform does not permit children under the age of thirteen (13) to create accounts independently. All accounts for minor athletes must be created and managed by a parent or legal guardian. By creating an athlete profile for a minor, the parent or guardian provides verifiable parental consent for the collection and use of the minor's information as described in this Privacy Policy.

4.2 Information Collected from Minors

For minor athletes, we collect only the information reasonably necessary to provide the Platform's services, including the athlete's name, school, graduation year, physical measurements, athletic statistics, and photographs provided by the parent or guardian.

4.3 Parental Rights

Parents and guardians have the right to:

• Review the personal information collected about their child;
• Request correction of inaccurate information;
• Request deletion of their child's personal information and athlete profile;
• Refuse further collection or use of their child's information.

To exercise any of these rights, please contact us at the address provided in Section 11.

4.4 Unauthorized Collection

If we become aware that we have collected personal information from a child under thirteen (13) without verifiable parental consent, we will promptly delete such information from our records.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you with the Platform's services. Specific retention periods include:

• Active Accounts: Personal information and athlete profile data are retained for the duration of your active account.
• Cancelled Subscriptions: Account data is retained but access to premium features is suspended. Profile data remains visible per the Platform's access rules.
• Terminated Accounts: Athlete profile data is retained for ninety (90) days following termination, after which it may be permanently deleted.
• Game Statistics: Athletic performance data and game statistics may be retained indefinitely as part of the Platform's historical records, even after account deletion, in anonymized or aggregated form.
• Legal and Compliance Records: Certain records, including Terms of Service acceptance logs and payment transaction records, may be retained as required by applicable law or for legitimate business purposes.

6. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL;
• Secure password hashing using bcrypt;
• JWT-based session management with signed tokens;
• Role-based access controls limiting data visibility;
• Secure storage of authentication tokens on mobile devices;
• Regular review of security practices and access controls.

No method of transmission over the Internet or method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. You are responsible for maintaining the confidentiality of your account credentials.

7. Cookies and Tracking Technologies

The Platform uses the following cookies and similar technologies:

• Authentication Cookies: Essential cookies that maintain your signed-in session. These are strictly necessary for the Platform to function and cannot be disabled.
• CSRF Protection Cookies: Security cookies that protect against cross-site request forgery attacks.
• Preference Cookies: Cookies that remember your display preferences (such as theme selection).
• Preview Cookies: Cookies used to manage early access and preview functionality during pre-launch periods.

The Platform does not use third-party advertising cookies or tracking pixels. We do not engage in behavioral advertising or cross-site tracking.

8. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

8.1 Access and Portability

You have the right to request a copy of the personal information we hold about you. You may access and download your athlete profile data at any time through the Platform.

8.2 Correction

You have the right to request correction of inaccurate or incomplete personal information. You may update your account information and athlete profiles directly through the Platform.

8.3 Deletion

You have the right to request deletion of your personal information. Deletion requests will be processed within thirty (30) days. Certain data may be retained as required by law or as described in Section 5.

8.4 Account Cancellation

You may cancel your account at any time through your account settings or by contacting us in writing. Upon cancellation, your data will be handled in accordance with the retention periods described in Section 5.

8.5 Communication Preferences

You may manage your notification preferences through the Platform's settings. Transactional communications necessary for account operation (such as password resets and subscription confirmations) cannot be opted out of while your account remains active.

8.6 SMS Opt-Out

If you have opted in to receive SMS text messages from EHA Connect, you may opt out at any time by replying STOP to any message. After opting out, you will receive a one-time confirmation message and no further SMS messages will be sent unless you re-subscribe. You may reply HELP to any message for assistance or contact us at legal@ehaconnect.com. Message frequency varies. Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

9. California Privacy Rights

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”), including:

• The right to know what personal information is collected, used, shared, or sold;
• The right to request deletion of personal information;
• The right to opt out of the sale or sharing of personal information;
• The right to non-discrimination for exercising your privacy rights.

We do not sell personal information. To exercise your California privacy rights, please contact us at the address provided in Section 11.

10. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Material changes will be communicated to registered users via email or in-app notification no less than thirty (30) days prior to taking effect. Non-material changes may take effect immediately upon posting to the Platform. Your continued use of the Platform following notice of any change constitutes your acceptance of the revised Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

11. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact:

For COPPA-related inquiries or to exercise parental rights regarding your child's information, please include “COPPA Request” in the subject line of your correspondence.