Privacy policy
Last updated: [DATE OF APPROVAL]
1. Who we are
Elite Sport Talents (“EST”, “we”) is operated by [LEGAL ENTITY NAME], [COMPANY FORM, e.g. S.r.l.], [REGISTERED ADDRESS], VAT [VAT NUMBER]. We are the controller of the personal data described here. Contact: [privacy@yourdomain]. [DPO CONTACT, if appointed].
2. What EST does with your data, in one paragraph
EST connects student-athletes with verified U.S. college coaches. To do that we publish an athlete’s recruiting profile to coaches whom we have verified, after the athlete (and, under 18, a parent or guardian) has agreed. Coaches never receive an athlete’s phone number, personal email or documents: they write through EST. Many athletes are under 18, and the product is built around that fact.
3. The data we collect
If you are an athlete
- Identity: name, date of birth, nationality, country and city of residence, languages, photo.
- Contact: email, phone number.
- If you are under 18: your parent or guardian’s name and email, and the record of their consent.
- Football: positions, preferred foot, height, weight, clubs, league and level, statistics, selections.
- School: school, graduation year, grades as they appear on your report card, test scores (TOEFL, IELTS, Duolingo, SAT, ACT), intended major, NCAA eligibility status.
- Recruiting preferences: when you want to start, divisions and states, whether you need a scholarship and what your family can contribute per year.
- Videos: links to your highlights on YouTube or Vimeo.
- Documents you upload: transcripts, diploma, passport or ID, test certificates.
- The date and fact of your consent to be shown to coaches.
If you are a coach
- Name, university email, university, program, division, role.
- Your recruiting needs, the athletes you save or skip, your notes and pipeline stages.
Everyone
- Account and security data: password (stored only as a one-way hash), sessions, a hashed form of your IP address, login times.
- Messages you send and receive on EST.
- How you use EST: pages and profiles viewed, searches and filters, and for coaches how much of a highlight video was watched. These records are first-party and are not sold or shared for advertising.
4. Why we use it, and on what legal basis
| Running your account and the recruiting service | Contract (Art. 6(1)(b) GDPR) |
| Showing an athlete profile to verified coaches | Consent, given at submission; for under-18s also the guardian's (Art. 6(1)(a)) |
| Verifying coaches and athletes; moderating messages that involve minors | Legitimate interest in a safe platform (Art. 6(1)(f)) [to confirm] |
| Service emails (verification, messages, security notices) | Contract (Art. 6(1)(b)) |
| Measuring how the product is used to improve matching | Legitimate interest (Art. 6(1)(f)) [to confirm] |
| Security: rate limits, audit logs of staff actions | Legitimate interest and legal obligations (Art. 6(1)(c), (f)) |
5. Who can see what
| Anyone with the link to a published profile | Name, photo, short bio, age (not date of birth), nationality, graduation year, positions, height, weight, foot, club, league and level, main video, verification badge |
| EST-verified college coaches | The above, plus country and city of residence, languages, shirt number, experience, national selections, club history, statistics, all videos, school and grades, test scores, English level, intended major, eligibility status, and recruiting preferences including what your family can contribute |
| You | Everything in your own profile |
| EST staff | Everything, including documents and conversations, for verification and safety. Staff reading a conversation or downloading a document is logged. |
Coaches never see your phone number, personal email, guardian details or documents. An unpublished profile is visible only to you and EST staff.
6. Athletes under 18
- A parent or guardian’s contact is required at signup, and their consent before a profile is shown to coaches.
- The guardian is emailed when the profile is submitted, and again when a coach first contacts the athlete, with the coach’s name and program.
- EST staff can read every conversation involving an athlete under 18 and can pause it.
- Messages that try to move a conversation off EST (phone numbers, emails, WhatsApp, social media handles) are flagged for staff review.
7. Transfers outside the EU
EST exists to connect European athletes with U.S. programs, so publishing a profile means making it available to coaches in the United States. Transfers rely on [TRANSFER MECHANISM TO THE U.S. — e.g. Standard Contractual Clauses]. Our service providers may also process data outside the EU under the same safeguards.
8. Service providers
- Hosting: Vercel ([HOSTING REGION]).
- Database, and private storage for photos and documents: Supabase (EU region, Frankfurt).
- Transactional email: Resend.
- Push notifications in the mobile app: Expo (650 Industries, United States), which passes them to Apple or Google. A notification carries the same short text as the one in your notifications list, and a device identifier for your phone.
- Error monitoring: Sentry, configured not to receive personal data such as IP addresses or form contents.
- Video: highlights are embedded from YouTube (via its privacy-enhanced youtube-nocookie.com domain) and Vimeo. Playing a video loads it from those services, under their own policies.
9. How long we keep it
- Your account and profile: until you delete them.
- Documents: until you remove them or delete your account.
- Sessions: they expire after 30 days.
- One-time email links: deleted 7 days after use or expiry.
- Anti-abuse counters: 2 days.
- Read notifications: 180 days.
- Unused profile invitations: 90 days after they expire.
- Usage records: [ANALYTICS EVENT RETENTION PERIOD]. When you delete your account they are detached from you.
- Audit log of staff actions: [AUDIT LOG RETENTION PERIOD].
10. Your rights
You can, at any time:
- Access and take your data: download it as a file from your account page.
- Correct it: edit your profile, or ask us to.
- Delete it: delete your account from your account page. This removes your profile, videos, documents and the messages you wrote.
- Withdraw consent to being shown to coaches, restrict or object to processing: write to [privacy@yourdomain].
- Complain to [SUPERVISORY AUTHORITY, e.g. Garante per la protezione dei dati personali].
11. Cookies
| est_session | Keeps you signed in. Strictly necessary. Expires after 30 days. |
| est_anon | A random identifier set when a signup form is opened, used only to count how many signups are completed. First-party, never shared. Expires after one year. [Consent requirement to confirm] |
| est_locale | Remembers the language chosen with the language switcher. Strictly necessary to show you the site in your language. Expires after one year. |
No advertising or third-party tracking cookies are set by EST.
12. Security
Passwords are stored as one-way hashes; session tokens are stored hashed; documents live in private storage and are only served to you and to EST staff, one download at a time, through short-lived links. Access to the back-office is limited to EST staff and every privileged action is logged.
13. Changes
If we change this policy in a way that matters, we will tell you by email or in the product before it applies.