Privacy Policy

ScoutingWave Inc. (“ScoutingWave,” “we,” “us,” or “our”) operates the sports recruiting platform available at scoutingwave.com and our mobile application (collectively, the “Service”). We connect athletes with verified scouts, coaches, and organizations worldwide through film upload, AI-powered performance analysis, and direct messaging.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what rights you have regarding your data. It applies to all users of scoutingwave.com and our mobile app, regardless of where you are located.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service.

We collect the following categories of personal information:

(a) Account and Profile Data

When you register, we collect your name, email address, date of birth, password (hashed), and role (athlete, scout, coach, or organization). Athletes may also provide school name, sport, position, playing biography, height, weight, and a profile avatar. Scouts and coaches may provide their affiliated organization, sport specialty, and verification documents.

(b) Film and Media

Athletes upload game film and highlight clips to the Service. We store the video files, auto-generated thumbnails, and AI-generated performance breakdowns associated with each upload. Film is hosted in our cloud storage (Supabase Storage backed by AWS S3).

(c) Communications

We store messages sent between users through our in-platform messaging system. We also retain feedback you submit through our feedback forms and support requests sent to our team.

(d) Usage Data

We automatically collect technical information including your IP address, browser type and version, operating system, pages visited, time spent on pages, clicks and navigation patterns, and referring URLs. This data is collected through Vercel Analytics and our application logs.

(e) Payment Data

Subscription payments are processed by Stripe, Inc. When you subscribe to a paid plan, Stripe collects your payment card details directly. We do not store full card numbers, CVV codes, or other sensitive payment instrument data on our servers. We receive from Stripe a tokenized payment method identifier, your billing name, and the last four digits of your card for display purposes.

(f) Cookies and Tracking

We use cookies and similar technologies as described in our Cookie Policy at scoutingwave.com/cookies. Essential cookies are required for authentication and security. We use Vercel Analytics for anonymous, aggregate usage statistics. We do not use advertising cookies or cross-site tracking technologies.

We use the personal information we collect to:

• Provide the Service: Create and maintain your account, display your athlete profile to scouts and coaches, facilitate messaging between users, and power all core platform features.
• AI Film Analysis: Process uploaded video files through our AI analysis pipeline to generate performance breakdowns, metrics, and scouting summaries. We pass film metadata (not your personal identifying information) to Anthropic’s API for analysis.
• Matchmaking: Match athletes with relevant scouts, coaches, and organizations based on sport, position, graduation year, location, and other profile attributes.
• Transactional Communications: Send account confirmation emails, password reset links, subscription receipts, and important service notifications through Resend.
• Fraud Prevention and Security: Detect and prevent unauthorized access, abuse, and other harmful activity on the platform.
• Legal Compliance: Fulfill our obligations under applicable laws, including responding to lawful requests from government authorities.
• Product Improvement: Analyze aggregate usage patterns to improve existing features, develop new features, and improve the overall user experience.

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

• Contractual Necessity (Article 6(1)(b)): We process your account data, profile information, film uploads, and messaging data because it is necessary to perform the contract we have with you (i.e., to provide the Service you signed up for). Without this data, we cannot operate your account or deliver the features you use.
• Legitimate Interests (Article 6(1)(f)): We process usage data and analytics to improve the platform and prevent fraud. Our legitimate interest in maintaining a safe, functional, and improving service outweighs the minimal privacy impact of this processing. We also process communication data to facilitate the recruiting connections that are the core purpose of the Service.
• Consent (Article 6(1)(a)): Where we use optional analytics cookies or send non-transactional marketing communications, we rely on your consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Legal Obligation (Article 6(1)(c)): We retain certain financial records (payment history, invoices) to comply with tax and financial reporting requirements.

We do not sell your personal information to third parties. We do not share your data with advertising networks or data brokers. We share your information only in the following limited circumstances:

• Supabase: Our database and file storage provider. Your account data, messages, and uploaded film are stored on Supabase infrastructure, which is hosted on AWS. Supabase acts as a data processor under a Data Processing Agreement.
• Resend: Our transactional email provider. We share your email address with Resend solely to deliver account-related emails such as verification, password resets, and subscription confirmations.
• Stripe: Our payment processor. When you subscribe to a paid plan, you interact directly with Stripe’s secure payment interface. Stripe is PCI-DSS compliant and processes payment data under its own privacy policy.
• Anthropic: Our AI analysis provider. We send film metadata (video descriptions, timestamps, and sport-specific context) to Anthropic’s API to generate performance breakdowns. We do not transmit your name, email, date of birth, or other directly identifying personal information to Anthropic.
• Cloudflare: We use Cloudflare for DNS, CDN, and DDoS protection. Cloudflare processes network traffic passing through their infrastructure to deliver the Service and protect against attacks.
• Legal Requirements: We may disclose your information if required to do so by law, court order, or government request, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: If ScoutingWave is acquired by or merged with another company, your information may be transferred as part of that transaction. We will notify you by email and provide an opportunity to opt out before your information becomes subject to a different privacy policy.

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you are under 13, please do not use the Service or provide any personal information to us.

If we become aware that a user is under the age of 13, we will promptly delete that user’s account and all associated personal information from our systems. We comply with the Children’s Online Privacy Protection Act (COPPA).

If you are a parent or guardian and believe your child under 13 has created an account on ScoutingWave, please contact us immediately at privacy@scoutingwave.com so we can delete the account and associated data.

Users aged 13 through 17 may use the Service with the knowledge and consent of a parent or legal guardian, as described in our Terms of Service.

Depending on where you live, you have various rights regarding your personal information.

Rights for EU/EEA Users (GDPR)

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may correct inaccurate or incomplete personal data directly through your account settings, or by contacting us.
• Right to Erasure: You may request deletion of your personal data. You may delete your account at any time through account settings. We will delete your data in accordance with our retention schedule (see Section 8).
• Right to Restriction: You may request that we restrict processing of your personal data in certain circumstances, for example while we verify the accuracy of a rectification request.
• Right to Data Portability: You may request your personal data in a structured, machine-readable format so you can transfer it to another service.
• Right to Object: You may object to processing based on legitimate interests, including profiling, at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu.

Rights for California Residents (CCPA)

California residents have the right to know what personal information we collect and how it is used, the right to request deletion of their personal information, the right to opt out of the sale of personal information (we do not sell personal information), and the right not to be discriminated against for exercising these rights.

To exercise any of your rights, contact us at privacy@scoutingwave.com. We will respond to verifiable requests within 30 days (GDPR) or 45 days (CCPA).

We retain personal information for the following periods:

• Active Accounts: Retained for as long as your account is active, plus 90 days after account deletion to allow for recovery and to process any outstanding requests.
• Film Uploads: Deleted within 30 days of account deletion or upon your explicit request.
• Usage and Analytics Data: Retained for up to 24 months in aggregate, anonymized form.
• Payment Records: Retained for 7 years to comply with tax and financial reporting obligations under applicable law.
• AI Analysis Results: Deleted along with the associated account and film data upon account deletion.
• Messages: Retained for the lifetime of the accounts involved, and deleted within 90 days when all parties have deleted their accounts.

ScoutingWave is incorporated in the United States, and our infrastructure is hosted primarily in the United States. If you are located in the European Economic Area, United Kingdom, or another jurisdiction with data transfer restrictions, your personal data will be transferred to and processed in the United States.

We rely on the European Commission’s Standard Contractual Clauses (SCCs) as the legal mechanism for transferring personal data from the EEA to the United States. Where adequacy decisions issued by the European Commission apply to a transfer, we rely on those decisions. Copies of our SCCs are available upon request at privacy@scoutingwave.com.

We take the security of your personal information seriously and implement industry-standard safeguards:

• Encryption in Transit: All data transmitted between your browser or app and our servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Data stored in Supabase (PostgreSQL) and Supabase Storage is encrypted at rest using AES-256.
• Access Controls: Access to production databases is restricted to authorized personnel on a need-to-know basis. We use row-level security (RLS) policies in our database to enforce data segregation between users.
• Security Reviews: We conduct regular security reviews and monitor our infrastructure for vulnerabilities and anomalous activity.

No method of transmission over the internet or electronic storage is 100% secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at privacy@scoutingwave.com.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other reasons. For material changes—those that significantly affect how we collect, use, or share your data—we will provide at least 30 days’ advance notice by email to the address associated with your account.

Non-material changes (such as clarifications, formatting updates, or corrections of typographical errors) may be made without prior notice, but will always be reflected in the “Last updated” date at the top of this page. We encourage you to review this policy periodically.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy-related inquiries within 5 business days.