Draft for legal review. This text is a working outline, has not been approved by counsel and is not yet binding. Items in brackets must be completed before launch.
Data retention policy
This policy sets how long ScoutPath keeps each kind of data and how it is deleted. The durations below are read from the same configuration the product uses, so this page always matches what the software does.
Retention periods
| Data | Kept for |
|---|---|
| Players on college rosters (name, position, class, height, hometown, previous college) | Current season and the previous one [to confirm] |
| Detected roster arrivals and departures | 24 months [to confirm] |
| Security and audit log (no personal content) | 24 months [to confirm] |
| Demo and contact requests | 24 months [to confirm] |
| Resolved data-review items | 24 months after resolution [to confirm] |
| Error details of imports and roster collections | 12 months [to confirm] |
| Closed personal-data requests | 36 months after closure [to confirm]Counsel to confirm (proof that a request was handled). |
| Free-trial sign-up fingerprints (keyed hash of the email address and of the network address) | 12 months [to confirm] |
| Conversations between agencies and coaches (messages and any shared profile summary) | 24 months after the last message [to confirm] |
| Rejected or revoked coach requests to manage a program | 24 months after the decision [to confirm] |
| Expired sign-in sessions and verification tokens | Deleted once expired |
| Athlete profiles, documents, notes and consents entered by an agency | Until the agency deletes them or closes its account [to confirm]The agency is the controller; deleting the workspace deletes them at once. |
| Athlete CSV files uploaded for an import (kept until the import is confirmed or canceled) | 24 hours at most; the summary keeps counts and line numbers only |
| History of email reminders (date, number of steps, status; no athlete name) | With the user's account [to confirm] |
| Payment events received from the payment provider (no card data) | 10 years (accounting records), to confirm with an accountant [to confirm] |
| Recruitment Management files (steps, deadlines, English test results, notes, change history) | With the athlete's profile: deleted when the agency deletes the athlete or the workspace [to confirm]The agency is the controller. A default deletion delay for closed files is to be decided (24 months proposed). |
What is collected from college rosters
Stored: name, jersey number, position, class year, redshirt status, listed eligibility, height, hometown, previous college or club, with the page address and the date it was read. Read for the page checks and never stored: high school, field of study, weight, link to the biography page, captain status.
How deletion happens
- An automatic job runs daily and deletes what has reached its limit. Each run that deletes something is recorded (counts only) in the audit log.
- Agencies delete athletes, documents and notes themselves at any time; deleted documents are removed from storage at once.
- A user deletes their account in Settings. An owner deletes the whole workspace (athletes, documents, notes, matching results, pipeline, conversations and recruitment files) in Settings, after confirming its name and their password.
- On a request from a person, we delete their data within 30 days. Players removed from rosters on request stay on a suppression list (a keyed fingerprint of the name, never the name) so they are not collected again.
Backups
Encrypted backups keep the 14 most recent daily copies and one copy per month for 12 months, then are destroyed. Deleted data therefore disappears from backups within 12 months. A restored backup has the suppression list and later deletions applied again before use.
Copies kept for continuity
[Earlier copies of rosters remain in the history of ScoutPath's private code repository, including fields no longer kept (high school, weight, field of study). A plan to remove them is ready and awaits the founder's decision before launch; until then these copies are not used by the product.]
Questions
Use the personal data request form or see the privacy policy.