Draft for legal review. This text is a working outline, has not been approved by counsel and is not yet binding. Items in brackets must be completed before launch.
Privacy policy
This policy explains what personal data ScoutPath processes, why, for how long, and how to exercise your rights. It describes the product as it works today. ScoutPath is operated by Leandro Fernandes Lemos Pires, Entrepreneur individuel (EI), micro-entreprise, SIREN 912 561 560, established in France (address in the legal notice). Contact: contact@scoutpath.eu. Players listed on college rosters will find a shorter explanation on the page written for them.
Who is responsible
- Agency staff accounts and website enquiries: ScoutPath is the controller.
- Athletes entered by an agency, and the agency's recruitment files: the agency is the controller and decides what is recorded; ScoutPath processes that data on the agency's instructions as its processor (see the Agency Terms and Data Processing Addendum).
- Players listed on public college rosters, and college staff: ScoutPath is the controller of the copy it keeps. [Counsel to confirm the roles.]
What we process and where it comes from
- Accounts: name, email, agency, role, password (stored only as a hash), sessions (device type, IP address, dates), and a security log of sign-ins and sensitive actions. When a workspace starts a free trial, we keep a keyed fingerprint of the email address and of the network address used, not the addresses themselves.
- Athletes (entered by agencies): identity and date of birth, nationality and languages, sporting profile (position, level, height, preferred foot, clubs, links to videos hosted on YouTube, Vimeo, Hudl or Veo), academic record and test scores, budget and location preferences, documents the agency uploads (such as transcripts, test reports, agreements or offer letters), notes, and the consent the agency recorded, including a parent or guardian's consent for athletes under 18.
- Recruitment files (Elite plan, kept by the agency): the universities followed for an athlete, the status, deadlines and reminders of each step (English tests and scores, coach contacts, application, offer and commitment, eligibility review, visa process, arrival), who at the agency handles it, the source the agency gives for an official outcome, internal notes and a history of changes. ScoutPath refuses passport, visa and SEVIS numbers it recognizes and asks agencies not to enter them.
- Players on college rosters: name, jersey number, position, class year, listed eligibility, height, hometown (from which we derive the home country), and previous college or club, as published by each college on its official athletics website, with the page address and the date we read it. We do not keep high school, field of study, weight, link to the biography page, captain status, even when a roster page shows them.
- College coaches who open an account: name, title, email, the program they ask to manage and the evidence of affiliation they give, the review decision, the recruitment needs they publish (attributed to them and dated), and, if they choose to receive them, their conversations with agencies.
- Conversations between agencies and coaches: the messages, and an athlete's profile summary when the agency chooses to share it after recording the athlete's or guardian's consent (no date of birth, contact details or documents).
- Colleges and programs: public data from US federal datasets (College Scorecard, EADA), association directories and official college websites, each with its source and date.
- Enquiries and requests: what you send through the contact form or the personal data request form.
Why we use it, and on what basis
- To provide the service to agencies under their contract (accounts, workspaces, collaboration between members, athlete profiles, matching, pipeline, recruitment files, account and workspace deletion).
- To describe college soccer programs to agencies: roster composition by position and class, international share, turnover and estimated openings. Our basis is our legitimate interest, and that of agencies and athletes, in understanding which programs could fit an athlete. We limit the data to what the analysis needs, keep only two seasons, never contact players, never sell roster data, and stop processing a player's data on request. [Counsel to confirm the balancing test.]
- To keep the service secure (sessions, rate limits, audit log) and to meet legal obligations (answering requests, keeping records of them).
- To let verified coaches publish their program's needs and, if they wish, talk with agencies: our contract with the coach and our legitimate interest in accurate, attributed recruitment information. [Counsel to confirm.]
- To prevent repeated free trials: the trial fingerprints above are compared with earlier sign-ups. Our basis is our legitimate interest in preventing misuse of the trial. [Counsel to confirm.]
Matching and automated processing
ScoutPath computes compatibility scores between an athlete and programs from the data available. Scores and estimated opportunities support the agency's own judgment. They are not decisions about anyone, not predictions of recruitment, admission or aid, and no decision with legal or similarly significant effects is made automatically. Estimated recruitment opportunities are always labeled as estimates and kept apart from needs confirmed by a program.
When enabled, an AI model (Anthropic) rewords the explanation of a recommendation from the facts the engine computed. It receives the program name, the computed facts and uncertainties, and the athlete's criteria needed to explain them, never the athlete's name or documents, and its text is discarded if it adds anything that is not in those facts.
Who receives data
- Members of the agency workspace see that agency's athletes and recruitment files, according to their role. No other agency can see them, and coaches never see a recruitment file or an athlete's record.
- A coach sees an athlete's profile summary, and video links if the agency chooses, only when the agency shares them in a conversation after recording consent.
- Service providers acting for us: [hosting provider, database and backup storage, email provider when chosen, Anthropic when AI explanations are enabled — to be listed with their locations].
- We do not sell personal data and do not use it for advertising. [Counsel to assess whether giving agencies access to roster data is a “sale” under US state laws, and whether data broker registration applies.]
International transfers
[Location of hosting and the safeguards used for transfers from the EU/UK (adequacy decision, EU-US Data Privacy Framework, or standard contractual clauses) to be completed once the hosting provider is chosen.] Anthropic (AI explanations, when enabled) and GitHub (source code) are in the United States. [Safeguard of each to be checked.]
How long we keep it
| Data | Kept for |
|---|---|
| Players on college rosters (name, position, class, height, hometown, previous college) | Current season and the previous one [to confirm] |
| Detected roster arrivals and departures | 24 months [to confirm] |
| Security and audit log (no personal content) | 24 months [to confirm] |
| Demo and contact requests | 24 months [to confirm] |
| Resolved data-review items | 24 months after resolution [to confirm] |
| Error details of imports and roster collections | 12 months [to confirm] |
| Closed personal-data requests | 36 months after closure [to confirm]Counsel to confirm (proof that a request was handled). |
| Free-trial sign-up fingerprints (keyed hash of the email address and of the network address) | 12 months [to confirm] |
| Conversations between agencies and coaches (messages and any shared profile summary) | 24 months after the last message [to confirm] |
| Rejected or revoked coach requests to manage a program | 24 months after the decision [to confirm] |
| Expired sign-in sessions and verification tokens | Deleted once expired |
| Athlete profiles, documents, notes and consents entered by an agency | Until the agency deletes them or closes its account [to confirm]The agency is the controller; deleting the workspace deletes them at once. |
| Athlete CSV files uploaded for an import (kept until the import is confirmed or canceled) | 24 hours at most; the summary keeps counts and line numbers only |
| History of email reminders (date, number of steps, status; no athlete name) | With the user's account [to confirm] |
| Payment events received from the payment provider (no card data) | 10 years (accounting records), to confirm with an accountant [to confirm] |
| Recruitment Management files (steps, deadlines, English test results, notes, change history) | With the athlete's profile: deleted when the agency deletes the athlete or the workspace [to confirm]The agency is the controller. A default deletion delay for closed files is to be decided (24 months proposed). |
Encrypted backups are kept for up to 12 months and then destroyed. If a backup is restored, deletions made since, including the suppression list described below, are applied again before the data is used. Details: Data retention policy.
Your rights
Depending on where you live (for example the EU, the UK, or a US state with a privacy law), you can ask for a copy of your data, its correction, its deletion, a restriction of its use, a copy in a reusable format, and you can object to its use. Use the personal data request form or write to contact@scoutpath.eu. We answer within 30 days and may first ask you to confirm your identity. A parent or guardian can act for a minor.
- Players on college rosters: if you ask us to delete your data, we delete it and add a keyed fingerprint of your name to a suppression list so that we do not collect it again, even if your college still publishes it. To change what your college publishes, contact the college.
- Athletes represented by an agency: your agency decides what is recorded. Contact it first; if you write to us, we pass your request to the agency and help it answer.
- You can complain to your data protection authority. ScoutPath is established in France, where the authority is the CNIL (Commission nationale de l'informatique et des libertés).
Minors
ScoutPath is used by agencies, not by athletes directly. Agencies must record a parent or guardian's consent before adding an athlete under 18, and the product refuses the profile without it. Some players on college rosters may be 17. [Counsel to confirm the handling of minors' data on public rosters and any state-specific rules.]
Security
- Each agency's data is isolated and access depends on the member's role.
- Passwords are hashed; sign-in attempts are limited and failures are logged; administrators must have signed in within the last 12 hours.
- Documents are stored privately and served only to authorized members; backups are encrypted.
- Sensitive actions are recorded in an audit log that holds identifiers and action names, not personal content.
Cookies
We use only the cookies needed to keep you signed in. See the cookie notice.
Changes
[Notice period and how changes are announced to be completed.] Last updated: [date of publication].