Privacy Policy

1. Who this policy covers

This Privacy Policy describes how Next Layer AI LLC ("Next Layer AI", "we", "us") collects, uses, and shares information through the Next Layer Sports ("NLS") platform. It covers people with an NLS account (Parents/Guardians and Organization staff), the Players they manage, and visitors who use our public pages and forms.

2. Information we collect

Account information: your name, email address, an optional profile picture you upload, your sign-in method, and a record of which version of these Terms and this Policy you accepted and when.

Organization information: an Organization's name, public profile, Programs, Groups, Training, Locations, staff roles, join requests, invitations (including the email addresses invitations are sent to), and its Stripe Connect account identifier when the Organization takes payments online.

Player information provided by a Parent/Guardian or an authorized Organization: a Player's name, date of birth, gender, Guardian relationships and Guardian invitations, Organization/Program/Group/Training membership, registrations, bookings, and attendance/RSVP information where applicable.

Payments: for each registration or booking paid through NLS we keep the amount, status, dates, the Organization, the Player, and the payment provider's reference identifiers. Payment card details are entered on our payment provider's pages and are never stored by us. Refunds and payments an Organization records as made offline (cash, check, complimentary) are recorded the same way.

Team Chat: the messages, reactions, pins and read status of the Group conversations you take part in.

Notifications: the in-app notifications addressed to you, whether you have read or dismissed them, and your email notification preferences.

Public forms: a message sent through our contact or request-access form is delivered to us by email with the name and email address you entered; it is not stored in the platform database. A message sent to an Organization through its public "Contact" form is delivered by email to that Organization's Owner with your name, email address and message. To limit automated abuse we keep, for up to one day, a salted hash of the network address a public form was submitted from -- never the address itself.

Technical information: when you verify a one-time code we record the time and your browser's user-agent string with that verification. Our infrastructure providers keep standard server, authentication and security logs, which can include network addresses, for the periods set by those providers.

3. Minors and Player data

Player records may concern minors, including children under the age of 13. Player information is provided and managed through a Parent/Guardian or an authorized Organization -- NLS does not offer accounts for Players. Access to a Player's data is restricted to the Player's Guardians and to the Organization(s) the Player belongs to, and within an Organization to the roles that need it to run Programs and Training.

4. How we use information

We use this information to operate the platform: to manage Organization membership, process Program registrations, Training bookings and their payments and refunds, schedule Training and record attendance, run Team Chat, show you in-app notifications, and send the emails described in section 6.

5. Data sharing and service providers

We do not sell personal information. Information is shared with:

• Organizations you or your Players belong to, for their own Players, members and payments. An Organization sees the Guardians of its Players (name and email), the people who request to join it, and messages sent through its contact form.
• Supabase -- database, authentication, file storage (profile pictures) and realtime infrastructure.
• Stripe -- payment processing. Organizations that take payments online connect their own Stripe account; your payment is made to the Organization's account, and Stripe receives the details needed to process it.
• Our email delivery provider -- for the transactional and notification emails we send.
• Cloudflare Turnstile -- when enabled on our public forms, to tell people from automated abuse; Cloudflare receives the technical information its widget collects.
• Our hosting and infrastructure providers, which process data on our behalf to run the platform.

6. Emails we send

We send only transactional and service emails: sign-in and one-time codes, invitations, account changes (including the confirmation of an account deletion and a change of Organization ownership), payment confirmations and refunds, and notifications about registrations, bookings, sessions, membership requests, Guardian requests and Organization operations. From your Settings you can turn off the emails for participation, membership, Guardian and Organization-operations notifications; security, payment, invitation and one-time-code emails cannot be turned off. Team Chat messages are never emailed. We do not send marketing or newsletter communications, and do not use advertising or analytics tracking.

7. Deleting your account, and what remains

You can delete your own account at any time from Settings; a one-time code sent to your email confirms it. Deletion removes your profile (name, email, picture), your sign-in credentials and sessions, your Guardian relationships, your Organization staff roles, your Team Chat reactions and read status, and your notifications and preferences, and it cancels or removes the pending requests you made. An Organization you own must first be transferred to another of its staff members (an Admin or Coach).

Records that belong to an Organization are kept by that Organization and continue to reference a "Former member": registrations, bookings, payments and refunds, Team Chat messages you sent, invitations you issued, and roster history. A Player you were the only Guardian of stays with every Organization that has a record of them, current or archived (marked as needing a new Guardian); a Player who was never part of an Organization and has no pending request to join one is deleted with your account. Your email address becomes available for a new, separate account.

8. Data retention

Apart from what account deletion removes (section 7), we retain account, Organization and Player data for as long as the associated account or Organization is active, and afterward for as long as reasonably needed to meet legal obligations, accounting and tax requirements, to resolve transactions, fraud or security concerns and disputes, or to maintain legitimate operational and historical records. In-app notifications are deleted automatically once they are 30 days old if you have read or dismissed them, and once they are 90 days old otherwise. The hashed network addresses kept for public-form abuse protection are deleted after one day.

9. Your rights

Depending on your location, you may have rights to access, correct, or delete your personal information. You can update your profile and delete your account yourself from Settings. For anything else, including information an Organization holds about you or a Player in your care, contact us through our contact page; requests about an Organization's own records may be referred to that Organization.

10. Changes to this policy

We may update this Privacy Policy from time to time. When the changes are material, account holders are asked to accept the updated Policy when they next sign in, and before they take further actions in the platform.