Privacy Policy

1.1 Information You Provide Directly

• Account registration information: name, email address, phone number, password, and role (student, parent, coach, school administrator)
• Student enrollment information: student name, date of birth, school, grade level, emergency contacts, medical conditions, and allergies
• Parent/guardian information: name, contact details, relationship to student, and billing address
• Payment and billing information: credit/debit card details (processed securely through third-party payment processors; we do not store full card numbers)
• Communications: messages sent through our platform, feedback, support requests, and contact form submissions
• Profile information: photos, bios, and preferences you choose to share
• Coach information: qualifications, certifications, background check authorization, and availability

1.2 Information Collected Automatically

• Usage data: pages visited, features used, time spent on pages, clicks, and navigation patterns
• Device information: browser type and version, operating system, device type, screen resolution, and language settings
• Log data: IP address, access times, referring URLs, and error logs
• Location data: general geographic location derived from your IP address (city/state level; we do not collect precise GPS location)
• Cookie data: information collected through cookies and similar tracking technologies (see our Cookie Policy for details)

1.3 Information from Third Parties

• Schools and educational partners may provide student rosters and program participation data
• OAuth providers (Google, GitHub) may share basic profile information when you sign in using those services
• Payment processors may provide transaction confirmation and billing status

We use the information we collect for the following purposes:

• Program delivery: to enroll students, manage schedules, track attendance, record progress, and communicate with families and schools
• Account management: to create and maintain your account, authenticate your identity, and provide customer support
• Communication: to send program updates, schedule changes, progress reports, announcements, and respond to your inquiries
• Safety and security: to verify identities, conduct background checks on coaches, manage emergency contacts, and ensure student safety
• Platform improvement: to analyze usage patterns, fix bugs, develop new features, and improve user experience
• Legal compliance: to comply with applicable laws, regulations, and legal processes, including COPPA, FERPA, CCPA, and GDPR
• Billing and payments: to process payments, send invoices, and manage subscription or program fees
• AI-powered features: to provide personalized drill recommendations, session planning, progress insights, and other educational tools (data is processed with privacy safeguards)

Legal basis for processing (GDPR): We process personal data based on: (a) your consent, (b) performance of a contract (e.g., program enrollment), (c) compliance with legal obligations, and (d) our legitimate interests in providing and improving our Services, provided these interests do not override your rights.

We do not sell your personal information for monetary consideration. We may share your information in the following circumstances:

• School partners: student participation data, attendance records, and progress reports shared with partner schools for program coordination
• Service providers: we use trusted third-party services for payment processing (Stripe), email delivery (Resend), cloud hosting (Vercel), database hosting (Supabase), analytics (Google Analytics), error tracking (Sentry), and AI processing (Groq)
• Legal requirements: we may disclose information when required by law, court order, subpoena, or government request, or to protect our rights, safety, or property
• Business transfers: in connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction
• With your consent: we may share information with other parties when you explicitly consent to such sharing

All third-party service providers are contractually obligated to protect your data and may only use it for the specific purposes for which we have engaged them. We do not allow our service providers to use your personal data for their own purposes.

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law.

When data is no longer needed, we securely delete or anonymize it. Anonymized data that cannot be used to identify individuals may be retained indefinitely for statistical and research purposes.

5.1 Rights Under GDPR (European Economic Area Residents)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access: You may request a copy of the personal data we hold about you.
• Right to Rectification: You may request that we correct inaccurate or incomplete personal data.
• Right to Erasure ("Right to Be Forgotten"): You may request that we delete your personal data, subject to certain legal exceptions.
• Right to Data Portability: You may request that we provide your personal data in a structured, commonly used, machine-readable format so you can transfer it to another service.
• Right to Restrict Processing: You may request that we limit how we use your personal data while a complaint is being resolved.
• Right to Object: You may object to the processing of your personal data for direct marketing or processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: You have the right to file a complaint with your local data protection authority.

5.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected, the sources, the business purposes, and the third parties with whom we share it.
• Right to Delete: You may request deletion of the personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out: You may opt out of the sale or sharing of your personal information. Visit our Do Not Sell My Personal Information page to submit a request.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Limit Use of Sensitive Information: You may limit the use and disclosure of sensitive personal information to purposes necessary for providing the Services.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, please email us at privacy@folafutbol.com, visit our Do Not Sell My Personal Information page, or call us at 718-973-4574. We will verify your identity before processing any request. We will respond to verifiable requests within 30 days (GDPR) or 45 days (CCPA).

We implement industry-standard technical and organizational measures to protect your personal information:

• Encryption: All data is encrypted in transit using TLS 1.2+ (HTTPS) and at rest using AES-256 encryption.
• Access controls: Role-based access control (RBAC) ensures that only authorized personnel can access personal data based on their role and need.
• Authentication: Two-factor authentication (2FA) is required for all administrative and coach accounts. Passwords are hashed using bcrypt with salt.
• Database security: Row-Level Security (RLS) policies enforce data isolation. All database connections use SSL.
• Rate limiting: API endpoints are protected by rate limiting to prevent abuse and brute-force attacks.
• Input validation: All user inputs are validated and sanitized to prevent injection attacks (SQL injection, XSS, CSRF).
• Security monitoring: We use automated error tracking and security monitoring. Regular security audits are conducted.
• Incident response: We maintain an incident response plan for security breaches (see Section 10: Data Breach Notification).
• Employee training: Staff with access to personal data receive regular training on data protection and privacy best practices.
• Vendor security: Third-party service providers are vetted for security practices and are required to maintain appropriate security measures.

We use cookies and similar tracking technologies to enhance your experience on our website. Cookies are small text files stored on your device that help us provide and improve our Services.

• Essential cookies: Required for site functionality, including session management, authentication, security features, and load balancing. These cannot be disabled.
• Analytics cookies: Help us understand how visitors use our website (e.g., Google Analytics). These are only activated with your consent.
• Preference cookies: Remember your settings such as language preferences, cookie consent choices, and display options.

You can manage your cookie preferences at any time through the cookie consent banner on our website, or by adjusting your browser settings. For detailed information about the specific cookies we use, their purposes, and durations, please see our Cookie Policy.

FolaFutbol is based in the United States. If you access our Services from outside the United States, your information may be transferred to, stored, and processed in the United States and other countries where our service providers operate.

• Our primary servers and database are hosted in the United States (AWS us-east-1 region via Supabase and Vercel).
• Some third-party service providers may process data in other jurisdictions. We ensure all providers maintain adequate data protection standards.
• For transfers from the EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or other lawful transfer mechanisms.
• By using our Services, you acknowledge that your data may be transferred internationally. We take steps to ensure that your data receives an adequate level of protection wherever it is processed.

In the event of a data breach that compromises the security of your personal information, we will take the following steps:

• Investigation: We will promptly investigate the breach to determine its scope and impact.
• Containment: We will take immediate steps to contain the breach and prevent further unauthorized access.
• Notification to authorities: We will notify the relevant data protection authorities within 72 hours of becoming aware of a breach (as required by GDPR), and comply with all applicable state breach notification laws.
• Notification to affected individuals: We will notify affected individuals without undue delay, by email or postal mail, with details about the breach, what information was involved, steps we are taking, and steps you can take to protect yourself.
• For children's data: Parents/guardians will be notified directly if their child's data is involved in a breach.
• Remediation: We will take corrective action to prevent similar breaches in the future and may offer credit monitoring or identity theft protection services for significant breaches.
• Documentation: All breaches are documented internally as part of our compliance records.

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us:

For CCPA/CPRA requests, you may also visit our Do Not Sell My Personal Information page.