Privacy Policy

1. Introduction and Overview

Welcome to Scout Me Pro, a trading name of Cyco GNMC Holdings Ltd (Company Number: HE458993), a company registered in Cyprus with its registered address at 33 Theklas Lysioti, Dorothea Building, 1st Floor, Office 12, 3030 Limassol, Cyprus ("Company," "we," "us," or "our"). We are committed to protecting your privacy and ensuring the safety of all users, particularly children and young athletes under the age of 16.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform, which includes:

• The Scout Me Pro mobile application for iOS (Apple App Store) and Android (Google Play Store)
• The Scout Me Pro website at scoutmepro.com
• All related services, APIs, and features accessed through any of the above (collectively, the "Platform")

This policy applies globally and is designed to comply with:

• The General Data Protection Regulation (GDPR) - European Union
• The Children's Online Privacy Protection Act (COPPA) - United States
• The California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) - California, USA
• The UK Data Protection Act 2018 and UK GDPR - United Kingdom
• The Personal Information Protection and Electronic Documents Act (PIPEDA) - Canada
• The Australian Privacy Act 1988 - Australia
• The Protection of Personal Information Act (POPIA) - South Africa
• Lei Geral de Proteção de Dados (LGPD) - Brazil
• Apple App Store Guidelines and App Store Review Guidelines
• Google Play Developer Program Policies and Data Safety requirements
• Other applicable international, federal, state, and local privacy laws

IMPORTANT NOTICE FOR PARENTS AND GUARDIANS: Scout Me Pro is designed for young athletes, including those under 16 years of age. We require verifiable parental consent before collecting any personal information from children under 16. Please read this policy carefully and contact us at legal@scoutmepro.com if you have any questions.

2. Data Controller Information

For the purposes of applicable data protection laws, the data controller is:

For EU residents, we have appointed a Data Protection Officer (DPO) who can be contacted at dpo@scoutmepro.com for any privacy-related inquiries.

3. Information We Collect

3.1 Information You Provide Directly

We collect information you voluntarily provide when using our Platform:

Account Registration Information:

• Full name
• Email address
• Date of birth (to verify age and apply appropriate protections)
• Username and password
• Phone number (optional)
• Profile photograph
• Cover photograph (optional)
• Country and city of residence

Athletic Profile Information (Athletes):

• Preferred football position (e.g. goalkeeper, centre-back, striker)
• Preferred foot (left, right, or both)
• Team or club name (optional)
• Achievements (up to 10 entries, optional)
• Biography

Scout Profile Information (Scouts):

• Organisation name and type (e.g. professional club, college, agency, independent)
• Organisation website (optional)
• LinkedIn profile URL (optional)
• Years of scouting experience
• Number of athletes signed or recruited
• Specialisations
• Preferred age range for scouting
• Whether accepting inquiries

Content You Create:

• Videos and photographs uploaded to the Platform
• Video metadata (descriptions, hashtags, text overlays, music selections, visual effects)
• Comments, messages, and communications
• Profile descriptions and posts
• Feedback and survey responses

Parental/Guardian Information (for users under 16):

• Parent/guardian full name
• Parent/guardian email address
• Parent/guardian phone number
• Consent verification information
• Payment information for consent verification (processed securely, not stored)

3.2 Information Collected Automatically

When you access our Platform, we automatically collect certain information:

Device and Technical Information:

• Device type, brand, model, and operating system version
• App version and build number
• Browser type and version (web)
• IP address
• Mobile network information
• Time zone, language, and locale settings
• Screen resolution

Usage Information:

• Pages, screens, and features accessed
• Videos viewed and watch duration
• Search queries
• Interactions with content (likes, comments, shares)
• Time spent on the Platform
• Referral sources
• Click patterns and navigation paths
• Subscription tier and status

Location Information:

• Approximate location derived from IP address
• Country, region, and city (for content recommendations)
• We do not collect precise GPS location data from the mobile application

Crash and Diagnostic Data:

• Application crash reports and error logs
• Stack traces and diagnostic information
• Screenshots of the application screen at the time of an error (automatically captured for debugging purposes; these may incidentally include visible personal information on screen)
• Performance metrics and response times
• HTTP request failure data

Push Notification Data:

• Push notification token (a unique identifier assigned to your device for delivering notifications)
• Device platform (iOS or Android)
• Notification delivery and interaction data

3.3 Information from Third-Party Authentication

If you choose to sign in using a third-party authentication provider, we may receive:

• Apple Sign-In: Name, email address (or a private relay email), and a unique user identifier. Apple may allow you to hide your email address, in which case we receive a relay address.
• Google Sign-In: Name, email address, and profile photograph.

We do not receive or store your third-party authentication passwords.

3.4 Information from Other Third Parties

• Social media platforms (if you choose to link accounts)
• Payment processors (transaction confirmation only)
• Content moderation services (safety assessments)

3.5 Information We Do Not Collect

The Scout Me Pro mobile application does not collect or access:

• Precise GPS or geolocation data
• Contacts or address book data
• Calendar data
• Health or fitness data
• Biometric data (fingerprints, facial geometry)
• Payment card numbers (handled entirely by Apple, Google, or RevenueCat)
• IMEI, serial numbers, or hardware identifiers
• Advertising identifiers (IDFA/GAID)
• Call logs or SMS messages

4. Mobile Application Permissions and Data

The Scout Me Pro mobile application requests the following device permissions. Each permission is only used for the stated purpose and is requested at the time it is needed:

All permissions are optional and requested at the point of use. If you deny a permission, the related feature will be unavailable but the rest of the app will continue to function normally. You can change permission settings at any time through your device's Settings app.

4.1 Mobile Data Storage and Security

Authentication tokens and session data on your mobile device are stored using encrypted secure storage (iOS Keychain / Android Keystore). We do not store personal data in unencrypted local storage. Video drafts in progress are stored locally on your device until you choose to upload them.

5. Special Provisions for Children Under 16 (COPPA and GDPR-K Compliance)

5.1 Verifiable Parental Consent

Before collecting any personal information from a child under 16, we require verifiable parental consent through one of the following methods:

• Email Verification: A verification link or one-time code sent to the parent/guardian's email address
• SMS Verification: A one-time code sent to the parent/guardian's phone number
• Credit Card Verification: A card verification check (no charge) to verify parental identity
• Government ID Verification: Secure verification of parent/guardian identity
• Signed Consent Form: Digital or physical signed consent document
• Video Call Verification: Live verification with our trust and safety team

5.2 Limited Data Collection for Children

For users under 16, we limit data collection to only what is reasonably necessary for participation in the Platform:

• We do not collect more personal information than necessary
• We do not condition participation on disclosure of unnecessary information
• We do not share children's personal information with third parties except as necessary for Platform operation
• We do not use children's data for behavioral advertising
• We do not enable children to make their personal contact information publicly available
• Children's profiles default to private and are only made public after parental consent is verified

5.3 Parental Rights

Parents and guardians have the right to:

• Review the personal information collected from their child
• Request deletion of their child's personal information
• Refuse further collection or use of their child's information
• Withdraw consent at any time
• Access their child's account and activity
• Set restrictions on their child's account

To exercise these rights, contact us at legal@scoutmepro.com or through the parental dashboard in the application.

5.4 Content Moderation for Child Safety

All content involving users under 16 is subject to enhanced review:

• Automated AI screening of all uploaded content
• Human review of flagged content within 24 hours
• Immediate removal of inappropriate content
• Age-appropriate content recommendations
• Restricted messaging capabilities
• No direct contact with unverified adults

6. Legal Basis for Processing (GDPR)

Under the GDPR and similar regulations, we process your personal data based on the following legal grounds:

6.1 Consent (Article 6(1)(a) GDPR)

• Processing of children's data with parental consent
• Marketing communications
• Optional data collection (e.g., precise location)
• Cookies and similar technologies
• Push notifications

6.2 Contract Performance (Article 6(1)(b) GDPR)

• Account creation and management
• Providing Platform features and services
• Processing transactions and subscriptions
• Customer support

6.3 Legal Obligation (Article 6(1)(c) GDPR)

• Tax and accounting requirements
• Responding to legal requests
• Child safety reporting obligations
• Regulatory compliance

6.4 Legitimate Interests (Article 6(1)(f) GDPR)

• Platform security and fraud prevention
• Service improvement and analytics
• Crash reporting and diagnostic data collection
• Enforcing terms of service
• Protecting users from harmful content

Note: We do not rely on legitimate interests for processing children's data. All children's data processing is based on parental consent.

7. How We Use Your Information

7.1 Platform Operations

• Create and manage your account
• Enable you to upload and share athletic content
• Connect athletes with scouts and opportunities
• Provide personalized content recommendations
• Facilitate communication between users
• Process transactions and subscriptions
• Deliver push notifications for messages, updates, and alerts

7.2 Safety and Security

• Verify user identities and ages
• Moderate content for appropriateness using AI-powered screening
• Detect and prevent fraud, abuse, and policy violations
• Protect the safety of all users, especially minors
• Respond to reports and complaints
• Enforce our Terms and Conditions

7.3 Communications

• Send service-related notifications (email, push, and in-app)
• Respond to inquiries and support requests
• Send marketing communications (with consent)
• Notify you of policy changes
• Send parental notifications and reports

7.4 Improvement, Analytics, and Diagnostics

• Analyse usage patterns to improve services
• Monitor application performance and stability
• Diagnose and fix crashes, errors, and bugs
• Conduct research and development
• Test new features
• Generate aggregated, anonymised insights

7.5 Legal and Compliance

• Comply with applicable laws and regulations
• Respond to legal process and government requests
• Protect our legal rights
• Fulfil reporting obligations

8. How We Share Your Information

8.1 With Your Consent

We share information when you direct us to, such as when you choose to make your profile public or share content with specific users.

8.2 Other Users

Depending on your privacy settings, certain information may be visible to other users:

• Public profile information
• Content you choose to share publicly
• Interactions such as comments and likes

8.3 Legal Requirements

We may disclose information when required by law or when we believe disclosure is necessary to:

• Comply with legal obligations
• Respond to valid legal processes
• Protect the safety of any person
• Prevent fraud or illegal activity
• Protect our rights and property

8.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice and, where required, obtain consent before any such transfer.

9. Third-Party Service Providers and SDKs

We use the following third-party service providers and software development kits (SDKs) to operate our Platform. All service providers are contractually bound to protect your data, process it only for specified purposes, and comply with applicable data protection laws.

We encourage you to review the privacy policies of each third-party provider. Links are available upon request at legal@scoutmepro.com.

9.1 Data Processing Agreements

We maintain Data Processing Agreements (DPAs) with all service providers that process personal data on our behalf, ensuring they meet the requirements of GDPR and other applicable data protection laws.

9.2 Children's Data and Third Parties

For users under 16, we limit data sharing with third-party services to only what is strictly necessary for Platform operation. We do not share children's data with third parties for advertising, profiling, or marketing purposes.

10. International Data Transfers

Scout Me Pro operates globally, and your information may be transferred to and processed in countries other than your country of residence. As detailed in Section 9, some of our service providers operate in the United States and other jurisdictions. We ensure appropriate safeguards are in place for all international transfers:

10.1 Transfer Mechanisms

• Standard Contractual Clauses (SCCs): EU-approved contractual safeguards
• Adequacy Decisions: Transfers to countries with adequate protection
• Binding Corporate Rules: For intra-group transfers
• Your Consent: For specific transfers with your explicit agreement

10.2 Data Storage Locations

Our primary data storage is in the European Union. Some data may be processed in:

• European Union (primary — Supabase, PostHog, Sentry, SightEngine, Infobip)
• United States (with appropriate safeguards — RevenueCat, Expo, Resend, Anthropic, Google Cloud, Apple, Perspective API)
• Global CDN (Cloudflare — video content is distributed globally for performance)

11. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes described in this policy:

11.1 Retention Periods

11.2 Deletion Requests

Upon receiving a valid deletion request, we will delete or anonymise your data within 30 days, except where retention is required by law or for legitimate purposes (such as fraud prevention). We will also instruct our third-party service providers to delete your data in accordance with our Data Processing Agreements.

11.3 Account Deletion

You may request deletion of your account at any time by contacting us at legal@scoutmepro.com or through the account settings in the mobile application. Upon account deletion:

• Your profile and personal information will be deleted within 30 days
• Your uploaded content will be removed from the Platform
• Video content on CDN providers will be purged within 30 additional days
• Third-party service providers will be instructed to delete your data
• Some data may be retained as required by law (e.g., transaction records for tax purposes)

12. Your Privacy Rights

Depending on your location, you have various rights regarding your personal information:

12.1 Universal Rights

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data
• Portability: Receive your data in a portable format
• Withdraw Consent: Withdraw previously given consent

12.2 GDPR Rights (EU/UK Residents)

• Right to Erasure: Request deletion of your data
• Right to Restriction: Limit how we process your data
• Right to Object: Object to certain processing activities
• Right to Lodge a Complaint: File a complaint with a supervisory authority
• Right Not to be Subject to Automated Decision-Making: Request human review of automated decisions

12.3 CCPA/CPRA Rights (California Residents)

• Right to Know: Know what personal information is collected
• Right to Delete: Request deletion of personal information
• Right to Opt-Out: Opt-out of the sale/sharing of personal information
• Right to Non-Discrimination: Not be discriminated against for exercising rights
• Right to Correct: Correct inaccurate personal information
• Right to Limit: Limit use of sensitive personal information

12.4 How to Exercise Your Rights

To exercise any of your privacy rights, you may:

• Email us at legal@scoutmepro.com
• Use the privacy settings in your account
• Use the account deletion option in the mobile application settings
• Submit a request through our Privacy Request Form at scoutmepro.com/privacy-request

We will respond to your request within 30 days (or as required by applicable law). We may need to verify your identity before processing certain requests.

13. Cookies and Tracking Technologies

This section applies primarily to the Scout Me Pro website. The mobile application does not use cookies but may use equivalent technologies as described in Sections 3, 4, and 9.

13.1 Types of Cookies We Use

Essential Cookies

Required for basic Platform functionality. Cannot be disabled.

Functional Cookies

Remember your preferences and settings.

Analytics Cookies

Help us understand how users interact with the Platform. We use PostHog for analytics, which is hosted in the European Union.

Marketing Cookies

Used to deliver relevant advertisements (adults only, with consent).

13.2 Managing Cookies

You can manage cookie preferences through:

• Our cookie consent banner
• Your browser settings
• Account privacy settings

13.3 Do Not Track

We honour Do Not Track (DNT) signals. When DNT is enabled, we limit tracking to essential functionality only.

14. Data Security

We implement comprehensive security measures to protect your personal information:

14.1 Technical Safeguards

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Secure authentication mechanisms with encrypted token storage
• Password hashing using industry-standard algorithms
• Mobile device secure storage (iOS Keychain / Android Keystore) for authentication tokens
• Regular security assessments and penetration testing
• Web Application Firewall (WAF)
• DDoS protection
• Intrusion detection systems

14.2 Organisational Safeguards

• Employee background checks
• Privacy and security training
• Access controls and least privilege principles
• Incident response procedures
• Regular audits and compliance reviews

14.3 Data Breach Notification

In the event of a data breach affecting your personal information, we will:

• Notify affected users within 72 hours of discovery
• Report to relevant supervisory authorities as required
• Provide information about the breach and remedial steps
• Take immediate action to mitigate harm

15. Third-Party Links and Services

Our Platform may contain links to third-party websites or services, including social media platforms such as WhatsApp, X (Twitter), Instagram, and TikTok. We are not responsible for their privacy practices. We encourage you to read the privacy policies of any third-party services you access.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes:

• We will update the "Last Updated" date
• We will notify you via email or in-app notification for material changes
• For significant changes affecting children, we will obtain new parental consent
• We will provide at least 30 days' notice before changes take effect

Continued use of the Platform after changes constitutes acceptance of the updated policy.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

18. Supervisory Authorities

If you believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with a supervisory authority:

• EU: Your local Data Protection Authority
• UK: Information Commissioner's Office (ICO)
• USA: Federal Trade Commission (FTC)
• Cyprus: Commissioner for Personal Data Protection