Privacy Policy

1. Who We Are

EuroScout Pro ("EuroScout", "we", "us") operates euroscoutpro.com, a recruitment network connecting American football players, clubs, coaches and scouts across Europe. For the purposes of the UK GDPR and the EU GDPR, EuroScout is the data controller for the personal data described in this policy. EuroScout Pro is operated by a sole trader established in the United Kingdom. The proprietor's full name and trading address are being finalised and will be published here; we will provide them on request in the meantime. Because we are established in the United Kingdom, our lead supervisory authority is the UK Information Commissioner's Office (ICO); if you are in the EEA you may also complain to the supervisory authority of the country you live in. Where the EU GDPR requires a European representative for a UK-established controller offering services to people in the EEA, we will appoint one and name them here. Data protection questions can be sent to info@euroscoutpro.com.

2. Scope Of This Policy

This policy applies to anyone who visits the site, creates an account, or otherwise interacts with EuroScout, and is written to meet the disclosure requirements of the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). It works alongside our Terms of Service and Cookie Policy, not instead of them.

3. Categories Of Personal Data We Collect

We collect the following categories of data, depending on how you use the platform:

• Account and identity data: name, email address, password (hashed by our authentication provider), account role, and OAuth identifiers if you sign in with a third-party provider.
• Profile and recruitment data: date of birth, nationality, position, physical measurements, performance statistics, career history, club affiliations, and recruiting status — provided by you as a player or club.
• Content you submit: profile photos, film clips and film links, captions, messages sent to other users, club media, and bug reports.
• Payment data: for Premium subscriptions, billing is handled entirely by Stripe. We store subscription status and plan metadata, but never your full card number.
• Communications data: messages between users, call booking details, notification preferences, and support correspondence.
• Usage and device data: pages visited, profile views, film and clip engagement, votes cast, IP address, browser/device type, and approximate location derived from IP.
• Cookies and similar technologies: see our Cookie Policy for the full list of what we set and why.
• Push notification tokens: if you opt in to browser push notifications, we store the subscription endpoint needed to deliver them.

4. Why We Use Your Data, And Our Legal Basis

Under GDPR Article 6, every use of personal data needs a lawful basis. Here is ours, by purpose:

• Operating your account and the core service (profiles, messaging, watchlists, recruiting pipelines) — necessary to perform our contract with you.
• Processing Premium subscription payments — necessary to perform our contract with you, and to comply with tax/accounting obligations.
• Showing public profile and club directory content — necessary to perform our contract, since public discovery is the core purpose of the service you signed up for.
• Sending service emails (confirmations, call reminders, need matches) — necessary to perform our contract.
• Product analytics (PostHog), fraud prevention, rate-limiting and abuse detection — our legitimate interest in keeping the platform safe, reliable and improving over time, balanced against your privacy.
• Optional marketing or re-engagement emails, and non-essential analytics cookies — based on your consent, which you can withdraw at any time.
• Retaining records for billing, dispute resolution or legal claims — necessary to comply with a legal obligation, or our legitimate interest in defending our legal rights.

5. Public Profile Data

Player profiles are public: every player account is listed so that clubs can find it, and a player who is not looking can mark themselves unavailable instead of hiding. Players and clubs choose what profile content to add, and clubs choose whether their club profile is listed. Public pages may be viewed, shared and indexed by search engines and by other platform members for recruitment discovery. Do not include information in a public profile that you do not want visible to the public internet.

6. Private Platform Data

Messages, call requests, staff invites, admin notes, reports and account settings are treated as private operational data and are only shown to authorised users or administrators, never published publicly.

7. Cookies And Tracking Technologies

We use essential cookies for authentication and session security, and — only with your consent, collected through the notice shown on your first visit — optional analytics cookies to understand product usage. Two things are not held behind that consent gate and we would rather say so plainly than imply otherwise: anonymous page-performance measurement, which we treat as necessary to keep the service usable, and embedded third-party content such as film players, maps and video calls, which loads when you open the feature that uses it and is controlled by those providers. Our Cookie Policy names every cookie and storage key in each of those groups, with its duration and purpose, and you can change your analytics choice at any time from the footer of any page.

8. Who We Share Data With

We do not sell your personal data. We share data only with the service providers ("sub-processors") needed to run EuroScout, each acting under a data processing agreement, and only for the purposes described in this policy:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and content delivery.
• Stripe — subscription billing and payment processing.
• Postmark — transactional email delivery.
• Daily.co — video call infrastructure for scheduled recruitment calls.
• PostHog — product analytics (only after you accept optional analytics cookies).
• Upstash — rate-limiting infrastructure that briefly processes IP addresses to prevent abuse.
• Vercel Speed Insights — anonymous page-performance timings, collected for all visitors and not tied to your identity.
• Google Maps, YouTube and Hudl — embedded maps and film players, which receive your IP address when a page or feature containing them is opened.

9. International Data Transfers

Our service providers may process data outside your country of residence, including in the United States. Where that happens we rely on the safeguards recognised under the UK and EU GDPR — the UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, an adequacy decision, or the provider's certification under the EU-US and UK-US Data Privacy Framework. In practice: Supabase (database, authentication and file storage) and Vercel (hosting and delivery) serve this platform from European regions; product analytics is processed by PostHog in the EU and is routed through our own domain rather than sent directly to a third-party host; Stripe (payments), Postmark (transactional email) and Daily.co (video calls) are US-based providers covered by the transfer mechanisms above. You can ask us for details of the safeguards applying to any specific transfer.

10. Data Retention

We keep personal data only as long as we need it, and delete or anonymise it after that. You can request deletion of your account and content at any time (see Section 11). Our standard periods are:

• Account and profile data: for as long as your account is open. After you delete your account, or after 24 months of complete inactivity, the profile stops being displayed and the underlying records are deleted or anonymised within 90 days.
• Messages and call bookings: for the life of the account, then deleted with it — noting that a conversation is also held by the person on the other side of it, and their copy is governed by their own account.
• Film links and uploaded media: until you remove them or your account is deleted. Cached or backup copies can persist for up to 90 days after removal.
• Billing and subscription records: 6 years from the end of the relevant tax year, as UK tax law requires.
• Security, abuse-prevention and rate-limiting logs, including IP addresses: up to 12 months.
• Consent records (which version of these documents you accepted, and when): for as long as needed to evidence that consent, and at least the life of the account.
• Anything covered by an active legal claim or dispute: until that matter is finally resolved.

11. Your Rights Under GDPR / UK GDPR

If you are located in the EEA, UK or Switzerland, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), subject to our legitimate retention needs above.
• Restrict or object to certain processing, including processing based on legitimate interest.
• Receive your data in a portable format, or have it transmitted to another controller.
• Withdraw consent at any time, without affecting processing carried out before withdrawal.
• Lodge a complaint with your local data protection supervisory authority.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, in the last 12 months we have collected the categories of personal information listed in Section 3, for the business purposes listed in Section 4. We do not sell or share personal information for cross-context behavioural advertising, so there is nothing to opt out of under the "Do Not Sell or Share My Personal Information" requirement. You have the right to:

• Know what personal information we collect, use, disclose and (if applicable) sell or share.
• Delete personal information we hold about you, subject to certain exceptions.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of personal information (not applicable today, as noted above).
• Not be discriminated against for exercising any of these rights.
• Designate an authorised agent to make a request on your behalf.

13. Other US State Privacy Rights

If you live in a US state with its own consumer privacy law — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and Montana — you have broadly equivalent rights to access, correct, delete and obtain a portable copy of your personal data, and to opt out of targeted advertising, the sale of personal data and certain profiling. We do not sell personal data, do not use it for targeted advertising, and do not carry out profiling that produces legal or similarly significant effects. Exercise any of these rights by writing to info@euroscoutpro.com, and where your state provides one, you may appeal a refusal by replying to our response.

14. Children's Privacy

EuroScout Pro is not directed at, and is not intended for use by, anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

15. Data Security

We use industry-standard technical and organisational measures — including encryption in transit, access controls and rate-limiting — to protect personal data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

16. Changes To This Policy

We may update this policy as the product evolves. Material changes are reflected in a new policy version (this version: 2026-09-11) and, where you hold an account, you will be asked to reconfirm your consent to the current version the next time it materially changes.

17. Contact Us

Questions, requests to exercise the rights above, or complaints can be sent to info@euroscoutpro.com.