Privacy Policy
1. Who we are
The Talent ID service is operated by Talent ID LLC (name pending registration), established in Ukraine. Privacy contact: privacy@talent-id.org. For questions about children's data under the Children's Online Privacy Protection Act (COPPA), parents can use the same address; we reply within 30 days. This policy also serves as our notice at collection for residents of California and other U.S. states with comprehensive privacy laws.
2. What data we collect
Adult users: name, email, cell phone number, role, organization, settings, sign-in logs; if you sign in with Google — the name and email from your Google account (we never receive your Google password); a log of account use (which sections were opened — without their content).
Children (players): name, date of birth, team group, anthropometrics (height, weight), test results, coach ratings, sports physical and medical clearance dates, wellness (a daily check-in, including whether something hurts), recommendations from the coach or the academy physician (without diagnoses), psychological test results (only with separate parental consent), attendance and training load, readings from the club's sports devices (distance, speed, heart rate during practice), tags on practice and game videos (only with separate parental consent). A child's data is entered by the club or the parents; parents of a child who is not on a club roster may keep a short profile themselves (year and quarter of birth, city, height, weight, 30 m sprint, preferred foot).
We do not collect: medical records, diagnoses, photos of children in profiles, or biometric data for identification. We do not collect precise geolocation.
Technical: IP address, device type, cookies (see the Cookie Policy).
Under the CCPA categories, this means identifiers, customer records, internet or other electronic network activity, and — for children — sensitive personal information related to health (wellness and clearance dates), which we use only to provide the service.
3. Purposes and legal bases
Providing the service under a contract with an academy, club or school; verifiable parental consent — for children's data and for each separate profile disclosure; security and abuse prevention; legal obligations — accounting and lawful requests from authorities. We comply with COPPA and the FTC's COPPA Rule (16 C.F.R. Part 312), Section 5 of the FTC Act, and applicable state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA). As the operator is established outside the United States, the Law of Ukraine «On Personal Data Protection» (No. 2297-VI) also applies to our processing. We do not sell personal information and do not «share» it for cross-context behavioral advertising, and we have not done so in the past 12 months.
4. Children's data
Children do not have their own accounts and the service is not designed for children to use. A child's data is processed only with the consent of a parent (legal guardian). For children under 13, we obtain verifiable parental consent as required by COPPA before any of the child's data is used, and we give parents direct notice of our practices; the club may enter data only after a parent has given that consent in the service. Talent ID applies a stricter rule than the law requires: all consents for a child's data are given by the parent, whatever the child's age (under 18). Parents can review the child's data in their account, correct it, download a full copy at any time («My data»), refuse further collection or use, ask us to delete it, or withdraw consent — without losing access to the parts of the service that do not need that data. We do not use children's data for advertising, do not build advertising profiles and do not condition a child's participation on disclosing more data than is reasonably necessary. Selection decisions are made by the coach — the service only shows calculations.
5. Who we share data with
Coaches and management of your organization — within their role. Other clubs and academies — only with separate parental consent for each specific request. The soccer federation or state association — if your academy has connected the data exchange and registered the child: only full name, date of birth, academy and team group, position, city and registration number (in return, official game reports are added to the profile); tests, health, family and contacts are not shared. Your academy's own systems via the open API (Elite package) — only if the academy's management has created an access key: full name, date of birth, team group, position, measurements and attendance of that academy's players, read-only (health, wellness, family and contacts are not shared); the key can be revoked at any time, every request is logged (30 days). Anyone you yourself send a link to the child's development passport (created by parents only, valid for 7 days, can be revoked): full name, year of birth and age, position, academy and team group, medical clearance status, attendance over 90 days, games and latest measurements — without contacts and without other children's data. A scout or club the academy sends a link to a playlist of video clips (only with the separate parental consent «Clips for scouts and clubs», up to 30 days, parents are notified, can be revoked): full name, year of birth, position and clips featuring the child; a clip plays from the game recording in the academy's video service, so the recipient can technically watch the whole recording. Advertisers — nothing except the number of parents (fewer than 20 is not shown). Service providers under written contracts that limit their use of the data: hosting and database in the EU (Ireland, Supabase); content delivery, the «human, not a bot» check and storage of game files in the EU (Cloudflare); an email service; an SMS service for the phone verification code; Google — only if you choose to sign in with Google; a server that detects moments in game videos (Modal, USA) — it receives a game recording only for the time of the analysis and does not keep it; payment services — card data never reaches us. Government authorities — only on a lawful basis (for example, a valid subpoena or court order).
6. Retention
Account — while it is active, and 30 days after a deletion request. Player data — while the child is at the club and up to 3 years after leaving, for the development history, unless the parents ask to delete it earlier. Original game recordings — 30 days (tags and clips — while the child is at the club). Website error log — 30 days. Account usage log and visit statistics — 13 months. Security logs — 12 months. Payment records — for the periods required by tax law. This section is our written data retention policy for children's personal information under the COPPA Rule: we keep it only as long as reasonably necessary for the purposes above and then delete it securely.
7. Your rights
Depending on your state of residence (for example, California, Colorado, Connecticut, Virginia, Texas and other states with comprehensive privacy laws), you may have the right to know and access the personal information we hold, to receive a copy in a portable format, to correct and delete it, to opt out of sale, sharing, targeted advertising and profiling (we do none of these), to limit the use of sensitive personal information, and to appeal our decision on your request. Parents have the COPPA rights described in section 4. We will not discriminate against you for exercising your rights. You may use an authorized agent; we may need to verify your identity. We reply within 30 days (and in any case within the period required by your state's law, for example 45 days under the CCPA). If we decline your request you may appeal by replying to our answer; you can also contact your state attorney general or, in California, the California Privacy Protection Agency (cppa.ca.gov), and the Federal Trade Commission (reportfraud.ftc.gov). You can also complain to the Ukrainian Parliament Commissioner for Human Rights. Most actions are available in your profile: «Language, theme and data».
8. Security
Encryption in transit and at rest, access separation at database level, two-factor sign-in with an authenticator app (available to everyone, recommended for academy management), review of new sign-ups by an administrator, access logs, daily backups, a security review before launch — a written information security program as required by the COPPA Rule. If a breach affects your personal information, we will notify you and the authorities as required by applicable state data breach notification laws.
9. International transfers
Talent ID's database is hosted in the European Union (Ireland), and the operator is established in Ukraine. By using the service from the United States, your data and your child's data are transferred to and stored outside the United States, where data protection law differs from U.S. law. The EU's General Data Protection Regulation (GDPR) applies to the hosting; transfers between the EU, Ukraine and the USA (including to the video analysis server in the USA and during Google sign-in) are made only with appropriate safeguards (EU Standard Contractual Clauses).
10. Changes
We will announce material changes by email and in the service at least 14 days in advance. If a change affects how we use children's data, we will ask parents for new consent before applying it.