Privacy Policy

This Privacy Policy for ScoutEvo LLC ("we," "us," or "our") describes how and why we collect, store, use, and share your personal information when you use our services ("Services"), including when you:

• Visit our website at https://scoutevo.com or any website of ours that links to this Privacy Policy
• Use ScoutEvo — a professional hockey recruitment network connecting hockey players (youth through professional) with scouts, coaches, advisors, and GMs. Players build profiles; staff use scouting lists and a full recruitment pipeline.
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have questions, contact us at privacy@scoutevo.com.

Summary of Key Points

Table of Contents

1. What Information Do We Collect?
2. How Do We Process Your Information?
3. What Legal Bases Do We Rely On?
4. When and With Whom Do We Share Your Personal Information?
5. Do We Use Cookies and Other Tracking Technologies?
6. How Do We Handle Your Social Logins?
7. How Long Do We Keep Your Information?
8. How Do We Keep Your Information Safe?
9. Data Breach Notification
10. Children's Privacy and Minor Users
11. What Are Your Privacy Rights?
12. Controls for Do-Not-Track Features
13. Do United States Residents Have Specific Privacy Rights?
14. Privacy Rights for Canadian Residents
15. Do We Make Updates to This Policy?
16. How Can You Contact Us About This Policy?
17. How Can You Review, Update, or Delete the Data We Collect?

1. What Information Do We Collect?

Personal Information You Disclose to Us

We collect personal information that you voluntarily provide when you register on the Services, participate in activities on the Services, or otherwise contact us. The personal information we collect may include:

• Names
• Email addresses
• Phone numbers (optional contact field)
• Job titles and roles
• Account credentials — authentication is managed exclusively by our provider Clerk; ScoutEvo never receives, stores, or has access to your password
• Contact preferences and social media handles (optional)
• Date of birth / birth year
• Height and weight (player profiles, optional)
• Hockey position, shooting hand, level, league, and current team
• Highlight video links (YouTube / Vimeo URLs — we do not host the video files)
• Profile photos, avatar, and banner images (uploaded to and stored on Supabase)
• Bio / about section
• Organization or team affiliation (for staff)
• Career experience and history (for staff)

Date of Birth and Physical Measurements. Date of birth is collected during account registration for age verification and access control purposes. Height and weight are collected as part of your player profile for recruitment purposes. Once set, date of birth cannot be changed, as it underpins age-based access controls and parental consent requirements. This restriction is disclosed to users at the time of registration. These data points are used solely for platform functionality and are never used for advertising, third-party profiling, or sold to any third party.

Profile Visibility.User profiles on ScoutEvo are not indexed by search engines and are not visible to the general public. Profiles are only visible to other authenticated (logged-in) users of the platform. Minor users' profiles remain hidden from all other users until parental consent is confirmed.

Data Export. You may request a copy of your profile data at any time by contacting us at privacy@scoutevo.com.

Payment Data. ScoutEvo does not collect, store, or have access to your payment card details, billing addresses, or other financial information. All payment processing — including card numbers, billing addresses, and transaction details — is handled exclusively by Stripe. We receive only a confirmation of payment status and a subscription tier identifier from Stripe. You may find Stripe's privacy notice at https://stripe.com/privacy.

Social Media Login Data. We may provide you with the option to register using your existing social media account (such as Google). If you choose to register in this way, we will collect certain profile information from the social media provider, typically your name and email address, as described in Section 6.

Information Automatically Collected

We automatically collect certain information when you visit, use, or navigate the Services. This includes IP addresses, browser type and version, device identifiers, operating system, referring URLs, pages visited, session duration, and other usage data. This information is used to operate and improve the Services, diagnose technical issues, and ensure platform security. This data is processed through our infrastructure provider Vercel and our database provider Supabase.

2. How Do We Process Your Information?

We process your personal information for the following purposes:

• To facilitate account creation, authentication, and manage user accounts
• To deliver and facilitate delivery of services to you
• To respond to user inquiries and offer support
• To send administrative information such as changes to our terms and policies
• To send transactional notifications, including parental consent and safety notifications for minor user accounts
• To fulfill and manage subscriptions and payments
• To enable user-to-user communications (messaging, recruiting inquiries)
• To calculate program fit scores and generate recruitment insights displayed to player Pro subscribers — this involves automated processing of profile data (position, level, league, location) against program criteria. It does not constitute legally significant automated decision-making; players are not excluded from any program based solely on a fit score
• To investigate and respond to reports of abuse, harassment, or violations of our community guidelines
• To save or protect an individual's vital interest, such as to prevent harm to a minor
• To identify usage trends and improve our Services
• To comply with our legal obligations
• To enforce our Terms of Service

3. What Legal Bases Do We Rely On?

We only process your personal information when we have a valid legal reason to do so, including:

• Consent: We may process your information if you have given us permission for a specific purpose, such as marketing communications.
• Performance of a Contract: We may process your personal information when necessary to fulfill our contractual obligations to you, including providing the Services you signed up for.
• Legitimate Interests: We may process your information when reasonably necessary to achieve our legitimate business interests, provided those interests are not outweighed by your rights.
• Legal Obligations: We may process your information where necessary for compliance with our legal obligations, including applicable privacy and child safety laws.
• Vital Interests: We may process your information where necessary to protect the vital interests of you or a third party, including the safety of minor users.

4. When and With Whom Do We Share Your Personal Information?

We do not sell your personal information to any third party. We may share your information in the following limited situations:

• Service Providers. We share data with the following third-party vendors who perform services on our behalf and are contractually obligated to protect your data:
  • Supabase — database and file storage
  • Clerk — user authentication and identity management
  • Stripe — payment processing
  • Resend — transactional email delivery
  • Vercel — web infrastructure, hosting, and CDN; processes IP addresses and request metadata for every page load
  • Upstash — Redis-based rate limiting; processes IP addresses to enforce per-IP request limits and protect against abuse
• Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. You will be notified of any such transfer and your rights under applicable law will be preserved.
• Legal Requirements: We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• With Your Consent: We may disclose your personal information for any other purpose with your explicit consent.

5. Do We Use Cookies and Other Tracking Technologies?

We use cookies and similar tracking technologies to maintain the security of our Services and your account, manage authentication sessions, remember your preferences, and assist with basic site functions. These are primarily first-party functional cookies necessary for the platform to operate. We do not use third-party advertising or behavioral tracking cookies.

You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable cookies, some parts of the Services may not function properly, including account login.

6. How Do We Handle Your Social Logins?

Our Services offer you the ability to register and log in using a third-party social media account (such as Google). Where you choose to do this, we will receive certain profile information from your social media provider — typically your name and email address. We will use the information we receive only for the purposes described in this Privacy Policy. We do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We encourage you to review their privacy policies before connecting your account.

7. How Long Do We Keep Your Information?

We retain personal information only as long as necessary for the purposes set out in this Privacy Policy, or as required by law. Our specific retention practices are as follows:

• Account data (profile information, settings, content you post): retained for the duration of your account. Upon account deletion, profile data is removed from active systems within 30 days.
• Backup systems: Deleted data may persist in encrypted backup systems for up to 90 days following deletion, after which it is permanently purged as part of our routine backup rotation.
• Staff-created data (scout lists, scouting notes, pipeline data, scouting reports): this data is owned by the staff user. Upon staff account deletion, this data is removed along with the account. Player profiles that appear in staff lists are not deleted when the staff account is deleted — only the staff user's private notes and evaluations are removed.
• Payment records: Transaction records and subscription history are retained for 7 years as required by applicable financial regulations, even after account deletion.
• Communications logs: We may retain records of reported content, abuse reports, and related communications for up to 3 years to support legal compliance and platform safety obligations.

8. How Do We Keep Your Information Safe?

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. All data is encrypted in transit (TLS) and at rest. Access to personal data is restricted to authorized personnel only. We use industry-standard authentication and access control practices through our service providers.

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. We cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. You use our Services at your own risk.

9. Data Breach Notification

In the event of a data security breach that affects your personal information, we will notify affected users as required by applicable law. Our breach notification practices are as follows:

• Minnesota residents: We will provide notice in the most expedient time possible and without unreasonable delay, as required by the Minnesota Government Data Practices Act and Minnesota Statute §325E.61.
• California residents: We will provide notice within 45 days of discovering a breach affecting your personal information, as required by the California Consumer Privacy Act and California Civil Code §1798.82.
• Canadian users: We will notify affected Canadian users and the Office of the Privacy Commissioner of Canada as required by PIPEDA and applicable provincial law when a breach creates a real risk of significant harm.
• Other U.S. states: We will comply with the breach notification requirements of your state of residence to the extent applicable.

Notification will be provided by email to the address associated with your account, and where required by law, by substitute notice on our website. The notice will describe the nature of the breach, the types of information involved, steps we have taken or are taking to address the breach, and steps you can take to protect yourself.

If you believe your account has been compromised, contact us immediately at privacy@scoutevo.com.

10. Children's Privacy and Minor Users

Users Under 13

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are under 13, do not use or provide any information on our Services. If we learn we have collected or received personal information from a child under 13 without verified parental consent, we will delete that information promptly. If you believe we might have any information from or about a child under 13, contact us immediately at privacy@scoutevo.com.

Users Ages 13–17

ScoutEvo serves many users between the ages of 13 and 17 (youth hockey players). We take the privacy and safety of minor users seriously and apply the following protections:

• Parental consent: Users identified as minors (under 18) during account creation trigger a parental consent email. Minor profiles are not publicly visible until parental consent is confirmed.
• Limited visibility: Minor profiles are hidden by default and only become visible to other platform users upon parental approval.
• No data selling: We do not sell personal information of any user, including minors.
• No targeted advertising: We do not use personal information of any user, including minors, for targeted advertising purposes.
• Messaging protections: Minor users are subject to the same messaging preference controls as all users — by default, only accepted connections may initiate new messages. Parents may also freeze their child's account at any time to block all new contact requests and messages.
• Parent portal and notifications: Parents and guardians have access to a dedicated management portal linked in all consent and notification emails. The portal allows parents to view their child's account status, review accepted staff connections, pause new contact requests and messages (freeze), and request account deletion. ScoutEvo also sends informational notification emails to the parent email address provided at registration when a staff user sends a connection request to, or initiates a first message with, a minor user. These notification emails include the staff user's name and organization but do not disclose message content.
• Parental rights: Parents or legal guardians may request to review, correct, or delete their child's personal information by contacting us at privacy@scoutevo.com. We will respond within 30 days.
• Safety reporting: Any user may report content or conduct they believe poses a safety risk to a minor using the platform's reporting tools. When such a report is submitted, ScoutEvo staff may review the reported content — including messages or posts — solely to investigate the report and protect the minor's safety. This processing is carried out under our vital interest and legal obligation bases. Report submissions are treated confidentially.

Players Evaluated by Staff

Staff users may add player profiles to private scout lists, scouting reports, and recruitment pipelines without the player's knowledge. This data — including any notes, ratings, and evaluations — is private to the staff user and is not shared with the evaluated player. Players who are residents of jurisdictions with applicable privacy rights (including California under CCPA and Canada under PIPEDA) may have the right to know that such data exists and, in some cases, to request its deletion. Staff users are responsible for ensuring their use of player data complies with applicable law. To exercise any rights regarding data held about you by a staff user, contact us at privacy@scoutevo.com. We will make reasonable efforts to assist, subject to our data retention obligations and the staff user's legitimate interests in maintaining recruitment records.

11. What Are Your Privacy Rights?

Depending on your location, you may have certain rights regarding your personal information, including:

• The right to access and obtain a copy of your personal information
• The right to request correction of inaccurate personal information
• The right to request deletion of your personal information
• The right to withdraw consent at any time (where processing is based on consent)
• The right to opt out of the sale of personal information (we do not sell personal information)
• The right to data portability
• The right to lodge a complaint with your applicable data protection authority

To exercise these rights, visit scoutevo.com/contact or email privacy@scoutevo.com. We will respond to verified requests within the timeframe required by applicable law.

You may also update or delete your account information directly through your account settings at any time.

12. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals. If a standard is adopted in the future, we will update this policy accordingly.

13. Do United States Residents Have Specific Privacy Rights?

If you are a resident of a U.S. state with a comprehensive consumer privacy law — including but not limited to California, Colorado, Connecticut, Virginia, Utah, Texas, Montana, Oregon, Iowa, Indiana, Tennessee, Delaware, New Hampshire, and New Jersey — you may have additional rights regarding your personal information, including:

• Right to know what personal information is collected, used, disclosed, or sold
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information (we do not sell or share personal information for advertising purposes)
• Right to non-discrimination for exercising your privacy rights
• Right to data portability in certain circumstances

California-specific rights (CCPA/CPRA). California residents have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act. The categories of personal information we collect, as defined under CCPA, include: identifiers (name, email, IP address), personal records (date of birth, physical characteristics including height and weight), commercial information (subscription records), and internet activity (usage data). We do not sell or share your personal information for cross-context behavioral advertising. Date of birth and physical measurements (height, weight) are collected solely for platform functionality and are not used for advertising or profiling.

Minnesota-specific rights (MCDPA). ScoutEvo LLC is organized under the laws of Minnesota. Minnesota residents have additional rights under the Minnesota Consumer Data Privacy Act (MCDPA), effective July 31, 2025, including the right to access, correct, delete, and obtain a portable copy of your personal data; the right to opt out of profiling that produces legal or similarly significant effects; and the right to appeal our decisions regarding your privacy requests. We do not sell personal data or use it for targeted advertising. To submit a request or appeal, contact us at privacy@scoutevo.com. We will respond within 45 days, with a possible 45-day extension where reasonably necessary.

To submit a privacy request, contact us at privacy@scoutevo.com. We will respond within 45 days as required by California law. For other states, we will respond within the timeframe required by your applicable state law.

14. Privacy Rights for Canadian Residents

If you are a resident of Canada, your personal information is collected, used, and disclosed in accordance with Canada's Personal Information Protection and Electronic Documents Act(PIPEDA) and applicable provincial privacy laws. We also monitor the progress of Canada's proposed Consumer Privacy Protection Act (CPPA / Bill C-27) and will update this policy to comply with any new requirements when that legislation takes effect.

Under PIPEDA, you have the right to:

• Know why we collect, use, or disclose your personal information
• Expect that your information is collected, used, or disclosed only for reasonable purposes
• Access your personal information and request corrections to it
• Withdraw consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice
• File a complaint with the Office of the Privacy Commissioner of Canada if you believe your rights have been violated

Quebec residents (Law 25).Quebec's Act respecting the protection of personal information in the private sector (Law 25 / Bill 64) imposes additional obligations on organizations handling personal information of Quebec residents. In accordance with Law 25: we have designated a privacy officer reachable at privacy@scoutevo.com; we conduct privacy impact assessments for high-risk processing activities including cross-border data transfers; personal information of Quebec residents is transferred to and stored in the United States through our service providers (Supabase, Vercel, Upstash), which transfer has been assessed and found to provide an adequate level of protection; you have the right to request de-indexing of personal information that identifies you where such information was collected without your knowledge or consent; and you may file a complaint with the Commission d'accès à l'information (CAI) if you believe your rights under Law 25 have been violated.

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law. Data is stored on servers located in the United States through our service providers (Supabase, Vercel, Upstash). By using our Services, Canadian users acknowledge the transfer of their information to the United States, where privacy laws may differ from those in your province or territory.

To exercise your rights or ask questions about how we handle your personal information, contact our privacy officer at privacy@scoutevo.com. We will respond within 30 days.

15. Do We Make Updates to This Policy?

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this page. If we make material changes, we will notify you by prominently posting a notice of such changes or by directly sending you a notification by email. We encourage you to review this Privacy Policy periodically to stay informed of how we protect your information.

16. How Can You Contact Us About This Policy?

If you have questions or comments about this policy, or wish to exercise your privacy rights, contact us at:

17. How Can You Review, Update, or Delete the Data We Collect?

You have the right to request access to the personal information we collect from you, details about how we have processed it, corrections to inaccurate data, or deletion of your personal information.

Self-serve options: You can update most of your profile information and permanently delete your account directly through Settings → Account at any time — no request required.

Formal data requests (data access, portability, or requests involving data held by staff users): email privacy@scoutevo.com or visit scoutevo.com/contact. We will verify your identity and respond within the timeframe required by your applicable law, and no later than 45 days from receipt of your request.