Privacy Policy

This Privacy Policy for ScoutEvo LLC ("we," "us," or "our") describes how and why we collect, store, use, and share your personal information when you use our services ("Services"), including when you:

• Visit our website at https://scoutevo.com or any website of ours that links to this Privacy Policy
• Use ScoutEvo — a professional hockey recruitment network connecting hockey players (youth through professional) with scouts, coaches, advisors, and GMs. Players build profiles; staff use scouting lists and a full recruitment pipeline.
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have questions, contact us at privacy@scoutevo.com.

Summary of Key Points

Table of Contents

1. What Information Do We Collect?
2. How Do We Process Your Information?
3. What Legal Bases Do We Rely On?
4. When and With Whom Do We Share Your Personal Information?
5. Do We Use Cookies and Other Tracking Technologies?
6. How Do We Handle Your Social Logins?
7. How Long Do We Keep Your Information?
8. How Do We Keep Your Information Safe?
9. Data Breach Notification
10. Children's Privacy and Minor Users
11. What Are Your Privacy Rights?
12. Controls for Do-Not-Track Features
13. Do United States Residents Have Specific Privacy Rights?
14. Privacy Rights for Canadian Residents
15. Do We Make Updates to This Policy?
16. How Can You Contact Us About This Policy?
17. How Can You Review, Update, or Delete the Data We Collect?

1. What Information Do We Collect?

Personal Information You Disclose to Us

We collect personal information that you voluntarily provide when you register on the Services, participate in activities on the Services, or otherwise contact us. The personal information we collect may include:

• Names
• Email addresses
• Phone numbers (optional contact field)
• Job titles and roles
• Account credentials — authentication is managed exclusively by our provider Clerk; ScoutEvo never receives, stores, or has access to your password
• Contact preferences and social media handles (optional)
• Date of birth / birth year
• Height and weight (player profiles, optional)
• Hockey position, shooting hand, level, league, and current team
• Academic information (player profiles, optional): GPA or percentage average, graduating class, SAT/ACT scores, NCAA Eligibility Center registration, and intended field of study
• Highlight video links (YouTube / Vimeo URLs — we do not host the video files)
• Profile photos, avatar, and banner images (uploaded to and stored on Supabase)
• Bio / about section
• Organization or team affiliation (for staff)
• Career experience and history (for staff)
• Events you post (title, dates, venue and location, birth years, level, host name, description, and registration link)
• Events you mark yourself as attending, and whether your name is shown or you are counted only
• Event claim requests (your organization, your role, and any note you provide) and event reports you submit

Date of Birth and Physical Measurements. Date of birth is collected during account registration for age verification and access control purposes. Height and weight are collected as part of your player profile for recruitment purposes. Once set, date of birth cannot be changed, as it underpins age-based access controls and parental consent requirements. This restriction is disclosed to users at the time of registration. These data points are used solely for platform functionality and are never used for advertising, third-party profiling, or sold to any third party.

Profile Visibility. User profiles on ScoutEvo are not indexed by search engines and are not visible to the general public. Profiles are only visible to other authenticated (logged-in) users of the platform. Minor users' profiles remain hidden from all other users until parental consent is confirmed.

Spotlight Posts. ScoutEvo may feature adult players, staff, and published team or organization pages in "spotlight" posts on the ScoutEvo page, which logged-in users can see. A spotlight uses information already visible on your profile to logged-in users (such as your name, photo, position or role, team or organization, and location) and links to your profile. Minor users are never featured. To ask that you not be featured, contact privacy@scoutevo.com.

Public Event Listings. Events posted to the ScoutEvo Events board are public: anyone, including visitors who are not logged in and search engines, can see an event's title, dates, location, birth years, level, description, host name, registration link, and the number of players and verified scouts or coaches attending. The name of the account that posted an event is not shown publicly, and no attendee is named publicly. See Section 4 for who can see attendee names.

Data Export. You may request a copy of your profile data at any time by contacting us at privacy@scoutevo.com.

Payment Data. ScoutEvo does not collect, store, or have access to your payment card details, billing addresses, or other financial information. All payment processing — including card numbers, billing addresses, and transaction details — is handled exclusively by Stripe. We receive only a confirmation of payment status and a subscription tier identifier from Stripe. You may find Stripe's privacy notice at https://stripe.com/privacy.

Social Media Login Data. We may provide you with the option to register using your existing social media account (such as Google). If you choose to register in this way, we will collect certain profile information from the social media provider, typically your name and email address, as described in Section 6.

Information Automatically Collected

We automatically collect certain information when you visit, use, or navigate the Services. This includes IP addresses, browser type and version, device identifiers, operating system, referring URLs, pages visited, session duration, and other usage data. This information is used to operate and improve the Services, diagnose technical issues, and ensure platform security. This data is processed through our infrastructure provider Vercel and our database provider Supabase.

Profile Views. When you view another user's profile while logged in, we record that view. The profile owner can see that their profile was viewed, as described in Section 4.

Sign-Up Source. When you create an account, we record which part of the Services you came from (for example, an event page you were viewing). We use this only to understand which features help people join ScoutEvo.

2. How Do We Process Your Information?

We process your personal information for the following purposes:

• To facilitate account creation, authentication, and manage user accounts
• To deliver and facilitate delivery of services to you
• To respond to user inquiries and offer support
• To send administrative information such as changes to our terms and policies
• To send transactional notifications, including parental consent and safety notifications for minor user accounts
• To fulfill and manage subscriptions and payments
• To enable user-to-user communications (messaging, recruiting inquiries)
• To calculate program fit scores and generate recruitment insights displayed to player Pro subscribers — this involves automated processing of profile data (position, level, league, location) against program criteria. It does not constitute legally significant automated decision-making; players are not excluded from any program based solely on a fit score
• To order search results in Explore. Results are ranked by subscription status, whether a player is marked "Open to offers," and how complete a profile is. All matching profiles remain visible; ranking only affects their order
• To show you which users viewed your profile (see Section 4)
• To operate the Events board, including event review, attendance counts, event claims, and reports
• To send a weekly email listing new events that may interest you, selected using your birth year, state or province, and men's or women's hockey preference. You can turn this email off at any time using the unsubscribe link in each email or in your notification settings. We do not send it to minor users whose parental consent is still pending
• To investigate and respond to reports of abuse, harassment, or violations of our community guidelines
• To save or protect an individual's vital interest, such as to prevent harm to a minor
• To identify usage trends and improve our Services
• To comply with our legal obligations
• To enforce our Terms of Service

3. What Legal Bases Do We Rely On?

We only process your personal information when we have a valid legal reason to do so, including:

• Consent: We may process your information if you have given us permission for a specific purpose, such as marketing communications.
• Performance of a Contract: We may process your personal information when necessary to fulfill our contractual obligations to you, including providing the Services you signed up for.
• Legitimate Interests: We may process your information when reasonably necessary to achieve our legitimate business interests, provided those interests are not outweighed by your rights.
• Legal Obligations: We may process your information where necessary for compliance with our legal obligations, including applicable privacy and child safety laws.
• Vital Interests: We may process your information where necessary to protect the vital interests of you or a third party, including the safety of minor users.

4. When and With Whom Do We Share Your Personal Information?

We do not sell your personal information to any third party. We may share your information in the following limited situations:

• Service Providers. We share data with the following third-party vendors who perform services on our behalf and are contractually obligated to protect your data:
  • Supabase — database and file storage
  • Clerk — user authentication and identity management
  • Stripe — payment processing
  • Resend — transactional email delivery
  • Vercel — web infrastructure, hosting, and CDN; processes IP addresses and request metadata for every page load
  • Upstash — Redis-based rate limiting; processes IP addresses to enforce per-IP request limits and protect against abuse
  • Rewardful — affiliate referral tracking; its script loads on our pages and processes visitor IP address and browser information, records visits that arrive through an affiliate link, and receives subscription details from Stripe for customers who were referred by an affiliate
• Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company. You will be notified of any such transfer and your rights under applicable law will be preserved.
• Legal Requirements: We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
• With Your Consent: We may disclose your personal information for any other purpose with your explicit consent.

What Other Users Can See

Some features show information about you to other ScoutEvo users:

• Profile views. When you view a profile, its owner can see that it was viewed. Owners on a Pro plan see the viewer's name, role, and organization (or, for players, position, birth year, and team). Owners on the free plan see only the viewer's role.
• Event attendance (players). If you mark yourself as attending an event, you are always included in the public attendee count. Your name and profile are shown only to verified staff users on a Pro plan, and only if you choose to be visible to scouts. The same users can also see those upcoming events listed on your profile. You can switch to "count only" or remove your attendance at any time. Other players never see your name in an attendee list or the events on your profile.
• Event attendance (staff). Staff attendance is counted only by default. If you choose to show your name, it is visible to logged-in staff users and to players on a Pro plan, on the event and on your profile. Events you host are listed on your profile. Only verified staff are included in the public count of scouts and coaches.
• Events you post. Event details are public as described in Section 1. The account that posted an event is visible only to ScoutEvo administrators.

5. Do We Use Cookies and Other Tracking Technologies?

We use cookies and similar tracking technologies to maintain the security of our Services and your account, manage authentication sessions, remember your preferences, and assist with basic site functions. These are primarily first-party functional cookies necessary for the platform to operate. We do not use third-party advertising or behavioral tracking cookies.

Affiliate referral cookie. If you arrive at ScoutEvo through an affiliate's referral link, our affiliate tracking provider, Rewardful, sets a cookie that records which affiliate referred you, so the affiliate can be credited if you later subscribe to a paid plan. It is used only for affiliate attribution, not for advertising, and lasts for the referral period of our affiliate program (up to 12 months). See the Affiliate Program Terms.

For example, if you start an action on an event page (such as marking yourself attending or claiming an event) and then create an account, a short-lived first-party cookie (expiring after 24 hours) remembers that action so we can return you to it. If you start posting an event before signing in, your draft is saved in your browser's local storage on your device until you publish it.

You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable cookies, some parts of the Services may not function properly, including account login.

6. How Do We Handle Your Social Logins?

Our Services offer you the ability to register and log in using a third-party social media account (such as Google). Where you choose to do this, we will receive certain profile information from your social media provider — typically your name and email address. We will use the information we receive only for the purposes described in this Privacy Policy. We do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We encourage you to review their privacy policies before connecting your account.

7. How Long Do We Keep Your Information?

We retain personal information only as long as necessary for the purposes set out in this Privacy Policy, or as required by law. Our specific retention practices are as follows:

• Account data (profile information, settings, content you post): retained for the duration of your account. Upon account deletion, profile data is removed from active systems within 30 days.
• Backup systems: Deleted data may persist in encrypted backup systems for up to 90 days following deletion, after which it is permanently purged as part of our routine backup rotation.
• Staff-created data (scout lists, scouting notes, pipeline data, scouting reports): this data is owned by the staff user. Upon staff account deletion, this data is removed along with the account. Player profiles that appear in staff lists are not deleted when the staff account is deleted — only the staff user's private notes and evaluations are removed.
• Events and attendance: events you post remain on the Events board (marked as past events after they end) until you or an administrator delete them. When you delete your account, events you posted are deleted too, except events posted on behalf of a team or organization page, which stay with that page. Your attendance records are removed when you remove your attendance or delete your account. Event claim requests and event reports are kept as part of our moderation records.
• Payment records: Transaction records and subscription history are retained for 7 years as required by applicable financial regulations, even after account deletion.
• Communications logs: We may retain records of reported content, abuse reports, and related communications for up to 3 years to support legal compliance and platform safety obligations.

8. How Do We Keep Your Information Safe?

We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. All data is encrypted in transit (TLS) and at rest. Access to personal data is restricted to authorized personnel only. We use industry-standard authentication and access control practices through our service providers.

However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. We cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. You use our Services at your own risk.

9. Data Breach Notification

In the event of a data security breach that affects your personal information, we will notify affected users as required by applicable law. Our breach notification practices are as follows:

• Minnesota residents: We will provide notice in the most expedient time possible and without unreasonable delay, as required by the Minnesota Government Data Practices Act and Minnesota Statute §325E.61.
• California residents: We will provide notice within 45 days of discovering a breach affecting your personal information, as required by the California Consumer Privacy Act and California Civil Code §1798.82.
• Canadian users: We will notify affected Canadian users and the Office of the Privacy Commissioner of Canada as required by PIPEDA and applicable provincial law when a breach creates a real risk of significant harm.
• Other U.S. states: We will comply with the breach notification requirements of your state of residence to the extent applicable.

Notification will be provided by email to the address associated with your account, and where required by law, by substitute notice on our website. The notice will describe the nature of the breach, the types of information involved, steps we have taken or are taking to address the breach, and steps you can take to protect yourself.

If you believe your account has been compromised, contact us immediately at privacy@scoutevo.com.

10. Children's Privacy and Minor Users

Users Under 13

Our Services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are under 13, do not use or provide any information on our Services. If we learn we have collected or received personal information from a child under 13 without verified parental consent, we will delete that information promptly. If you believe we might have any information from or about a child under 13, contact us immediately at privacy@scoutevo.com.

Users Ages 13–17

ScoutEvo serves many users between the ages of 13 and 17 (youth hockey players). We take the privacy and safety of minor users seriously and apply the following protections:

• Parental consent: Users identified as minors (under 18) during account creation trigger a parental consent email. Minor profiles are not publicly visible until parental consent is confirmed.
• Limited visibility: Minor profiles are hidden by default and only become visible to other platform users upon parental approval.
• Event attendance: A minor who marks themselves attending an event is included only in the anonymous attendee count until parental consent is confirmed. After consent, the minor's attendance is visible only to verified staff users on a Pro plan, and only if the player has not chosen "count only." Attendee names are never shown publicly or to other players.
• No data selling: We do not sell personal information of any user, including minors.
• No targeted advertising: We do not use personal information of any user, including minors, for targeted advertising purposes.
• Messaging protections: Minor users are subject to the same messaging preference controls as all users — by default, only accepted connections may initiate new messages. Parents may also freeze their child's account at any time to block all new contact requests and messages.
• Parent portal and notifications: Parents and guardians have access to a dedicated management portal linked in all consent and notification emails. The portal allows parents to view their child's account status, review accepted staff connections, pause new contact requests and messages (freeze), and request account deletion. ScoutEvo also sends informational notification emails to the parent email address provided at registration when a staff user sends a connection request to, or initiates a first message with, a minor user. These notification emails include the staff user's name and organization but do not disclose message content.
• Parental rights: Parents or legal guardians may request to review, correct, or delete their child's personal information by contacting us at privacy@scoutevo.com. We will respond within 30 days.
• Safety reporting: Any user may report content or conduct they believe poses a safety risk to a minor using the platform's reporting tools. When such a report is submitted, ScoutEvo staff may review the reported content — including messages or posts — solely to investigate the report and protect the minor's safety. This processing is carried out under our vital interest and legal obligation bases. Report submissions are treated confidentially.

Players Evaluated by Staff

Staff users may add player profiles to private scout lists, scouting reports, and recruitment pipelines without the player's knowledge. This data — including any notes, ratings, and evaluations — is private to the staff user and is not shared with the evaluated player. Verified staff users on a Pro plan may also start a private scouting log for an event, which can include players who have chosen to be visible to scouts as attending that event. Players who are residents of jurisdictions with applicable privacy rights (including California under CCPA and Canada under PIPEDA) may have the right to know that such data exists and, in some cases, to request its deletion. Staff users are responsible for ensuring their use of player data complies with applicable law. To exercise any rights regarding data held about you by a staff user, contact us at privacy@scoutevo.com. We will make reasonable efforts to assist, subject to our data retention obligations and the staff user's legitimate interests in maintaining recruitment records.

11. What Are Your Privacy Rights?

Depending on your location, you may have certain rights regarding your personal information, including:

• The right to access and obtain a copy of your personal information
• The right to request correction of inaccurate personal information
• The right to request deletion of your personal information
• The right to withdraw consent at any time (where processing is based on consent)
• The right to opt out of the sale of personal information (we do not sell personal information)
• The right to data portability
• The right to lodge a complaint with your applicable data protection authority

To exercise these rights, visit scoutevo.com/contact or email privacy@scoutevo.com. We will respond to verified requests within the timeframe required by applicable law.

You may also update or delete your account information directly through your account settings at any time.

12. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals. If a standard is adopted in the future, we will update this policy accordingly.

13. Do United States Residents Have Specific Privacy Rights?

If you are a resident of a U.S. state with a comprehensive consumer privacy law — including but not limited to California, Colorado, Connecticut, Virginia, Utah, Texas, Montana, Oregon, Iowa, Indiana, Tennessee, Delaware, New Hampshire, and New Jersey — you may have additional rights regarding your personal information, including:

• Right to know what personal information is collected, used, disclosed, or sold
• Right to delete personal information
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of personal information (we do not sell or share personal information for advertising purposes)
• Right to non-discrimination for exercising your privacy rights
• Right to data portability in certain circumstances

California-specific rights (CCPA/CPRA). California residents have additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act. The categories of personal information we collect, as defined under CCPA, include: identifiers (name, email, IP address), personal records (date of birth, physical characteristics including height and weight), commercial information (subscription records), and internet activity (usage data). We do not sell or share your personal information for cross-context behavioral advertising. Date of birth and physical measurements (height, weight) are collected solely for platform functionality and are not used for advertising or profiling.

Minnesota-specific rights (MCDPA). ScoutEvo LLC is organized under the laws of Minnesota. Minnesota residents have additional rights under the Minnesota Consumer Data Privacy Act (MCDPA), effective July 31, 2025, including the right to access, correct, delete, and obtain a portable copy of your personal data; the right to opt out of profiling that produces legal or similarly significant effects; and the right to appeal our decisions regarding your privacy requests. We do not sell personal data or use it for targeted advertising. To submit a request or appeal, contact us at privacy@scoutevo.com. We will respond within 45 days, with a possible 45-day extension where reasonably necessary.

To submit a privacy request, contact us at privacy@scoutevo.com. We will respond within 45 days as required by California law. For other states, we will respond within the timeframe required by your applicable state law.

14. Privacy Rights for Canadian Residents

If you are a resident of Canada, your personal information is collected, used, and disclosed in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. We also monitor the progress of Canada's proposed Consumer Privacy Protection Act (CPPA / Bill C-27) and will update this policy to comply with any new requirements when that legislation takes effect.

Under PIPEDA, you have the right to:

• Know why we collect, use, or disclose your personal information
• Expect that your information is collected, used, or disclosed only for reasonable purposes
• Access your personal information and request corrections to it
• Withdraw consent to the collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice
• File a complaint with the Office of the Privacy Commissioner of Canada if you believe your rights have been violated

Quebec residents (Law 25). Quebec's Act respecting the protection of personal information in the private sector (Law 25 / Bill 64) imposes additional obligations on organizations handling personal information of Quebec residents. In accordance with Law 25: we have designated a privacy officer reachable at privacy@scoutevo.com; personal information of Quebec residents is transferred to and stored in the United States through our service providers (Supabase, Vercel, Upstash), and we rely on these providers' contractual data protection commitments to protect that information; you have the right to request de-indexing of personal information that identifies you where such information was collected without your knowledge or consent; and you may file a complaint with the Commission d'accès à l'information (CAI) if you believe your rights under Law 25 have been violated.

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, or as required by law. Data is stored on servers located in the United States through our service providers (Supabase, Vercel, Upstash). By using our Services, Canadian users acknowledge the transfer of their information to the United States, where privacy laws may differ from those in your province or territory.

To exercise your rights or ask questions about how we handle your personal information, contact our privacy officer at privacy@scoutevo.com. We will respond within 30 days.

15. Do We Make Updates to This Policy?

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this page. If we make material changes, we will notify you by prominently posting a notice of such changes or by directly sending you a notification by email. We encourage you to review this Privacy Policy periodically to stay informed of how we protect your information.

16. How Can You Contact Us About This Policy?

If you have questions or comments about this policy, or wish to exercise your privacy rights, contact us at:

17. How Can You Review, Update, or Delete the Data We Collect?

You have the right to request access to the personal information we collect from you, details about how we have processed it, corrections to inaccurate data, or deletion of your personal information.

Self-serve options: You can update most of your profile information and permanently delete your account directly through Settings → Account at any time — no request required.

Formal data requests (data access, portability, or requests involving data held by staff users): email privacy@scoutevo.com or visit scoutevo.com/contact. We will verify your identity and respond within the timeframe required by your applicable law, and no later than 45 days from receipt of your request.