Privacy policy

AcademyOS is operated by Rawad Aridi (“we”, “us”). For privacy questions or requests concerning your information, contact rawadkaridi@gmail.com.

For player, guardian and staff records entered by an academy, the academy normally decides why information is collected and who may use it; it is the data controller. We provide AcademyOS and process those records on the academy’s instructions. We are responsible for processing we determine ourselves, such as account administration, service security and support.

This notice covers the website, staff, player and family portals, and the AcademyOS Backups utility. An academy’s own privacy notice also applies to its activities. Contact us if you are unsure who should handle a request.

• Accounts and access: name, email, authentication identifiers, organisation membership, staff roles and player or guardian account links.
• Academy records: player name, preferred name, date of birth, contact details, photograph, squad and jersey information, position, membership history, guardian relationships and emergency contacts.
• Participation and administration: schedules, attendance, evaluations, shared nutrition plans, documents, registration submissions, consent choices, announcements and notification preferences.
• Fees: academy charges, balances, payment records, refunds and receipts. The free pilot does not collect subscription card payments; recording an academy payment is not the same as processing a card payment.
• Sensitive records, where enabled: health or injury information and restricted clinical notes supplied by authorised academy staff. Do not enter unnecessary medical, identity or financial information.
• Technical and support information: IP address, browser and device information, request and error logs, security events and information you provide when contacting support.

Information may come from you, your academy, an authorised guardian or staff member, or an identity provider used to sign in. Not every category is collected for every person.

We use information to operate accounts and portals, deliver academy features, maintain access boundaries, communicate requested updates, investigate faults and abuse, support users and meet applicable legal obligations.

Where applicable, the operator relies on service-contract requirements for account and support functions, legitimate interests in proportionate service security, legal obligations, and consent for optional processing that requires it. The academy must identify and communicate the appropriate lawful grounds for its records, including any additional requirements for children, health information or overseas transfers. This notice is not a blanket consent request.

A player may have their own account while an authorised guardian has separate access to the same linked player. Neither account gives access to the academy’s entire directory. The academy must verify guardian authority and arrange age-appropriate information and any required parental or guardian permission before processing children’s information.

Account creation, portal invitations and registration are distinct from permission for photography, publicity or other optional uses. A private profile photograph is not permission for public sharing. Academies must respect the scope of each consent and handle withdrawal requests; recording a consent does not itself prove that every proposed use is lawful.

Player and family profile details are read-only in the portals. Ask the academy to correct them. Private staff drafts and clinical notes are not part of the player or family view.

Authorised academy staff see records according to their role and assigned scope. Linked players and guardians see only the information made available to their portal, with fee access subject to the applicable access settings. Operator access is limited to legitimate service administration, authorised support, recovery, security or legal needs.

• Clerk: account authentication and organisation identity. AcademyOS manages its own staff permissions.
• Vercel: website hosting and request processing.
• Supabase: application database and uploaded-file storage.
• Google: the separately authorised backup destination described below; maps or address lookup when those features are configured and used.
• Optional providers: external AI document processing and transactional email only when the relevant feature is available and used. AI import availability and provider safeguards are described below; email delivery remains disabled in the current production pilot.

Private player documents, photos and staff credentials have access controls. Academy or squad logos may be publicly accessible by design; do not use a public logo upload for personal records. Recipients can keep copies of files they are authorised to download. We may disclose information where legally required or necessary to address a security incident, with the applicable safeguards.

Operator-only tool: AcademyOS Backups connects the operator’s Google account to store encrypted recovery archives. Players, guardians and academy staff do not need to connect Google Drive to use their portals.

The tool requests drive.file, not access to all Drive files. Google grants per-file access to items selected for the app or created by it. The tool adds its own checks restricting its destination to the operator-selected private AcademyOS folder; the OAuth scope itself is not a folder-wide sandbox.

It reads the selected folder’s identifier, name, type and access metadata, creates encrypted archive files there, and reads archive metadata and encrypted bytes to verify a transfer. Locally stored authorisation tokens allow renewed access without repeated sign-in. Tokens and encryption keys are not placed in backup archives or website source code.

Google receives encrypted archive contents and file metadata such as names, sizes and timestamps. Archive names do not contain player or guardian names. The tool does not browse unrelated Drive files, share the folder publicly, or use Google data for advertising, credit decisions or AI training. Human access is limited to the operator’s authorised recovery or support, security investigation or legal requirements.

Use of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. The operator can revoke the connection through Google account connections. Revocation stops future API access; it does not delete archives already stored in Drive. Contact the operator for archive or local-token removal.

Backup availability: production backups are not active. Testing has used encrypted synthetic content only; no production data has been exported through this tool. Daily backups with 14-day archive retention are proposed, not an available recovery service. Any future archive deletion will be limited to this tool’s backups, not unrelated Drive files.

When AI-assisted import is available, an authorised staff member can send source text or a document to an external AI service after confirming authority to do so. Remove unrelated sensitive information first, particularly when a roster concerns children. AcademyOS does not store the original import upload as a document. Analysis does not create player profiles, nutrition templates or plans; staff must review and confirm the extracted information before saving it. Content-free attempt and security audit records may still be kept. Manual entry remains available.

Current pilot status: Gateway-managed OpenAI import is enabled in the production pilot. Bounded checks with fictional roster and diet sources have verified extraction, human review and saving synthetic records. These checks do not verify every supported format or source, clinical suitability or legal compliance. Processing real player or guardian information still requires the academy’s required permissions and privacy review.

When staff use AI import, Vercel AI Gateway and OpenAI receive the source needed to transcribe it. The route restricts processing to OpenAI, requires Gateway Zero Data Retention and no prompt training, disables response storage and does not record source content in application telemetry. Gateway-managed credentials use Vercel’s eligible provider agreements rather than a separately funded personal OpenAI account. Provider safety and feature exceptions still apply; these settings are not a universal no-retention or compliance guarantee. The operator must recheck the effective route and any configured provider credentials before credential or routing changes. See Gateway’s retention controls and OpenAI’s data controls. These controls do not replace the academy’s lawful grounds, required permissions or privacy review.

Optional in-app and email notification choices are managed in notification settings. Important in-app account and cancellation notices may remain enabled. Email delivery requires a configured provider and the applicable opt-in; native mobile or browser push delivery is not part of the current pilot.

Sign-in uses cookies and related browser storage to maintain sessions and protect accounts. Local storage remembers interface choices such as collapsed sidebar groups. The application does not currently include advertising trackers or optional audience analytics. Enabled third-party embeds, such as maps, can receive an IP address, browser details and the requested venue address under their own notices.

The current production application database and file-storage project is hosted in Ireland. Hosting, authentication, support, maps and Google services may process information in other countries.

Applicable overseas-transfer requirements and processor arrangements must be assessed before live data is introduced. Contact the operator for information about the relevant providers and transfer arrangements; this notice does not certify that those arrangements have been completed.

Controls include authenticated sessions, role and record-level access restrictions, private storage policies and separated development and production environments. The backup utility encrypts archive contents before transfer. No system is completely secure. Report suspected unauthorised access promptly; we will assess incidents and make notifications where required.

Academy records are retained according to the academy’s documented purposes, instructions and applicable obligations. Account, security and support records are retained only as needed for their purposes, legal duties and dispute handling. Retention periods must be agreed and documented for the pilot before real records are introduced; deactivating a player preserves their history and is not deletion.

Contact the academy or operator to request deletion. We may need to retain particular records where the law requires it and explain any applicable limitation. Account deletion does not automatically erase an academy’s finance, consent or attendance history. Copies already downloaded by authorised recipients are outside automated deletion.

If recovery archives are activated, deleted records can remain in restricted archives until the approved retention period ends. A recovery process must reapply relevant deletion instructions. The proposed 14-day archive window does not determine the retention of active academy records or provider security logs.

Depending on the applicable law, you may request information about processing, access, correction, deletion, restriction or portability, object to certain processing, withdraw consent, or seek human review of a significant automated decision. Withdrawal does not undo processing that was lawful before withdrawal. AI import does not make eligibility or medical decisions for you.

For academy-held records, start with your academy. For platform questions, or if you need help identifying the responsible party, email rawadkaridi@gmail.com. We may ask for proportionate identity or authority verification; do not email passwords or unnecessary identity documents. Requests are handled within applicable legal time limits.

You may also complain to the relevant data-protection authority, including the Nigeria Data Protection Commission where applicable, without first giving up any other right.

Material changes to purposes, providers, Google data use or the operator’s contact location will be reflected in an updated notice and communicated as appropriate. Where fresh consent is required, it must be obtained before the new processing begins.