Privacy Policy

Privacy Policy — version 2026-09-01-draft-v2 Effective date: [EFFECTIVE DATE] 1. Controller [LEGAL NAME], [REGISTERED ADDRESS], company registration number [COMPANY REGISTRATION NUMBER]. Data protection contact: privacy@collegerecruit.tech. 2. What we collect Account data: email address, password (stored hashed, never in readable form), date of birth, age bracket, and the terms version you accepted with a timestamp. Profile data you choose to add: name, photo, city and country, graduation year, sport and position, height and weight, GPA and test scores, biography. Recruiting data you create: shortlists, athlete statistics, highlight links, portfolio answers and generated text, personal statements, coach contacts you add, drafted outreach and messages. Guardian data for members under 16: the guardian email address given by the child, the consent decision, its timestamp and the IP address it came from. Technical data: IP address, browser user agent and locale, captured as evidence of consent and to prevent abuse. 3. Why, and on what legal basis To provide the service you asked for — performance of a contract. To gate accounts by age and obtain and record guardian consent — legal obligation and Article 8 GDPR. To publish a portfolio page — your explicit consent, plus the guardian's consent where the member is under 16. You can withdraw it at any time, which unpublishes the page. To keep the service secure and prevent abuse — our legitimate interest. 4. Children Our establishment is in Hungary, so the digital consent age is 16. An account declared as under 16 stays inactive and stores no athlete data until a parent or guardian confirms it. If nobody confirms within 7 days, we delete the pending account and the guardian email address. 5. Coach contact details you add When you save a coach to your account you are storing information about another person, so we keep this deliberately narrow. You obtain a coach's details yourself from the college's own public staff directory. We do not scrape, buy, or hold any central list of coach contacts, we never contact a coach, and we never send email on your behalf. We store only the coach's name, role, sport, college and the source you noted, together with the drafts you write. We do not store coach phone numbers. Our legal basis is legitimate interest: yours in organising your own correspondence, ours in providing the tool. We limited what we keep to professional contact information that the college itself publishes. Because these details reach us from you rather than from the coach, Article 14 GDPR would ordinarily require us to notify each coach individually. Doing that for every coach in every user's private address book would itself be unsolicited contact and would defeat the purpose of a private address book, so we rely on the disproportionate-effort exemption in Article 14(5)(b) and publish this notice instead, alongside a self-service opt-out. Any coach can block future contact through this service at our do-not-contact page. We store only an irreversible SHA-256 hash of the address, so the block works without us ever holding the address itself. We delete coach contacts when you delete them and when you close your account. 6. Who processes data for us We never sell your data. Our processors are: Supabase — database, authentication and file storage. Lovable — application hosting and the AI gateway that routes model requests. Google, reached through the Lovable AI gateway — the language model that generates your drafts, portfolio text and personal statements. Your profile and statistics are sent to it to produce that text. Resend — transactional email such as account confirmation, guardian consent requests and portfolio prompts. Each acts under a data processing agreement. Coaches only ever see what you send them yourself, from your own mailbox. A portfolio page is visible publicly only after you explicitly publish it. 7. Analytics and cookies We use the privacy-friendly analytics built into our hosting platform to count page views and referrers in aggregate. We do not run advertising trackers, and we do not sell or share data with advertisers. The cookies we set are strictly necessary ones that keep you signed in. 8. Transfers Some processors operate outside the EEA. Those transfers rely on the European Commission's Standard Contractual Clauses. 9. How long we keep it Account and recruiting data: while your account exists, then deleted within 30 days of closure. Pending unconfirmed child accounts: 7 days. Consent records: kept for 5 years after the account closes, because we must be able to prove consent existed — withdrawing consent stops the processing but never erases the record that consent was given. Do-not-contact hashes: kept indefinitely, because deleting one would un-block someone who asked to be left alone. 10. Your rights Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent at any time. Write to privacy@collegerecruit.tech. You can complain to Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), Budapest, Falk Miksa utca 9-11., ugyfelszolgalat@naih.hu. 11. Security Data is encrypted in transit, passwords and consent tokens are stored only as hashes, and access to your rows is enforced in the database itself, not only in the app.