SCOUTFORGE - Privacy Policy
Last updated: October 7, 2026
Effective: October 7, 2026
This Privacy Policy explains how Scoutforge, Inc., a Delaware corporation, together with its subsidiaries and affiliates (“ScoutForge,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information in connection with the ScoutForge football (soccer) scouting marketplace and related websites, applications, dashboards, and services (the “Platform”). It is incorporated into the ScoutForge Terms of Service. Capitalized terms not defined here have the meanings given in the Terms. This Policy provides notice of our information practices. Acknowledging this Policy or accepting the Terms does not, by itself, constitute consent to processing for which separate consent is required.
This Policy applies to Scouts, Clubs, academies, Agents and intermediaries, and their personnel; to Parents and Players where player-facing features are available; to people identified in scouting material or verification evidence; and to visitors and correspondents. Some features described here are introduced in phases. Describing a feature does not mean it is live. Processing associated with a future feature begins only when that feature is introduced and any required notices, choices, and safeguards are in place. Information about a person may nevertheless be submitted by another User through an existing feature, even if that person does not have an account or access to the feature.
1. Scope and Roles.
1.1 Marketplace.ScoutForge operates a professional marketplace that connects verified human scouts with football clubs, academies, and agents. Human scouting is primary. The Terms describe the parties’ commercial roles and responsibilities.
1.2 Our role.For personal information we decide how and why to process — accounts, verification, trust and safety, payments we administer, security, and our own legal obligations — ScoutForge is a controller, and, where applicable, a “business” under the California Consumer Privacy Act. Where we process personal information solely on a business customer’s documented instructions, we act as a processor or service provider, the applicable agreement governs that processing, and this Policy describes the processing for which we determine the purposes and means. Our role depends on the actual processing activity, not solely on the account type or the label in an agreement.
1.3 Contributor role.Where a Club, Agent, or Scout independently collects information about a Player or other person and submits it, that contributor is responsible for the lawfulness of its own collection and disclosure, and is ordinarily a separate controller. A person’s appearance in a report does not mean that person has an account, has been contacted, or has endorsed the report. The contributor’s responsibilities do not replace ScoutForge’s own obligations concerning information it receives, uses, or discloses.
2. Information We Collect.
We do not collect every category below from every person. Sensitive categories are identified in Section 2.4.
2.1 Information you provide.Depending on your role and the features you use, we collect identity and account data (name, email, credentials, role, organization, coverage region, professional profile, availability, and contact preferences); invitation and eligibility data, including accreditation, references, and information used to confirm that a professional account holder is an adult; verification data, including government identification and credential information submitted to become a Verified Scout or to confirm parental authority; marketplace content, including Gig postings, proposals, briefs, deliverables, Reports, Notebooks, ratings, reviews, referrals, support requests, and appeals; payment and tax data, including billing contact, transaction amounts, payout tokens, and tax identifiers where required; and records of your acceptance of the Terms and acknowledgment of this Policy, together with separately obtained consents where required. Payment providers process payment-card and bank details. ScoutForge does not store full payment-card numbers.
2.2 Scouting and player information.Reports, Notebooks, and profiles may identify a Player and describe observations, performance, career history, club or academy affiliation, and progression. A Certificate of Discovery records that a Scout submitted a verified first report on a Player, together with chain-of-custody metadata. It is a record of platform activity and credit. Contributors must not include unnecessary sensitive information. The Terms prohibit unfounded allegations of criminality, dishonesty, doping, match-fixing, age misrepresentation, or a medical, psychiatric, or disciplinary condition. We do not ask for medical or consumer-health information, and contributors must not submit it as scouting Content. If it is submitted, we restrict it and address removal, and any applicable obligations as described in Section 13.7.
Scouts may not upload photographs or video of Players as scouting Content. A Scout may link to lawfully published third-party footage. We do not host, control, or endorse that footage. Verification media submitted under the Terms to show Gig attendance is a separate, restricted category and is not a Player profile. Verification media must be limited to what is necessary to verify attendance and must not unnecessarily capture identifiable Players or bystanders. Where player-facing features are introduced, a Parent may provide a Player profile, progress information, or media through the Parent’s account, subject to Section 8. Direct messaging between a Club and a Player is not permitted. Contributors must not include a minor Player’s private contact details, home address, or unnecessary information about the minor’s schedule or precise whereabouts.
2.3 Verification, location, and activity data.For a Gig that requires proof of performance, we collect GPS check-in, device metadata, timestamps, before-and-after photographs or video, an optional video-call report, and the audit log of those events. Precise location for Gig verification is distinct from the approximate location inferred from an IP address. The verification feature explains when precise location is collected and requests the applicable device permission. We limit collection and disclosure of precise location and verification media to what is necessary for verification, dispute handling, security, and audit purposes. We also collect transaction status, access and download activity for paid content, and information needed to investigate fraud, circumvention, or a dispute. If private scouting mode is offered, it limits what other Users can see. It does not prevent ScoutForge from processing activity data for security, audit, safeguarding, and legal purposes.
2.4 Sensitive information.Depending on the feature, personal information we collect may include precise geolocation, when a Scout checks in to a Gig; government identification and account credentials, when we verify identity or secure an account; information of a known child, when a Parent uses a player-facing feature or a contributor submits a report about a minor; and a biometric identifier, only if you or a Parent choose an identity-verification method that uses one, and only through the verification vendor for that purpose. The verification notice identifies the provider, the information required, the results provided to ScoutForge, applicable retention practices, and any available alternative method before you choose a verification method. User-to-User message content may also constitute sensitive personal information under applicable law. We do not seek racial or ethnic origin, religion, health, sex life, or sexual orientation. If a contributor includes that information, we treat it as sensitive, restrict it, and may remove it. We do not use sensitive information to train a model, and we do not sell it. We apply the notice and consent requirements applicable to the actual verification method; using a vendor does not eliminate those requirements.
2.5 Communications and technical data.We process messages exchanged on the Platform, community posts, safety and content reports, correspondence with us, and related metadata. We collect device and log data, including IP address, device and browser type, operating system, approximate location inferred from IP address, cookie identifiers, and feature interactions.
2.6 Sources other than you.We receive information from the person who invited you; from a Club, Agent, Scout, or Parent who submits it; from payment, identity, and infrastructure providers; and from a service you choose to connect. We may derive a reputation score from Platform activity and reviews where that feature is offered. A reputation score is an aggregation of User input and our methodology. Section 9 describes reputation features and the process for challenging inaccurate inputs or a related moderation action. A score is not a warranty of skill.
3. How We Use Information.
3.1 Purposes.We use personal information to create and administer accounts and invitations; verify Users and credentials; provide profiles, search, Reports, Notebooks, messaging, and other requested features; operate live verification and audit logs; issue and display Certificates of Discovery; administer restricted and paid access; process subscriptions, commissions, payouts, refunds, and escrow-release conditions through our payment providers; meet tax and accounting duties; protect Users and minors; enforce access restrictions; investigate fraud, circumvention, and misconduct; moderate Content; handle correction and removal requests; report suspected exploitation or abuse to a competent authority; send service, security, transaction, renewal, and policy notices; and, where permitted, send marketing you can opt out of.
The Terms describe payment arrangements and ScoutForge’s fees. Payment-related processing must reflect the arrangement actually used for the transaction.
3.2 Why we process.We process personal information to provide the service you request, for our legitimate business operations (security, verification, safeguarding, moderation, dispute handling, scout credit, and service improvement), to comply with law, and with consent where we ask for it. Where EU or UK law applies and consent or another specific basis is required, we rely on that basis. Providing information required to open an account or complete a transaction is necessary to receive that service. We do not treat a contributor’s submission, or a person’s acknowledgment of this Policy, as consent to processing that requires that person’s separate consent.
3.3 Model training and automated features.Identifiable scouting Content is not used to train a machine-learning model. De-identification requires more than removing a name: we take reasonable measures to prevent information from being associated with an individual, including through performance, club, career, or other contextual details. We publicly commit to maintain and use de-identified information in that form and not attempt to re-identify it, except to test the effectiveness of de-identification where legally permitted. We contractually require recipients of de-identified information to comply with those restrictions. Children’s personal information and sensitive personal information are excluded from model-training datasets. Any Content used to develop an automated feature is first aggregated or de-identified. You may opt out of use of your Content for model training by written request to the privacy contact in Section 15. That choice is applied prospectively before Content is included in a new training dataset. We explain any limitations affecting previously prepared datasets or trained models when responding to the request, subject to applicable law. A contributor’s choice does not authorize use of another person’s information where additional permission or another legal requirement applies. We will not treat de-identification as a substitute for consent where law requires consent. We will give any additional notice, and any required right to contest, before a solely automated decision that produces a legal or similarly significant effect. We do not use personal information for cross-context behavioral advertising or targeted advertising, and we contractually restrict providers processing on our behalf to the specified services and other uses permitted by applicable law. We do not authorize those providers to use identifiable Content to train their own models. Providers acting independently for specified purposes are addressed in Section 4.2.
4. Who Receives Information
The Platform is a professional marketplace, not a private notebook. Disclosure follows the feature, the audience setting, and the restrictions in the Terms. Applicable privacy rights and the safeguards for minors also apply to these disclosures.
4.1 Other Users.A Scout’s profile, credentials, availability, authored Reports or Notebooks, reviews, and credit may be visible to Clubs, Agents, Scouts, and other audiences the feature authorizes. A public Report is accessible more broadly than a private or paid Report. Before publication or sharing, the feature identifies the applicable audience and whether downloading is available. Public information may be copied or indexed by third parties. A Club or Agent receives the brief, deliverable, verification status, and related information needed to commission and review a Gig. Raw location data and verification media are restricted and are not disclosed merely because a User commissions a Gig; any access is limited to what is necessary for verification or dispute handling and described in the feature. A Scout receives the brief and information needed to perform it. Authorized users on an organization account may access information associated with that account, within the seats purchased. A Parent-controlled Player profile, if introduced, is available only to the audiences disclosed in that feature. Clubs may view a Player profile where the feature allows it. They may not message the Player. Information about known minor Players in Reports and Notebooks is subject to the safeguards in Section 8, whether or not the Player has a Parent-controlled profile.
We do not promise that information you publish, or share with another User, remains confidential after that User receives it. The recipient’s use is restricted by the Terms. The recipient is independently responsible for its own use. Removing information from the Platform does not automatically erase downloaded or other recipient-held copies. We take any steps applicable law requires to communicate correction, deletion, or other valid privacy requests to recipients; a recipient’s separate responsibilities do not eliminate our own obligations.
4.2 Service providers.We disclose information to providers that host the Platform, provide security, identity checks, support, communications, and payment processing, under written terms that limit their use. Payments are processed by Stripe or a successor provider. A provider may also process information under its own notice when it determines the purposes itself, for example when Stripe handles a payment instrument under its own regulatory duties. We distinguish processing on our behalf from a provider’s independent processing and identify applicable independent-provider notices at the relevant interaction.
4.3 Advisers, authorities, and transactions.We disclose information to professional advisers, auditors, insurers, and prospective financing or acquisition counterparties under confidentiality obligations; to a competent authority where required by law or reasonably necessary to address safety, fraud, or legal process; and, in a merger, financing, reorganization, or sale, to the counterparty, subject to this Policy and applicable law. We limit these disclosures to information that is reasonably necessary for the purpose and apply appropriate confidentiality and security restrictions.
4.4 No sale, share, or targeted advertising.We do not sell personal information for money or other valuable consideration, subject to confirmation of the marketplace disclosures described in Section 4.1 before this Policy is published. We do not share personal information for cross-context behavioral advertising. We do not disclose personal information for targeted advertising. We do not sell precise geolocation, and we do not sell sensitive data. If we introduce any of those practices, we will update this Policy first and provide the required opt-out or consent mechanism before the practice begins. A disclosure is excluded from a statutory definition of sale only where the applicable legal requirements are satisfied. A payment for a Report or access to the Platform does not, by itself, establish an exclusion. Where an exclusion depends on a consumer directing disclosure, that direction must concern the information of the consumer whose information is disclosed; a contributor’s decision to submit another person’s information does not itself establish that person’s direction.
5. Notice at Collection.
The following summary is our notice at collection for the California Consumer Privacy Act, where applicable, and provides information relevant to other U.S. state laws. Retention is addressed in Section 10. We do not sell or share the categories below subject to the prepublication confirmation described in Section 4.4. We provide or link to applicable notices at or before collection, including additional notices for sensitive-data and verification features where required. The statutory-category mapping below applies only to information actually collected; future-feature descriptions do not represent that information has already been collected.
Category
Purposes
Recipients
Identifiers and account data (name, email, role, organization, account ID)
Account, invitation, verification, communications, security
Service providers; other Users as the feature authorizes; advisers and authorities as Section 4 describes
Professional and eligibility data (credentials, references, coverage); professional or employment-related information and identifiers
Scout verification, profiles, trust
Clubs, Agents, and other Users who can view the profile; identity vendors
Commercial and transaction data (subscriptions, Gig fees, commissions, payout tokens)
Billing, escrow release, tax, fraud prevention
Payment providers; the counterparty to the transaction; tax authorities if required
Scouting Content (Reports, Notebooks, reviews, Certificates of Discovery); identifiers, professional information, and inferences, as applicable
Marketplace operation, paid access, scout credit, moderation
Authorized audiences; hosting and security providers
Player information submitted by a contributor or Parent; identifiers, professional information, audiovisual information where permitted, and inferences, as applicable
Display to authorized audiences, correction and removal, safeguarding
Authorized audiences; not used for advertising
Precise geolocation and verification media; geolocation, audiovisual information, and sensitive personal information where applicable
Gig verification, disputes, audit
The Gig counterparty as status; trust, hosting, and security providers. Raw evidence only where necessary as described in Section 4.1. Not sold
Approximate location, device, and log data; geolocation, identifiers, and internet or other electronic network activity
Security, fraud prevention, service operation
Hosting and security providers
Communications content and metadata; electronic information, identifiers, and sensitive personal information where applicable
Delivery of messages, safety, disputes, legal holds
The recipient User; security providers
Government ID; a biometric identifier only if an identity check uses one; identifiers, biometric information, and sensitive personal information where applicable
Identity or parental-authority verification
The identity vendor, for that purpose only; ScoutForge receives the verification results described in the verification notice
Information of a known child; the applicable categories above, subject to additional protections
The Parent-requested feature, permitted scouting activity, safeguarding, and legal duties
Restricted audiences; no advertising; no model training
Inferences such as a reputation score, where offered
Display of reviews and standing
DisUsers who can view the profileplay of reviews and standing
6. Cookies and Similar Technologies.
We use cookies and similar technologies that are necessary to authenticate you, keep the service secure, remember a preference you set, and balance load. These are required for the Platform to function. Blocking them in your browser may prevent sign-in or a transaction. We do not currently use non-essential analytics, advertising, or social-media cookies. If we introduce them, we will describe them in a cookie notice and, where required, use them only after you have made the relevant choice. We honor a legally required opt-out preference signal, including a global privacy control, as described in Section 13. These statements apply to similar technologies and embedded services, not only to browser cookies.
7. Communications.
We send transactional and service messages, including security alerts, Gig and escrow notices, renewal reminders where auto-renewal law requires them, and changes to this Policy or the Terms. Essential security, legal, and transaction messages may continue while necessary to administer an account or transaction or meet a legal obligation. You may manage optional notifications through available settings. We send marketing only where permitted. You may opt out by the unsubscribe link in the message or by writing to the privacy contact. We do not send marketing to a known child, and we do not allow a Club to message a Player through the Platform.
8. Children and Young Players.
8.1 Adult accounts.Professional accounts are for adults. You may not register if you are under 16, except that a minor Player may participate only through a Parent or legal guardian, and only when player-facing features are available. The minimum Player age for those features is [10 / 13 / 16 — confirm before launch]. Player-facing features will not be activated until the minimum age and applicable age-screening, notice, consent, visibility, and deletion safeguards have been implemented. Adult account restrictions do not mean that the Platform holds no information about children: adult contributors may submit permitted scouting information about minor Players as described below.
8.2 Information about a minor submitted by an adult.A Report or Notebook may identify a minor because an adult contributor observed that Player. The contributor must have the lawful basis, and any parental permission, that applicable law and the Terms require, and must keep a record of it. A contributor’s warranty does not replace our own duty where law requires direct notice to, or consent from, a Parent. We may require evidence and may restrict or remove material if the requirement is not met. We apply age-appropriate safeguards to information about known minors whether submitted by a Parent or another contributor. Reports and Notebooks identifying known minor Players have restricted visibility by default and are not made available for public discovery. Any permitted disclosure or download is limited to the audiences and purposes identified in the feature and remains subject to applicable notice and consent requirements. A minor’s private contact details, home address, and unnecessary schedule or precise-location information must not be included. Parents and non-account Players may seek correction or removal through Section 12.
8.3 Information collected from a child.Before we activate a feature that is directed to children, or through which we knowingly collect personal information from a child under 13, we will give the Parent direct notice of what we collect, why, and who receives it; obtain verifiable parental consent before collection, by a method reasonably calculated to confirm that the person is the Parent; and obtain a separate verifiable parental consent before disclosing a child’s personal information to a third party for a purpose that is not integral to the service. We will not rely on an unchecked or self-attested checkbox. Targeted advertising and model training are not integral to the service. We limit collection to what is reasonably necessary for the feature the Parent requested, set minor profiles to restricted visibility by default, and disable public discovery. The direct notice explains the applicable recipients or specific recipient categories, disclosure purposes, consent method, and the Parent’s choice to allow collection and use without allowing non-integral third-party disclosures. A Parent account does not, by itself, replace a required verifiable-consent process.
We do not condition a child’s participation on the child disclosing more information than is reasonably necessary. We do not use a child’s personal information for targeted or behavioral advertising, and we do not use it to train a model. If we learn that we have collected personal information from a child in circumstances requiring authorization without that authorization, we will restrict it and delete it or obtain the legally required consent. We do not continue otherwise unauthorized use or disclosure while seeking that consent.
8.4 Parents’ rights.A Parent may review, correct, restrict, or delete the child’s personal information, or withdraw consent, by contacting us as described in Section 15. We may ask for enough information to confirm the Parent’s authority. Withdrawal may end the feature. We may retain a limited record of the consent, the request, and information we must keep for safety, a dispute, tax, or a legal hold. We will not retain a child’s information longer than reasonably necessary for the purpose. A reason to retain a limited compliance record is not a reason to retain the child’s entire profile, media, or scouting record. Section 10 describes the retention and deletion rules. We do not permit direct Club-to-Player messaging. Reports of suspected grooming, exploitation, or abuse may be shared with a competent authority.
9. Reputation, Referrals, and Automated Features.
Where offered, reputation scores and reviews reflect User submissions and our methodology. They are not an endorsement. The relevant feature describes the principal inputs, who can view the result, and how it is used, including whether it affects visibility, verification, account standing, or eligibility for opportunities. You may request correction of inaccurate personal information used in a score through Section 12 and request review of a score or its application through the reporting or appeal channel described in the feature. We distinguish an automated result from a decision reviewed by a person and provide applicable notices and rights based on the actual use and effect. You may appeal a moderation action under the Terms. Any referral or credit program is optional, and its terms explain the information used and the benefit offered. Where a program requires a financial-incentive notice or other specific privacy disclosure, we provide that notice before participation.
10. Retention.
We keep personal information only as long as reasonably necessary for the purposes in this Policy, including the type and sensitivity of the data, account status, legal and tax duties, safeguarding, disputes, and limitation periods. Closing an account or removing Content from display does not erase a record we still need for a lawful purpose. When the period ends, we delete or de-identify the information, subject to backups, which cycle out on their ordinary schedule, and to a legal hold. A legal hold or other exception is limited to the information needed for the applicable purpose and is reviewed when that purpose ends. We maintain a written retention schedule identifying the purpose, business need, deletion trigger, and applicable timeframe for each category. Children’s personal information is not retained indefinitely.
Life of the account, then up to 3 years for claims, tax, and audit only to the extent the particular information is needed for those purposes
Terms and consent acceptance records
Life of the account plus 6 years, or longer if a dispute is open and the records are relevant to it; child-related records follow the specific rule below
User-to-User message content
[90 days] in the ordinary course, then deletion, unless a safety review, open dispute, legal hold, or lawful request requires longer. Users should keep their own copies where permitted by the Terms and applicable law
Gig verification GPS, timestamps, and media
Life of the Gig, the dispute window, and then [24 months] for audit and trust, unless a hold applies. Raw precise-location data and media are deleted earlier where a minimized verification result is sufficient
Reports, Notebooks, and paid-access logs
While published or licensed to the commissioning User; copies removed from display are kept for the audit and license period in the Terms, then deleted or de-identified. License rights do not override an applicable deletion obligation. Content and access logs are assessed separately where their purposes differ
Attribution and chain-of-custody metadata is limited to what is needed to preserve valid scout credit and is reviewed when the associated report, license, or dispute no longer requires retention. Associated Player and minor information is minimized and is deleted or de-identified on a valid request unless a legal exception applies. Remaining metadata is deleted or de-identified when it is no longer necessary for its stated purpose
Payment, commission, and tax records
7 years, or longer if tax law requires for the records necessary to satisfy the applicable obligation
Parental-consent artifacts and parent-rights requests
Life of the child’s participation plus 3 years, and in any event no longer than needed to demonstrate compliance. This applies to a minimized consent or request record, not raw IDs, face images, or biometric artifacts
Moderation, safety, and appeal records
3 years after the matter closes, or longer if needed to enforce a repeat-offender rule or respond to a claim. Extended retention is limited to a necessary, minimized record and is periodically reviewed
Government identification and verification images
Only for the period necessary to complete the applicable verification and address a documented verification issue, subject to law. Government IDs and images used in the parental-verification methods that require prompt deletion are promptly deleted after verification. We retain a minimized verification result rather than the raw artifact where sufficient
Biometric identifiers and templates, if used
Only for the specific verification purpose and applicable legally permitted retention period; deleted when no longer necessary. The verification notice specifies the applicable deletion timeframe and vendor practices before collection
24 months, unless needed for an incident or applicable legal hold; retained incident records are limited to what is necessary
Marketing suppression records
Kept after an opt-out so the opt-out is honored and limited to the information necessary for that purpose
Deleted through the applicable backup rotation. Pending deletion, backup information is protected from routine use; if restored, applicable deletion and suppression instructions are reapplied
We do not keep User-to-User message content as a standing archive, and we do not routinely review the substance of private messages. Authorized personnel may access messages for safety, security, compliance, an open dispute, a legal hold, or a lawful request. A Certificate of Discovery may preserve credit as the Terms describe. That license is not a reason to retain a minor’s profile, media, or contact details indefinitely. Deletion and retention controls extend to providers processing information on our behalf, subject to their applicable legal obligations.
11. Security.
We maintain administrative, technical, and organizational safeguards appropriate to the information and the risk, including access controls, encryption in transit, least-privilege access to verification media and children’s information, and vendor review. If we collect personal information from a child, we maintain a written information-security program appropriate to that information. No online service can guarantee absolute security. If we confirm a breach of security that applicable law requires us to notify, we will notify the affected people and regulators within the required time. If you believe an account, or information about a child, has been compromised, contact us promptly through the privacy channel.
12. Your Choices and Requests.
You may update certain account details in settings. The Terms and account settings describe subscription cancellation. You may unsubscribe from marketing using the link in the message. Subject to the law that applies to you, you may ask us to:
- confirm whether we process your personal information, and access or receive a copy of it, including in a portable format where the law provides that right;
- correct inaccurate information;
- delete information we hold about you;
- restrict or limit certain processing, including use and disclosure of sensitive personal information;
- opt out of sale, sharing for cross-context behavioral advertising, and targeted advertising. Section 4.4 describes our practices. We honor applicable opt-out rights and legally required preference signals;
- opt out of profiling in furtherance of a decision that produces a legal or similarly significant effect. Whether that right applies depends on the actual processing and its effect, not the feature’s label; and
- withdraw consent where processing rests on consent, without affecting earlier lawful processing.
A person who does not have an account, including a Player named in a Report, may make the same requests. Identify the material and your connection to it. A Parent should identify the child and be prepared to show authority. We may verify identity and authority before acting, and we may ask an authorized agent for proof of permission. Verification is proportionate to the request and required only where appropriate under applicable law. We do not require an account to exercise privacy rights. Information collected to verify a request is used only for verification and retained only as necessary for that purpose or a required compliance record. We do not impose identity-verification requirements on opt-out requests where the law prohibits them. We will not discriminate against you for exercising a right. We may deny or limit a request where the law allows, including to protect another person’s rights, complete a transaction you requested, or keep a record the law requires us to keep. We will explain the reason and the appeal path. We provide responses without charge except where applicable law permits a fee and we explain its basis.
If we process the information solely on a business customer’s instructions, we may direct the request to that customer and assist as the agreement and the law require. A content complaint and a privacy request are different processes. Content reports go through the reporting channel in the Terms. Privacy requests go to the contact in Section 15. If a submission raises both issues, we route it appropriately rather than requiring the person to abandon one process or repeat information unnecessarily.
13. United States State Privacy Notice
13.1 Laws covered.This section supplements the rest of this Policy for residents of states with a comprehensive consumer privacy law. The rights and obligations that apply depend on your state, the information and processing involved, and the applicable law’s scope. Section 8 describes our safeguards for children and young Players.
Some of these laws apply only above a revenue, volume, or small-business threshold. Where a law does not apply to us, we will still consider a request in good faith. We do not waive an available exemption. Information already regulated by HIPAA, GLBA, or the Fair Credit Reporting Act, and publicly available information as the applicable statute defines it, may be outside these rights. An exemption is applied only to the extent the relevant law provides it; publication in a scouting report does not, by itself, make all underlying information exempt.
13.2 Rights.Residents may, subject to exceptions and verification, confirm whether we process personal information and access it; correct inaccurate personal information (Iowa’s statute does not require a correction right; we will still correct information that is inaccurate and that we are in a position to correct); delete personal information provided by, or obtained about, the resident; obtain a portable copy where the state law provides portability; and appeal a refusal. A Parent or guardian may exercise rights for a known child. An authorized agent may submit a request where the state allows it. Where permitted and appropriate for the request, we may require proof of the agent’s authority and verification of the resident’s identity. We will not discriminate for the exercise of a right, subject to differences expressly permitted by applicable law and any required notice.
13.3 Sale, sharing, targeted advertising, and profiling.Residents may opt out of the sale of personal information, sharing for cross-context behavioral advertising, and targeted advertising. Section 4.4 describes the practices to which those rights relate. We also do not sell precise geolocation. Residents may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. Minnesota residents may also question the result of profiling to which the Minnesota statute applies, know what data was used, and, where feasible, correct the underlying data and have the result re-evaluated. Section 9 describes reputation features. Applicable profiling rights depend on the actual uses and effects of a feature, including its role in access to opportunities or services.
13.4 Sensitive data, minors, and minimization.California residents may limit the use and disclosure of sensitive personal information where the applicable statutory right applies. Where another state’s law requires consent before we process sensitive data, we obtain it, or we do not process that data. We do not use sensitive personal information to infer characteristics, and we do not sell it. Precise geolocation is collected only from a Scout who uses Gig verification, for verification, dispute, and audit purposes, and it is not sold. We limit collection and retention to what is reasonably necessary and proportionate for the applicable purpose, subject to any stricter standard required by law. We apply data minimization to children’s information everywhere. We do not sell or share the personal information of a consumer we know to be under 16, and we do not use the personal information of anyone we know to be under 18 for targeted advertising or for sale.
13.5 How to submit, and how long we take.Submit a request through the privacy contact in Section 15, or through [the in-product privacy request form, if available]. The request channels are available to non-account Players and other people whose information we process, as well as account holders. We will acknowledge the request and respond within 45 days, or sooner where required by applicable law. Certain requests, including opt-outs, may be subject to shorter deadlines. We may extend once, by up to 45 days, if reasonably necessary, only where applicable law permits, and we will tell you why within the initial response period. If we deny a request, you may appeal by replying to the decision or contacting the privacy contact with a clear request for reconsideration. You need not use a particular word or create an account. Please submit the appeal within 45 days of the denial; this does not shorten any longer period available under applicable law. We will decide the appeal within 45 days, unless applicable law permits an extension and we notify you within the required period. For Virginia requests, we decide an appeal no later than 60 days after receipt, without an additional extension. We will explain our decision and provide the applicable regulator’s complaint mechanism if the appeal is denied. We honor a universal opt-out mechanism, including a global privacy control or other opt-out preference signal that is legally required in your state, as a request to opt out of sale, sharing, and targeted advertising. Where we do not engage in the processing covered by the signal, there is no covered processing to stop. If we introduce covered processing, we implement the required signal handling and other choices before it begins.
13.6 California.Our preceding-12-month disclosures cover only the categories actually collected and disclosed during that period. Planned features described elsewhere in this Policy are not historical collection or disclosure. The applicable categories, sources, purposes, and recipients are identified in Sections 2 through 5 as confirmed for that period. We have not sold personal information, and we have not shared it for cross-context behavioral advertising, in the preceding 12 months. We do not have actual knowledge of selling or sharing the personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes other than those permitted by California Civil Code section 1798.121. California’s Shine the Light law permits a California resident to ask, once a year, for a list of the categories of personal information we shared with third parties for those parties’ direct marketing, if any. We do not share personal information with third parties for their own direct marketing. Send a request to the privacy contact with the subject line “Shine the Light.” We will publish the metrics the CCPA regulations require if we meet the applicable consumer threshold. Any program that constitutes a financial incentive under applicable California law is accompanied by the required notice and choice before participation, whether or not it involves a sale of personal information.
13.7 Nevada and consumer health information.Nevada residents may opt out of the sale of covered information for monetary consideration under Nevada law. We do not sell covered information. We do not intentionally collect consumer health data as Washington’s My Health My Data Act defines it. Injury, medical, or similar observations do not belong in a Report. If we receive that information, we restrict it, do not sell it, do not use it for advertising, and will delete it on request unless an applicable legal exception permits retention. We also address removal when prohibited information is identified without waiting for a request. A prohibition on submission does not eliminate legal obligations arising from information actually received, retained, or inferred. If a feature will process consumer health information, we assess and implement any required notice, consent, and other safeguards before that processing begins.
14. International Processing.
ScoutForge is a Delaware corporation. We process personal information in the United States. If you access the Platform from outside the United States, your information will be processed in the United States as described in this Policy, subject to applicable law. The Terms or your use of the Platform do not waive mandatory privacy protections.
Where a non-U.S. law applies to processing for which we are a controller and requires a specific right including access, correction, deletion, restriction, portability, objection, or withdrawal of consent, you may exercise that right through the privacy contact in Section 15. Where that law requires a transfer safeguard for information moving to the United States, we implement the required safeguard before the transfer and provide information about the applicable mechanism through the privacy contact. A Club, Agent, or Scout that uploads another person’s information remains responsible for its own lawful basis and notices. We will identify an EU or UK representative, or a data-protection officer, in this Policy before processing for which such an appointment is required begins.
15. Changes and Contact.
15.1 Changes.We will update the date above when we change this Policy, and we will give additional notice, or ask for consent, when the law or the Terms require it. A new player-facing feature, a new category of recipient, or a sale, share, or targeted-advertising program will be reflected in this Policy before that activity begins. Prior versions are retained. We review this Policy at least annually and when features, providers, data practices, audiences, supported jurisdictions, or the scope of processing materially change. Material changes do not retroactively authorize uses inconsistent with required consent or applicable law.
15.2 Privacy contact.Privacy requests and questions: [support@scoutforge.com]. Postal requests: Scoutforge, Inc., Attn: Privacy, [street address, city, state, ZIP]. For an urgent safety or content report, use the Platform reporting channel at [report@scoutforge.com], which is separate from a privacy request. Parents may use the privacy contact to ask about children’s information, review, or delete that information, withdraw consent, or refuse further collection or use. The applicable children’s notice identifies any other operators collecting or maintaining children’s information as required by law.
15.3 Registered agent.The Terms identify the channels for legal process and copyright notices. Those channels are separate from the privacy-request contact above.