Privacy Policy

1. Who is responsible for your data

The data controller is [SCOUTIQ LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS — CÔTE D'IVOIRE]. For any question about this policy or to exercise your rights, contact us at [PRIVACY CONTACT EMAIL].

2. What personal data we collect

We collect the following categories of personal data, depending on how you use ScoutIq:

• Account data — name, username, email address, phone number (optional), password (stored as a salted hash, never in plain text), profile picture, country/city, preferred language.
• Authentication data — OAuth identifiers when you sign in with Google; device sessions (IP address, browser/device type, approximate location) for security and "active sessions" management.
• Payment data — for card payments, Stripe processes and stores your card details directly; we only receive a payment token, transaction status, and billing history. For mobile money payments (Wave, Orange Money, MTN, Moov Africa), CinetPay processes the transaction; we receive a transaction identifier, amount, and status — never your mobile money PIN or full account details.
• Platform activity data — saved searches, player/team comparisons, match predictions, AI Scout conversation history, tagging activity (for taggers), club manager squad/roster data (for club managers).
• Communications — messages you send to support, and transactional emails we send you (verification codes, payment receipts, security alerts).
• Device/push data — a device token if you enable push notifications, used solely to deliver notifications you've opted into.
• Technical/log data — IP address, user agent, request timestamps, and error logs, collected automatically for security, fraud prevention, and service reliability.

3. Why we process your data, and on what legal basis

Under GDPR Art. 6 and the equivalent Loi n°2013-450 principles, every use of your data rests on one of these bases:

• Performance of a contract — creating and operating your account, processing subscription payments, delivering the features you've signed up for (Art. 6(1)(b)).
• Consent — accepting the Terms of Service and this Privacy Policy at signup (recorded with a timestamp, IP address, and document version for proof of consent); optional marketing communications, if any, are separately opt-in (Art. 6(1)(a)).
• Legitimate interest — fraud prevention, rate-limiting abuse, service security, product analytics to improve ScoutIq, and defending our legal rights (Art. 6(1)(f)), balanced against your rights and never overriding them.
• Legal obligation — retaining payment/invoicing records for tax and accounting law, responding to lawful requests from competent authorities (Art. 6(1)(c)).

4. AI features and automated processing

ScoutIq's AI Scout and machine-learning features (market-value estimates, progression/potential scoring, transfer-likelihood predictions) analyze publicly available football statistics and platform-tagged match data to generate insights for the user querying them. These outputs are decision-support information for scouting purposes, not a solely-automated decision producing legal or similarly significant effects on any individual within the meaning of GDPR Art. 22 — no account status, price, or access decision is made by an algorithm without human involvement. AI Scout conversation content you submit is processed by our AI provider strictly to generate a response and is not used to train third-party foundation models beyond what that provider's own data-processing terms permit.

5. Who we share data with

We share personal data only with service providers who process it on our behalf under contract, and only to the extent needed to provide the service:

• Stripe (card payments) — payment processing, billing, fraud prevention.
• CinetPay (mobile money payments — Wave, Orange Money, MTN, Moov Africa) — payment processing for Côte d'Ivoire and West Africa.
• Google (Gemini API) — processes AI Scout conversation content to generate responses; Google Sign-In for OAuth authentication.
• Firebase (Google) — delivers push notifications to devices that have opted in.
• DigitalOcean Spaces — stores uploaded media (profile pictures, match video, club logos).
• Email delivery providers (transactional email) — sends verification, password-reset, receipt, and security-alert emails.
• Sentry — error monitoring; may capture technical request context to help us fix bugs.

We do not sell personal data. We do not share data with third parties for their own independent marketing purposes. Where a processor is located outside your country (e.g. a data subject in the EEA whose data is processed by a provider outside the EEA, or a Côte d'Ivoire-based user whose data is processed by an EU/US-based provider), we rely on that provider's standard contractual safeguards (such as the EU Standard Contractual Clauses) or an applicable adequacy framework to protect the transfer.

6. How long we keep your data

We keep account and platform-activity data for as long as your account is active, plus a limited period after closure to handle disputes and legal obligations. Payment and invoicing records are retained for the period required by applicable tax and accounting law, even after you close your account or request erasure, under the legal-obligation exception described in Section 8. Security/session logs are retained on a rolling basis and periodically purged. Tagging data you contribute becomes part of the shared analytics dataset described in the Terms of Service and is retained as football statistical record; your personal attribution to it is removed on request as described below.

7. Your rights

Subject to the conditions and exceptions in applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you. Use the "Download my data" tool in Settings → Security for instant self-service export.
• Rectification — correct inaccurate or incomplete data via your profile settings.
• Erasure — request deletion of your account and personal data via Settings → Security → Delete Account, or by contacting us. Financial records we're legally required to retain are anonymized from your account but kept in their own right.
• Restriction and objection — ask us to limit or stop certain processing based on legitimate interest.
• Portability — receive your data in a structured, machine-readable format (the data-export tool produces JSON).
• Withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint — with your local data protection supervisory authority. In the EEA, this is your national Data Protection Authority. In Côte d'Ivoire, this is ARTCI (Autorité de Régulation des Télécommunications/TIC de Côte d'Ivoire).

8. Children's privacy

ScoutIq is not directed at children under 16 and we do not knowingly collect personal data from anyone under that age. If you believe a child has provided us personal data, contact us and we will delete it.

9. Security

We use industry-standard safeguards: encrypted connections (TLS), hashed passwords, encrypted sensitive fields at rest, role-based access control, rate limiting, and audit logging of security-relevant actions. No system is perfectly secure, and we will notify affected users and relevant authorities of any data breach as required by applicable law.

10. Cookies

ScoutIq uses cookies for authentication and, where you consent, for functional preferences. See our Cookie Policy for the full list and how to manage your preferences.

11. Changes to this policy

We may update this Privacy Policy as our service or legal obligations evolve. Material changes will be reflected in the "last updated" date above, and where required by law, we will ask existing users to re-confirm their acceptance of a materially changed policy.

12. Contact

Questions, requests, or complaints about this policy: [PRIVACY CONTACT EMAIL].