Privacy policy.

EliteSportIQ Inc. ("EliteSportIQ," "we," "us," or "our")

EliteSportIQ is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use our website, mobile application, and 1-on-1 hockey coaching platform (collectively, the "Services"). We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's Anti-Spam Legislation (CASL), and applicable provincial privacy legislation.

1. Information We Collect

1.1 Information You Provide Directly

• Account Information: Full name, email address, password (hashed and salted using bcrypt), date of birth, phone number
• Player Profile: Position, team name, league, skill level, city/province, coaching goals, and preferences
• Payment Information: Processed exclusively through Stripe Inc. We never store, access, or process your full credit card number, CVV, or banking details on our servers. We retain only a tokenized reference, last four digits, card brand, and expiration date for display and dispute resolution purposes
• Session Content: Video uploads, session recordings, coach notes, feedback, and ratings you provide
• Communications: Messages you send through our platform, support requests, and survey responses

1.2 Information Collected Automatically

• Device & Browser Data: IP address, device type, operating system, browser type and version, screen resolution, and language preferences
• Usage Data: Pages visited, features used, session duration, click patterns, booking history, and referral activity
• Cookies & Similar Technologies: Session cookies, persistent cookies, and local storage for authentication, preferences, and analytics (see Section 10)

1.3 Information From Third Parties

• Google OAuth: If you sign in with Google, we receive your name, email, and profile picture as authorized by you
• Payment Processor: Stripe provides us transaction confirmations, dispute notifications, and fraud detection signals
• Referral Program: When referred by another user, we receive the referral code used at signup

2. How We Use Your Information

We use your information for the following purposes:

• Service Delivery: Providing, maintaining, and improving the EliteSportIQ coaching platform, matching you with coaches, facilitating bookings and session delivery
• Account Management: Creating and managing your account, authenticating identity, processing plan changes
• Payment Processing: Processing subscription payments, issuing refunds, managing billing disputes, and maintaining transaction records for a minimum of seven (7) years as required for chargeback defense and tax compliance
• Communication: Sending transactional emails (booking confirmations, session reminders, payment receipts), and with your consent, promotional communications about new features and offers
• Safety & Fraud Prevention: Detecting, investigating, and preventing fraudulent transactions, unauthorized access, and platform abuse
• Analytics & Improvement: Understanding usage patterns, improving features, and developing new services
• Legal Compliance: Fulfilling legal obligations, responding to lawful requests from authorities, and establishing, exercising, or defending legal claims

3. Legal Bases for Processing (PIPEDA & GDPR)

Under PIPEDA, we process personal information based on meaningful consent, which you provide when you create an account, subscribe to a plan, or use our Services. Specific legal bases include:

• Consent: You provide express consent at account creation by agreeing to these policies. You may withdraw consent at any time, subject to legal or contractual restrictions, by contacting us or deleting your account
• Contractual Necessity: Processing required to fulfill our subscription agreement with you (payment processing, session delivery, account management)
• Legitimate Interest: Fraud prevention, platform security, service improvement, and analytics, balanced against your privacy rights
• Legal Obligation: Tax record retention, responding to court orders, and regulatory compliance

4. Data Sharing & Third-Party Services

We do not sell, rent, or trade your personal information. We share data only with:

• Stripe Inc.: Payment processing, subscription management, fraud detection (PCI DSS Level 1 certified)
• Google LLC: OAuth authentication (if you choose Google sign-in), Google Analytics for anonymized usage statistics
• Amazon Web Services (AWS): Cloud infrastructure and data hosting (data stored in Canada, ca-central-1 region)
• SendGrid (Twilio Inc.): Transactional and marketing emails
• Coaches: Your assigned coach receives your name, profile information, session videos, and scheduling details necessary to deliver coaching services. Coaches are bound by confidentiality agreements
• Legal & Regulatory: When required by law, court order, subpoena, or to protect the rights, safety, or property of EliteSportIQ, our users, or the public
• Business Transfers: In connection with a merger, acquisition, bankruptcy, or sale of assets, your data may be transferred to the successor entity with equivalent privacy protections

All third-party service providers are contractually bound by data processing agreements that require them to protect your information to standards no less than those described in this policy.

5. Data Retention & Deletion

• Active Account Data: Retained for the duration of your account plus 30 days after deletion request
• Session Videos & Recordings: Retained per your plan tier (Basic: 3 months, Prospect: 6 months, Pro: 9 months, Elite: 12 months) after session date, then automatically purged
• Payment & Transaction Records: Retained for seven (7) years from the transaction date for tax compliance (CRA requirements) and chargeback defense (card network rules permit disputes up to 540 days)
• Anonymized Analytics: Retained indefinitely in aggregated, non-identifiable form
• Support Communications: Retained for 3 years after last interaction
• Deleted Accounts: Upon account deletion, personal data is purged within 30 days except for data required by law (payment records, dispute evidence)

6. Data Security

We implement industry-standard security measures including:

• TLS 1.3 encryption for all data in transit
• AES-256 encryption for data at rest
• Bcrypt password hashing with per-user salts
• Role-based access controls and principle of least privilege
• Regular third-party security audits and penetration testing
• SOC 2 Type II compliant infrastructure (AWS)
• Automated intrusion detection and real-time monitoring
• Employee security training and confidentiality agreements

While no system is 100% secure, we take commercially reasonable steps to protect your information. In the event of a data breach affecting your personal information, we will notify you and the Office of the Privacy Commissioner of Canada within 72 hours as required by PIPEDA.

7. Your Rights

Under PIPEDA and applicable law, you have the right to:

• Access: Request a copy of all personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Withdraw Consent: Withdraw consent to specific processing activities at any time
• Data Portability: Receive your data in a structured, commonly used, machine-readable format
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada

To exercise any of these rights, email privacy@elitesportiq.com. We will respond within 30 days as required by PIPEDA.

8. Children's Privacy

EliteSportIQ provides coaching services to hockey players including minors (under 18). For users under 16, we require verifiable parental or guardian consent before account creation. Parents/guardians may review, modify, or delete their child's information at any time by contacting us. We collect only the minimum information necessary to provide our coaching services to minor users and apply additional safeguards to their data.

9. International Data Transfers

Your data is primarily stored and processed in Canada (AWS ca-central-1, Montreal). Some third-party processors (Stripe, Google, SendGrid) may process data in the United States. Where data is transferred outside Canada, we ensure adequate protection through contractual safeguards, including Standard Contractual Clauses and compliance with PIPEDA's accountability principle for cross-border transfers.

10. Cookies & Tracking Technologies

• Essential Cookies: Required for authentication, session management, and security. Cannot be disabled
• Functional Cookies: Remember your preferences (mode selection, language). Can be managed in browser settings
• Analytics Cookies: Google Analytics with IP anonymization enabled. You may opt out via browser settings or the Google Analytics Opt-out Browser Add-on

We do not use cookies or tracking technologies for behavioral advertising or sell cookie data to third parties.

11. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email and an in-app notification at least 30 days before taking effect. Continued use of the Services after the effective date constitutes acceptance of the updated policy. Previous versions are available upon request.

12. Contact & Data Protection Officer

For privacy inquiries, data access requests, or complaints:

• Privacy Officer: privacy@elitesportiq.com
• General Support: support@elitesportiq.com
• Mailing Address: EliteSportIQ Inc., Ontario, Canada
• Office of the Privacy Commissioner of Canada: www.priv.gc.ca | 1-800-282-1376