ClipboardIQ — Privacy Policy


1. Data Controller

Sport Link LLC Sofia, Bulgaria Email: sportlink@spotsscoreboard.com

Sport Link LLC ("Company," "we," "us") is the data controller for personal data processed through the ClipboardIQ application ("App").

2. What Data We Collect

2.1 Account Data

  • Email address (or SSO credentials via Google, Microsoft, or Apple Sign-In)
  • IP address (collected automatically)
  • Device information (platform, app version)

2.2 Coach-Generated Content

  • Practice plans, custom drills, and rulesets created by the coach
  • Game history (scores, results, opponent names)
  • AI conversation logs (messages exchanged with the AI Practice Planner)
  • Drill feedback and ratings
  • Coach preferences (coaching style, favorites)

2.3 Squad and Player Data

Coaches may enter information about their squad members, including:

  • Player first names or nicknames
  • Free-text coaching notes (observations about skills, strengths, areas to improve, and other coaching context)

Important: Squad member data consists of unverified notes entered by the coach. These are the coach's subjective professional observations, not verified identities. Players do not have accounts in the App, do not log in, and do not provide any information directly. This data cannot reliably identify specific individuals and is treated as the coach's professional content.

2.4 Payment Data

Payment processing is handled by third-party processors (Paddle, Apple App Store, Google Play Store). We do not directly collect or store credit card numbers or banking details. We receive subscription status, transaction identifiers, and billing country from payment processors.

2.5 Diagnostic Data

  • Error logs (error messages and stack traces) are stored for debugging and service reliability purposes. These logs do not contain user-provided content such as names, emails, or coaching notes.
  • Error notifications may be sent to the development team via email for critical issues.

2.6 Data We Do NOT Collect

  • We do not use third-party analytics, crash reporting, or behavioral tracking services (such as Google Analytics, Segment, or Mixpanel)
  • We do not collect precise geolocation
  • We do not collect biometric data
  • We do not collect data directly from children (see Section 8)

3. How We Use Your Data

3.1 Service Delivery

  • To provide the App's core functionality (scorekeeping, practice planning, game management)
  • To personalize AI practice plan recommendations based on your squad context, schedule, drill history, and feedback
  • To maintain your game and practice history
  • To process your subscription and payments

3.2 AI Processing

When you use AI features (Practice Planner, automated feedback questions), contextual data from your account is sent to third-party AI service providers for processing. This includes:

  • Your conversation messages (what you type or speak to the AI)
  • Squad member first names and coaching notes (to personalize recommendations)
  • Recent practice and drill history (to avoid repetition and build on what worked)
  • Game schedule and opponent history (to tailor practice for upcoming games)
  • Season phase and age group context (for periodization and age-appropriate planning)

Only data relevant to the current request is sent. We apply data minimization — the AI receives the minimum context needed to generate useful recommendations.

3.3 Service Improvement

We may use anonymized, aggregated data derived from usage patterns to improve the App. This data is stripped of all personally identifying information before use. See Section 10 for details.

4. Third-Party Data Processors

We share personal data only with the following categories of service providers, who process data on our behalf under appropriate contractual safeguards:

4.1 AI Service Providers

The App uses third-party AI models to power its AI Practice Planner and related features. Current providers include:

  • Mistral AI, SAS (Paris, France) — Processes AI conversation data within the EU. Per Mistral's API terms, input/output data from API calls is not used to train their models. API data is retained for up to 30 days for abuse monitoring, then deleted.
  • BgGPT by INSAIT (Sofia University, Sofia, Bulgaria) — Processes Bulgarian-language chat conversations. Used for natural language understanding in Bulgarian.

We may use additional or alternative AI providers for specific features (e.g., language-specific models). Any such provider will process data under terms consistent with this Privacy Policy. We will update this section when providers change.

4.2 Payment Processors

  • Paddle (for web subscriptions) — Paddle acts as the Merchant of Record for web purchases, meaning Paddle is the legal seller and an independent data controller for payment-related data under its own privacy policy
  • Apple (for iOS App Store purchases)
  • Google (for Google Play purchases)

4.3 Infrastructure

  • Cloud hosting and database services for data storage and synchronization
  • Email delivery service for transactional emails (password recovery, subscription notifications)

4.4 Authentication Providers

When you sign in using a third-party provider, we receive limited profile information from that provider:

We only receive the information necessary to create or link your account. We do not access your contacts, calendar, or other data from these providers.

4.5 No Other Sharing

We do not sell, rent, or trade your personal data to any third party. We do not use advertising networks or analytics services. We may disclose data if required by law, court order, or to protect the rights, property, or safety of Sport Link LLC or others.

5. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process personal data under the following legal bases:

Processing Activity Legal Basis
Account creation and service delivery Contract performance (Art. 6(1)(b))
AI practice plan generation Contract performance (Art. 6(1)(b)) — AI features are part of the service
Payment processing Contract performance (Art. 6(1)(b))
Service improvement via aggregated data Legitimate interest (Art. 6(1)(f))
Venue attendance estimation (hashed device identifiers) Legitimate interest (Art. 6(1)(f))
Legal compliance Legal obligation (Art. 6(1)(c))

6. Data Retention

Data Category Retention Period
Account data Retained while your account is active
Coach-generated content (plans, drills, history) Retained while your account is active
AI conversation logs Retained while your account is active
Squad and player data Retained while your account is active
Venue/spectator data (hashed device identifiers) Retained while associated game data is active
Diagnostic data (error logs) Retained for up to 90 days
Payment/subscription records Retained per legal requirements (up to 10 years for tax/accounting)

Upon account deletion request: Your account is deactivated and your email address and personal data is anonymized so it can no longer be used to identify you. If you require immediate and complete erasure of all your data, contact us at sportlink@spotsscoreboard.com and we will process your request manually within 30 days.

AI provider data: Data sent to AI providers is subject to their retention policies. Mistral AI retains API data for up to 30 days, then deletes it. Following an account deletion request, no new data will be sent for that account.

Backups: Anonymization is propagated through regular backup rotation cycles.

7. Data Security

We implement appropriate technical and organizational measures to protect personal data, including:

  • Encrypted data storage (database encryption at rest)
  • TLS/HTTPS for all data in transit between client apps, servers, and third-party services
  • Password-protected and access-controlled server infrastructure
  • Data synchronization between client and server via encrypted channels (Redis/BullMQ over secure connections)
  • Access limited to authorized personnel only

Authentication and Sessions: The App uses JSON Web Tokens (JWT) stored on your device for authentication. These tokens contain only a non-identifying session identifier and an expiration timestamp — no personal data is embedded in the token. Session data is stored server-side. We do not use tracking cookies or any form of cross-site tracking.

8. Children's Privacy

The App is intended for use by adult coaches aged 18 and older. We do not knowingly collect personal information directly from children under 13 (under 14 in Bulgaria per the Bulgarian Personal Data Protection Act, or under 16 in other EEA member states where applicable).

Squad member names and coaching notes entered by coaches are the coach's own professional notes. They are not accounts, profiles, or verified identities of minors. No child interacts with the App directly, and no child provides any information to the App.

If a parent or guardian believes that information about their child has been entered into the App and would like it reviewed or removed, please contact us at sportlink@spotsscoreboard.com . We will promptly address such requests.

9. Your Rights

9.1 Rights Under GDPR (EEA Users)

You have the right to:

  • Access your personal data (Art. 15)
  • Rectify inaccurate data (Art. 16)
  • Erase your data ("right to be forgotten") (Art. 17) — see Section 6 for details on how deletion is implemented
  • Restrict processing (Art. 18)
  • Data portability — receive your data in a structured, machine-readable format (Art. 20)
  • Object to processing based on legitimate interest (Art. 21)
  • Lodge a complaint with your supervisory authority (in Bulgaria: Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria; https://cpdp.bg )

To exercise these rights, contact us at sportlink@spotsscoreboard.com .

9.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Categories of personal information we collect:

  • Identifiers (email address, IP address, device identifiers)
  • Internet or electronic network activity (app usage, AI conversation logs)
  • Professional information (coaching notes, drill ratings)

We do not sell or share your personal information as defined by the CCPA/CPRA. We do not engage in cross-context behavioral advertising.

Your rights:

  • Right to know what personal information we collect, use, and disclose
  • Right to delete your personal information
  • Right to correct inaccurate personal information
  • Right to opt-out of the sale or sharing of personal information (we do not sell or share, but you may contact us to confirm)
  • Right to non-discrimination for exercising your privacy rights

Service providers vs. third parties: AI providers (Mistral AI and others) are classified as "service providers" under CCPA — they process data only on our behalf, under contract, and are restricted from using it for their own purposes.

To exercise these rights, contact us at sportlink@spotsscoreboard.com . We will respond within 45 days.

10. Future Use of Aggregated Data

We may in the future use anonymized, aggregated data derived from usage patterns to provide community-level features and insights (such as aggregated drill effectiveness trends or popularity statistics across similar teams). Such data will be:

  • Stripped of all personally identifying information before use
  • Aggregated across a sufficient number of users to prevent re-identification
  • Never used to identify any individual coach, player, or team

We will update this Privacy Policy before launching any such features. If an opt-out mechanism is applicable, we will provide one.

11. International Data Transfers

Your data is primarily processed in the European Union. AI service providers (currently Mistral AI) also process data within the EU. If we engage service providers outside the EEA in the future, we will ensure appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions) per GDPR Chapter V.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the App or by email. The "Effective Date" at the top reflects the most recent revision. Your continued use of the App after changes are posted constitutes acceptance of the revised policy.

13. Contact

Sport Link LLC Sofia, Bulgaria Email: sportlink@spotsscoreboard.com

For data protection inquiries or to exercise your rights, email us at the address above. For complaints, you may also contact the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria; website: https://cpdp.bg ; email: kzld@cpdp.bg .


Revision #4/ Sat, 04 Apr 2026 12:16:23 UTC