Draft for legal review. Text in [square brackets] must be completed before launch.
Privacy Policy
Last updated: [date of publication]
Who we are
My Academy is software that sports academies use to manage their athletes, sessions, staff and money. It is provided by [company legal name], [registered address], Egypt ("we"). Contact us about privacy at [privacy email].
Two roles: the academy and us
Each academy decides what it records about its athletes, guardians and staff, and why. For that information the academy is responsible (the controller), and we process it on the academy's behalf and only to run the service. If you are a parent, guardian or athlete and want to see, correct or delete information an academy holds about you, contact the academy first; we will help it answer you.
For the account details of the people who sign in (owners, admins, coaches and staff), we are responsible.
What we collect
Your account. Name, email address, phone number if you give it, and your password, which Supabase Auth stores only as a secure hash. If you sign in with Google, we receive your name and email address from Google.
What an academy records. Depending on the academy and its bundle, this can include:
- athletes: name, date of birth, gender, nationality, national ID, school, address, photo, group, attendance, technical tests and fees;
- guardians: name, relationship, phone, email and a photo of their ID;
- health: medical records and injuries;
- staff: contact details, responsibilities, working hours, pay and reviews;
- money: income, expenses, invoices, bills and payroll;
- documents the academy uploads, such as contracts and consent forms.
Payments for a plan. Card payments are handled by Paymob. We never see or store card numbers; we keep the amount, plan, date and Paymob's transaction reference.
Technical records. Our providers keep standard server logs (such as IP address, time and the address requested) to run and secure the service.
Children's information
Many athletes are under 18. Before an academy records athletes, its owner confirms in the app that every athlete's guardian has agreed to it. Academies must only record what they need to run the academy. Health records and guardian ID photos are visible only to the people the academy allows: medical information to staff with medical access, and ID photos to people who manage athletes.
How we use it
- to provide the service the academy has chosen: storing records, showing them to the right people, and producing reports and PDFs;
- to take payment for a plan and keep the record of it;
- to keep the service secure, prevent abuse and fix problems;
- to contact account holders about their account, their plan or changes to these terms.
We do not sell personal data, show advertising, or use academy records to train AI models.
Where it is stored and who processes it
- Supabase hosts the database, sign-in and file storage, in London, United Kingdom (region eu-west-2).
- Cloudflare serves the website.
- Paymob processes plan payments.
- Google provides optional sign-in, and serves the app's fonts and display engine, which means your browser contacts Google's servers when the app loads.
Each processes data only as needed to provide its part of the service. [Describe the legal basis for transfers outside Egypt, as required by Law No. 151 of 2020.]
How it is protected
Every request is checked by the database itself, so each person sees only their own academy, and within it only what their role and branches allow. Data travels encrypted (HTTPS). Photos, ID photos and documents are kept in private storage and opened through links that expire. Medical, pay and legal records are never saved on your device.
What is stored on your device
The app keeps your sign-in session, your preferences (such as light or dark mode) and copies of recently viewed lists in your browser's local storage, so it opens quickly and works on a weak connection. Signing out removes the saved lists. We use no advertising or tracking cookies, so there is no cookie banner.
How long we keep it
We keep an academy's records while its account is open. An owner can delete their account in the app (Your profile, Delete account); that deletes the academies they own and everything in them straight away. Copies in our providers' backups are removed as those backups expire, within [backup retention period]. Payment records may be kept longer where tax law requires.
Your rights
Under Egypt's Personal Data Protection Law (Law No. 151 of 2020), and the EU or UK GDPR where they apply, you can ask to see, correct, delete or receive a copy of your personal data, object to some uses, and complain to the Personal Data Protection Center in Egypt or your local regulator. Write to [privacy email]; we answer within [number] days.
Changes
If we change this policy in a way that matters, we will tell account holders by email or in the app before the change takes effect.