Privacy Policy

1. Who we are

SideKrew (“we”, “our”, “SideKrew”) is an autonomous, agentic operations platform for grassroots team sports. Our service helps volunteer-run youth and amateur clubs manage registrations, schedules, and team travel through AI agents.

We are headquartered in Canada and host all primary data in a Canadian region (ca-central-1). We are committed to handling personal information, especially children's data, with the highest level of care.

This policy applies to all personal information collected or processed by SideKrew, including information about minors. It is designed to meet or exceed the requirements of Quebec Act Respecting the Protection of Personal Information in the Private Sector (Law 25) and PIPEDA (Canada's federal private-sector privacy law). We will comply with stricter obligations (e.g., COPPA for US users) as we expand.

2. Our approach to children's data

Minors are the core data subjects in grassroots sports. We treat this responsibility seriously. Our design principles for children's data:

• Minors do not have accounts. A child registered in our system is a participant record, not a user. Children do not log in and are never directly contacted by our AI agents or by SideKrew.
• All communication routes through guardians. Any message about a child goes only to their linked guardian or parent. This is an architectural constraint; it is not configurable by clubs.
• No advertising, no data sale, no behavioural tracking of minors. We have no advertising system. We do not sell data. We do not build behavioural profiles of children. We do not share children's data with third-party advertising or analytics networks.
• Data minimization. We collect only the information a season requires: name, date of birth, gender (for division placement), and contact information for guardians. Medical and sensitive notes are encrypted at rest and visible only to club administrators.
• No tracking technologies on minors. We do not use cookies, pixels, or similar tracking technologies that operate on or profile minors' activity, in compliance with Law 25's requirement for explicit opt-in consent for tracking.

3. What information we collect and why

4. Legal basis and consent

We process personal information under the following legal bases (consistent with Law 25 and PIPEDA):

• Consent. Guardian consent is recorded when a participant is enrolled. For children under 14 (Quebec) or in jurisdictions with equivalent requirements, explicit parental consent is required before we process personal information.
• Contractual necessity. Processing registration, payment, and scheduling data is necessary to deliver the services a club has contracted for.
• Legitimate interest. Security logging and fraud prevention.

We do not rely on “legitimate interest” to override the rights of children. Any processing of a minor's data that is not strictly necessary for the contracted services requires explicit guardian consent.

5. How we protect your information

• Encryption in transit: All data is transmitted over HTTPS/TLS.
• Encryption at rest for sensitive fields: Medical and health notes are encrypted at the field level using AES-256-GCM before storage.
• Row-level security: Our database enforces strict multi-tenant isolation; a club can never access another club's data.
• Access control: Only club staff with the org_admin role can view medical notes. Guardians can view only the records linked to their children.
• Audit logging: Every sensitive action (including erasure) is permanently audit-logged with the actor, timestamp, and before-snapshot.
• Data residency: Primary databases reside in Canada (ca-central-1).
• Least-privilege AI agents: Our AI agents never exceed what an org_admin could do manually, and all agent actions are logged. Agents never contact minors directly.

6. Sharing and disclosure

We do not sell personal information. We do not share data with advertisers or data brokers. We share information only as follows:

• Within the club: Club staff (admins, coaches, team managers) can see participant and registration data for their organization only.
• Payment processor: Stripe receives payment information to process registration fees. Stripe is PCI-compliant. Card numbers never touch SideKrew servers.
• Email / SMS providers: Resend and Twilio transmit messages to guardians. They receive only the recipient address/number and message content needed for delivery.
• Legal obligation: We may disclose information if required by law, court order, or to protect the safety of children or the public.
• Service providers: Cloud infrastructure (Vercel, Supabase) processes data on our behalf under data-processing agreements. Data remains in Canada for primary storage.

7. Advertising cookies on our public marketing site (opt-in only)

Our public marketing site (the marketing pages such as the homepage, comparison pages, and guides) may use advertising cookies and pixels from Google and Meta (Facebook/Instagram), but only after you explicitly opt in. When these identifiers are configured, a banner asks for your consent before any pixel loads — consistent with Law 25's requirement for prior, explicit consent to tracking technologies.

• Purpose: advertising measurement to reach new clubs. These pixels help us understand which ad campaigns bring clubs to discover and try SideKrew. That is their only use.
• Never in the signed-in app, never on minor-associated accounts. No advertising pixels or client-side tracking run inside the authenticated app, or on any account associated with minors. Tracking is limited to the public marketing site and only with your consent — consistent with our commitment that no client-side analytics tracking is operated on accounts associated with minors.
• No data sale, no child profiling. We do not sell any personal information and do not build behavioural profiles of children. Children are participant records, never users, and are never tracked.
• Nothing loads by default. If you decline or make no choice, no advertising pixel is loaded. While SideKrew has no advertising identifiers configured, the banner does not appear and no pixel exists at all.
• How to withdraw consent. You can withdraw consent at any time by clearing this site's cookies and site data in your browser (which brings the banner back so you can choose “Decline”), or by emailing us at privacy@sidekrew.com. Withdrawal does not affect your use of SideKrew.

8. Your rights: access, correction, and erasure

Under Law 25 and PIPEDA, individuals (and guardians acting on behalf of minors) have the right to:

• Access. Request a copy of personal information we hold about you or your child.
• Correction. Request correction of inaccurate or incomplete information.
• Erasure (deletion). Request permanent deletion of a participant record and all associated data. This is a true hard delete (not an archive). All registrations, compliance records, invoices, and guardianship links are permanently removed. The action is audit-logged for accountability.
• Withdrawal of consent. Withdraw consent for processing not required for the contracted services. Withdrawal may affect the ability to participate in programs that require the relevant data.
• Complaint. Lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) or the Commission d'accès à l'information (CAI) if you believe your rights have not been respected.

How to exercise these rights: Guardians may initiate erasure directly from their child's profile in the platform. For access, correction, or other requests, contact our privacy officer at privacy@sidekrew.com.

We will respond to access and correction requests within 30 days. Complex requests may require up to 90 days; we will notify you if an extension is needed.

9. Data retention

We retain personal information for as long as it is necessary to deliver the contracted services, comply with legal obligations, or resolve disputes. Typical retention:

• Participant records: Retained for the duration of active participation in the club. On erasure request, immediately and permanently deleted.
• Registration and payment records: Retained for 7 years for financial and tax compliance, unless a guardian exercises erasure rights and the legal basis for retention no longer applies.
• Audit logs: Retained for 3 years for security and accountability.

10. Data residency

Primary data is stored in Canadian data centres (ca-central-1 region). We will make data residency a configurable deployment parameter when we expand to other geographies. Any cross-border data transfer will be governed by appropriate safeguards.

11. Privacy officer

SideKrew has a designated privacy officer responsible for compliance with Law 25, PIPEDA, and this policy.

You may also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or the Commission d'accès à l'information du Québec at cai.gouv.qc.ca.

12. Changes to this policy

We will update this policy as our practices evolve or legislation changes. Material changes will be communicated to active clubs at least 30 days before they take effect. Continued use of the platform after that date constitutes acceptance of the updated policy.

All previous versions of this policy are available on request from our privacy officer.