Legal
Privacy Policy
Aligned with the California Privacy Rights Act (CPRA) · Effective date: August 1, 2026 · Last updated: July 1, 2026
Jump to a section
1Overview
Varsity Engine LLC ("Company," "we," "us") operates the Varsity Engine platform ("Platform"), a digital sports management and recruiting service for the Mid-South Association of Independent Schools (MAIS). This Privacy Policy explains how we collect, use, retain, and disclose personal information from users of the Platform, including student-athletes, parents and legal guardians, coaches, athletic directors, school and association administrators, college recruiting staff, and general visitors.
This policy applies to all users. If you are a California resident, the California Privacy Rights Act (CPRA) gives you specific rights over your personal information, described in the sections below. By accessing or using the Platform, you acknowledge the practices described in this Privacy Policy.
2Notice at collection
At or before the point of collection, we tell you the categories of personal information we collect and the purposes for which they are used. The CPRA statutory categories we may collect are:
Identifiers. Name, email address, phone number, account identifier, and IP address.
Customer records. Role (coach, AD, athlete, parent or guardian, administrator), school affiliation, and login credentials.
Commercial information. Subscription status and records of services provided.
Internet or network activity. Browser and device information, pages visited, time on site, and referring URL, collected through standard analytics.
Approximate geolocation. City, region, or country you enter, and coarse location inferred from IP address. We do not collect precise GPS location.
Audio and visual information. Video, photo, and audio files submitted through the broadcast and highlight-film features.
Professional or athletic and education-related information. Sport, position, graduation year, grade, measurables, statistics, and GPA voluntarily submitted by the athlete, guardian, or authorized school personnel.
Sensitive personal information. Government-issued identification number submitted for identity verification. Separately, and as a matter of Company policy rather than statutory classification, all personal information of a known minor receives heightened internal safeguards. See section 4.
Inferences. Recruiting match signals generated from verified profile data and posted roster needs.
Sources. We collect this information directly from you, from your school or coach during verification, and automatically as you use the Platform. We do not purchase personal information from data brokers.
3How we use information
Platform operation. To provide scores, standings, schedules, recruiting profiles, and media services.
Verification. To authenticate users and verify athlete profiles through coaches and athletic directors.
Recruiting. To surface verified, opted-in athlete profiles to college coaches and facilitate connections through the Connect feature.
Communication. To send account-related notifications, verification updates, and platform announcements.
Improvement and security. To analyze usage, maintain security, prevent fraud, and improve the Platform.
Legal compliance. To comply with applicable law, enforce our Terms of Service, and protect the rights and safety of users.
We use each category of personal information only for the purposes disclosed at collection and other purposes compatible with that context. We will provide a new notice before using your information for an incompatible purpose.
4Sensitive personal information
Under the CPRA, certain information is treated as "sensitive personal information." On the Platform this includes the government-issued identification number you submit for identity verification. The personal information of a known minor is not, by itself, a statutory sensitive-personal-information category under the CPRA; the Company nonetheless applies heightened internal safeguards to all known-minor data, described in section 8 and section 12.
Limited use. We use sensitive personal information only for the purposes permitted by the CPRA, such as verifying identity and eligibility, maintaining security, and providing the service you request. We do not use or disclose it to infer characteristics about you.
Right to limit. Because we already limit our use of sensitive personal information to these permitted purposes, no further action is required from you. You may still contact us with questions about how this information is handled.
Heightened safeguards for minors. Separately from the statutory category above, the Company treats all personal information of a known minor as requiring heightened internal protection. This is a Company safeguard, not a statutory classification, and it applies regardless of whether the information is sensitive personal information under the CPRA. These safeguards are described in section 8 and section 12.
5Sharing & disclosure
Schools and administration. Game data, scores, and standings are shared with member schools and the association as part of conference operations.
College recruiters. Verified athlete profiles marked recruiting-visible are accessible to college coaching staff through the Connect and recruiting-board features. Athletes and their guardians opt in to this visibility.
Service providers and contractors. We disclose information to vendors that host the Platform and provide analytics and email delivery, under written contracts that limit their use of the information to performing services for us.
Legal requirements. We may disclose information when required by law, subpoena, or court order, or to protect the safety of users or the public.
6We do not sell or share your personal information
We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the CPRA. We have not done so in the preceding twelve months, including for consumers we know to be under 18 years of age.
Because we do not sell or share personal information, no opt-out is necessary. We honor "Do Not Sell or Share My Personal Information" and Global Privacy Control signals by default. If our practices ever change, we will update this policy and provide a clear opt-out mechanism before any sale or sharing begins.
7Data retention
We retain each category of personal information only for as long as reasonably necessary for the purpose it was collected, then delete or de-identify it. Our general schedule:
Account and profile information. For the life of your account and for a limited period afterward to meet legal, security, and record-keeping needs. We retain this information for [90] days after account closure, except where a longer period is required by law or is necessary to resolve a pending dispute or enforce our agreements.
Identity verification documents. Retained only as long as needed to complete and record verification, then securely deleted immediately after the verification result is recorded, and in no case later than [30] days after verification. Where our verification provider can return a pass or fail result together with a confirmation that the person is of the required age, we capture only that result and do not retain the identification image at all. When an image is briefly handled to complete verification, it is deleted as described above and is never stored on the athlete's profile. After verification, we retain only a verification record, consisting of the fact and date of verification, the age-eligibility confirmation, and the name of the verifying guardian, for as long as the athlete's account is active and for [three] years afterward. For age confirmation alone, a verified checkbox attestation that the athlete meets the minimum age may be used in place of an identification document where permitted.
Game, stat, and media content. Retained as part of the historical record unless you request removal of content you submitted, unless a guardian withdraws consent for a minor's media, or unless the content is removed under the Copyright and Content Removal Policy. Scores, standings, and official results remain part of the competitive record after a profile is removed, but are no longer displayed in association with a withdrawn athlete profile.
Usage and analytics data. Retained for no more than [24] months for security and product improvement.
8Student-athletes & minors
Guardian consent for name, image, and likeness. Before a profile for an athlete under 18 can publish, a parent or legal guardian must complete the NIL Consent and Authorization Agreement, authorizing how the minor's name, image, and likeness may be used for promotional material and school recruitment profiles. This consent is limited to the uses the guardian selects and can be withdrawn in writing at any time.
COPPA. Accounts on the Platform are limited to users aged 14 and older. The Platform does not knowingly collect personal information from children under 14 without verifiable parental consent. If we learn a child under 14 has provided information without consent, we will delete it promptly. The Platform does not publish, display, or maintain any personally identifiable information about an athlete under 14, whether submitted by the athlete, a guardian, or a member school. This includes rosters, scores, statistics, photographs, and video that would identify an athlete under 14. Aggregate or team-level results that do not identify an individual under 14 are not restricted by this paragraph.
FERPA. The Platform is not designed to receive education records protected by the Family Educational Rights and Privacy Act, and we do not connect to, query, or import from any school student information system. Academic information such as GPA is entered manually by the athlete, the guardian, or authorized school personnel. Where a school directs its personnel to enter information drawn from a student's education records, we act on the school's behalf and under its direct control under a signed School and Association Data Agreement, use that information only for the purposes the school authorizes, do not redisclose it except as the school permits, and return or delete it at the school's direction. Features that accept transcript, grade, enrollment, or eligibility data are not enabled for a school until that agreement is executed. Schools remain responsible for obtaining any consent, or for applying any exception, that FERPA requires before their personnel enter such information.
Minor privacy protections. A minor's GPA, transcript, contact details, and measurables stay private by default until the athlete or guardian chooses to share them with a specific program. We do not sell or share the personal information of consumers under 18.
Guardian rights. Parents and guardians may access, correct, or delete their child's personal information, and withdraw consent, by contacting us at the address below.
Removal of media depicting a minor. A parent or legal guardian may request removal of media that depicts their child, whether or not the child holds an account on the Platform and whether or not the family uploaded the media. Requests are handled under the Privacy and likeness removal process in the Copyright and Content Removal Policy. Requests concerning nonconsensual intimate imagery are handled under the separate process described in that Policy and are acted on within 48 hours of a valid request.
9Your California privacy rights (CPRA)
If you are a California resident, you have the following rights, subject to certain exceptions:
Right to know and access. Request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom we disclose it.
Right to delete. Request deletion of personal information we collected from you.
Right to correct. Request correction of inaccurate personal information we maintain about you.
Right to opt out of sale or sharing. Direct us not to sell or share your personal information. We do not sell or share personal information, so no action is needed.
Right to limit use of sensitive personal information. Limit our use of sensitive personal information to permitted purposes. We already apply this limit by default.
Right to data portability. Receive a copy of your personal information in a portable, readily usable format.
Right to non-discrimination. We will not discriminate against you for exercising any of these rights.
10Exercising your rights
How to submit a request. Email [email protected] or use the contact form on the Platform. Please tell us which right you wish to exercise.
Verification. To protect your information, we will take steps to verify your identity before fulfilling a request. We may ask you to confirm information already associated with your account.
Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require written permission and verification of your identity.
Response timing. We aim to acknowledge requests within 10 business days and respond within 45 calendar days, with one 45-day extension where reasonably necessary and permitted by law.
Appeals. If we decline your request, you may appeal by replying to our decision. We will respond to appeals within the time required by applicable law.
11Other state privacy laws
Residents of other states with comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah, and Texas, may have similar rights to access, correct, delete, and obtain a copy of their personal information, and to opt out of targeted advertising, sale, and certain profiling. You may exercise these rights using the same contact methods described in section 10.
12Data security
We use industry-standard technical and organizational measures to protect personal information, including encryption in transit (TLS), access controls, and regular security reviews. No method of electronic transmission or storage is fully secure, and we cannot guarantee absolute security.
Safeguards. Access to personal information is limited to authorized personnel who need it to operate the Platform. Sensitive records, such as minors' data, guardian identity documents, and signed consents, are stored with restricted access and retained only as long as needed for the purpose collected or as required by law.
Verification and minors. Guardian consent and government-issued ID uploaded to verify authority are used only for verification and record-keeping, are never shown on an athlete's public profile, and are handled under heightened access controls.
Your role. You are responsible for keeping your login credentials confidential and for activity under your account. Notify us promptly if you believe your account has been compromised.
Incident response. If we become aware of a data breach affecting your personal information, we will notify affected users and applicable authorities as required by law, and take reasonable steps to contain and remediate the incident.
13Changes & contact
We may update this Privacy Policy periodically. Material changes will be communicated through the Platform or by email, and the "Last updated" date will change. Continued use after an update constitutes acknowledgment of the revised policy.
For questions, requests, or concerns about this Privacy Policy or your personal data, contact: Varsity Engine LLC, Attn: Privacy, Mississippi, United States. [email protected]