AcademyOS

Draft pending legal review. This text has not yet been reviewed by a lawyer and may change before its final publication. The details in brackets will be completed during that review. The Spanish version prevails in case of discrepancy.

AcademyOS Privacy Policy

Last updated: [publication date]

This policy explains what personal data AcademyOS processes, why, with whom it is shared and how to exercise your rights, in accordance with Ecuador's Organic Law on Personal Data Protection (LOPDP) and its regulations.

1. Who processes your data

  • The academy you belong to is the data controller for the data of its roster, families and staff: it decides what data to upload and for what purpose.
  • MSLARCO ([legal name], tax ID (RUC) [number], [address], Ecuador) provides AcademyOS and acts as data processor for that data, following the academy's instructions.
  • MSLARCO is the controller of account data (name, email, language and access security) and of data it receives through its own website, for example when you request a demo.

Data protection officer: [name and email of the officer].

2. What data we process

  • Account: name, email, password (stored encrypted), language, devices with an open session and access logs.
  • Players: name, date of birth, ID document if the academy records it, photo, age group, sports data and notes the academy adds.
  • Families and guardians: name, contact details, relationship and the consents granted or revoked.
  • Academy staff: name, email and profile within the academy.
  • Technical use: IP address, browser and activity logs needed for security and auditing.

We do not ask for data the service does not need. Health data is only processed when the academy activates a module that requires it, with the reinforced safeguards the law requires for sensitive data.

3. Data of children and adolescents

Most players are minors. That is why:

  • The academy must have the consent of the mother, father or legal guardian to upload a minor's data, where the law requires it.
  • The responsible guardian can see their child's profile and grant or revoke consents (for example, the use of their image) from the platform. An authorized relative can only view it.
  • Everyone sees only what their profile allows: a family never sees other players' data and coaches see only what they need for their work.
  • We never use minors' data for advertising or commercial profiling, and we never sell it.
  • A minor player only has their own account if the academy invites them and with their guardian's authorization.

4. What we use it for

  • Providing the service to the academy: roster, age groups, families, staff and whatever its modules enable.
  • Sending service emails: invitations, verification codes and security notices.
  • Protecting accounts and the platform, preventing abuse and meeting legal obligations.
  • Improving the service with aggregated usage statistics that do not identify anyone.

The legal basis is the performance of the contract with the academy, consent where applicable, compliance with legal obligations and the legitimate interest in the security of the service.

5. Who we share it with

Only with providers we need to operate, under contract and with confidentiality and security obligations:

  • Hosting and file storage: [provider and country].
  • Email delivery: Amazon Web Services (SES).
  • App stores and phone notification services, when you use the app.

Some of these providers are outside Ecuador. In those cases we apply the safeguards the LOPDP requires for international data transfers. We do not sell or hand over personal data to third parties for their own purposes.

6. How long we keep it

For as long as the academy uses the service and the account is active. When the academy ends the service or requests deletion, we delete or anonymize the data within [period] days, except for what the law requires us to keep. Security logs are kept for [period].

7. How we protect it

Encrypted connections, passwords stored with one-way hashing, optional two-step verification, strict separation of each academy's data, profile-based permissions and an audit log of important actions. If a breach affecting your data occurs, we will notify the academy, the authority and the people affected within the deadlines set by law.

8. Your rights

You may exercise your rights of access, rectification, updating, deletion, objection, portability and suspension of processing, and withdraw a consent at any time. The mother, father or legal guardian exercises them on behalf of a minor.

If your data was uploaded by an academy, you can ask the academy or write to us at [privacy email] and we will help it respond. We will reply within the deadline set by the LOPDP. If you are not satisfied, you may contact Ecuador's Superintendency for Personal Data Protection.

9. Cookies

The site uses the cookies needed to keep your session and your language and theme preferences. On the public page we use Google Analytics 4 to measure which parts help, only if you accept it in the cookie notice; if you reject it, no measurement cookie is stored. You can change your decision at any time from the "Cookies" link in the footer.

10. Changes

If we change this policy significantly, we will notify you by email or within the platform before it takes effect.

11. Contact

For any privacy question: [privacy email].