Privacy Policy

§ 01 Scope and Applicability

This Privacy Policy applies to all users of the RecruitOS platform, a sports technology service operated by Field-IQ Sports Solutions LLC, a Virginia limited liability company. RecruitOS provides digital scouting intelligence tools, athlete performance profiles, event tracking, and recruiting workflow management for authorized college and professional recruitment personnel ("Recruiters"), athletic program administrators ("Operators"), youth athletic organizations, and the student-athletes and families who participate in events indexed by the platform.

This Policy applies to:

• The RecruitOS web application and any associated mobile interfaces;
• All subdomains, microsites, and organization-specific portals hosted under RecruitOS infrastructure;
• All data submitted, uploaded, generated, or processed through the platform by any user category;
• Information collected via embedded analytics, form submissions, event check-in flows, and scout note tools.

This Policy does not govern information collected offline, by third-party platforms linked from RecruitOS, or by athletic organizations that independently collect data outside the RecruitOS platform. Where RecruitOS acts as a data processor on behalf of an Operator (as defined in Section 7), the Operator's own privacy practices govern that Operator's separate data collection activities.

§ 02 Information We Collect

2.1 Information Provided Directly

We collect information that users provide when registering accounts, completing profiles, submitting forms, or communicating through the platform. This includes:

• Recruiter and Scout Accounts: Full name, institutional affiliation, coaching title or role, email address, phone number, and account credentials;
• Operator and Organization Accounts: Organization name, contact representative information, program type (high school, travel, showcase), geographic region, and billing information;
• Athlete Profile Data (submitted by Operators or authorized adults): Athlete's full name, graduating class year, high school or program affiliation, position, physical measurements (height, weight), batting/throwing hand, academic graduation year, and performance statistics provided voluntarily by the submitting organization;
• Event Data: Tournament names, game dates and locations, opponent information, and results voluntarily submitted by authorized program administrators.

2.2 Information Collected Automatically

When any user accesses RecruitOS, we automatically collect certain technical and usage information, including:

• Internet Protocol (IP) address;
• Browser type, version, and operating system;
• Device identifiers and persistent cookies or similar tracking technologies;
• Pages viewed, features accessed, time stamps, session duration, and navigation patterns;
• Referring URLs and search terms used to locate the platform;
• Geolocation data derived from IP address (general region only; precise geolocation is not collected without express consent).

2.3 Scout Notes and Recruiter-Generated Content

Authorized Recruiters may create private scouting notes, ratings, and assessments associated with individual athlete profiles. This data is generated by the Recruiter and remains associated with the Recruiter's account. Field-IQ treats such content as proprietary to the generating user's institutional account and does not share, sell, or repurpose it except as required for platform operation or as required by law.

2.4 Information We Do Not Collect

RecruitOS does not collect, and Operators are strictly prohibited from submitting, the following categories of data through the platform:

• Social Security Numbers or government identification numbers;
• Financial account information of student-athletes or their families;
• Medical or health records;
• Biometric identifiers (fingerprints, facial recognition data, voiceprints);
• Home addresses of minors;
• Direct contact information (personal email or cell phone numbers) for athletes under 18 years of age.

Submission of prohibited data categories by any Operator or user constitutes a material breach of the RecruitOS Terms of Use and may result in immediate account suspension and data deletion.

§ 03 How We Use Your Information

Field-IQ uses information collected through RecruitOS for the following purposes:

3.1 Platform Operations

• Authenticating and managing user accounts;
• Delivering core platform functionality including athlete profile display, event indexing, and scout note management;
• Processing and displaying event and game results submitted by authorized program administrators;
• Enabling organization-level access controls and permission tiers.

3.2 Communication

• Sending transactional communications including account confirmations, password resets, and service notices;
• Responding to support requests, inquiries, and user feedback;
• Delivering product updates, platform changelog notices, and policy change notifications.

3.3 Analytics and Platform Improvement

• Analyzing aggregate, de-identified usage data to improve platform functionality, performance, and user experience;
• Identifying feature usage trends and product roadmap priorities;
• Conducting internal research to support platform development.

3.4 Legal Compliance and Safety

• Complying with applicable federal and state laws, court orders, and regulatory obligations;
• Investigating and responding to suspected violations of this Policy or the Terms of Use;
• Protecting the rights, property, and safety of Field-IQ, its users, and the public.

§ 04 Legal Bases for Processing

Field-IQ processes personal information under the following legal bases as applicable:

• Contractual Necessity: Processing required to perform services under the RecruitOS Terms of Use and Operator Agreements;
• Legitimate Interests: Processing necessary for our legitimate business interests in operating and improving the platform, provided such interests do not override the rights and freedoms of data subjects;
• Consent: Where required by applicable law (including COPPA for children under 13), processing is conditioned on the affirmative, verifiable consent of a parent or legal guardian;
• Legal Obligation: Processing required to comply with applicable federal and state law, regulatory directives, or lawful court orders.

§ 05 Minors and Children's Privacy (COPPA Compliance)

5.1 Applicability of COPPA

The Children's Online Privacy Protection Act (COPPA), as amended by the FTC's 2025 Final Rule (effective June 23, 2025, compliance deadline April 22, 2026), requires verifiable parental consent before collecting, using, or disclosing personal information from children under 13 years of age through any website or online service directed to children, or where the operator has actual knowledge that a child under 13 is providing personal information.

RecruitOS is not a consumer-facing platform directed to children. It is a professional recruiting intelligence tool accessed by authorized college and professional scouts, recruiters, and athletic program administrators. Student-athletes do not register for RecruitOS accounts. Athlete profile information is submitted exclusively by authorized adult Operators—coaches, program directors, or athletic administrators—on behalf of their programs.

5.2 Operator Representations and Responsibilities

All Operators who submit athlete profile data through the RecruitOS platform expressly represent and warrant that:

• They have obtained all necessary consents from parents or legal guardians of athletes under 13 prior to submitting any personally identifiable information of such athletes to the platform;
• For athletes between the ages of 13 and 17, they have obtained all applicable parental or guardian acknowledgments required by their organization's policies, applicable state law, and any applicable athletic association rules;
• The information submitted is limited to publicly-available or voluntarily-disclosed athletic and performance data, and does not include contact information, home addresses, or sensitive personal data as defined in Section 2.4;
• They have provided or will provide appropriate notice to athletes' families regarding the use of RecruitOS as a recruiting visibility tool.

5.3 Field-IQ's Obligations Under COPPA

In accordance with the 2025 COPPA Final Rule amendments, Field-IQ commits to the following:

• Data Minimization: We collect and retain only the minimum athlete information necessary to fulfill the platform's core recruiting intelligence function;
• Defined Data Lifecycle: Athlete profile data is not retained indefinitely. See Section 9 (Data Retention) for full policy;
• Third-Party Disclosure Restrictions: We require written confirmation from any third-party service providers that handle athlete data that such providers maintain reasonable security measures and use the data only for the stated purpose;
• No Targeted Advertising to Minors: Field-IQ does not serve targeted advertisements to users of the platform using any data derived from athlete profiles or associated with individuals under 18;
• Parental Access Rights: Parents or legal guardians who believe their child under 13 has had information submitted to RecruitOS may contact us at the address in Section 16 to request review, correction, or deletion of that information.

5.4 Mixed Audience Acknowledgment

Consistent with the 2025 COPPA Final Rule definition of "mixed audience website or online service," Field-IQ acknowledges that while the primary users of RecruitOS are adult professionals, the platform processes data about minors as a core function of its recruiting intelligence service. Field-IQ applies heightened data protection standards to all athlete profile data regardless of the athlete's age.

§ 06 FERPA and Student Educational Records

The Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g, protects the privacy of student education records maintained by schools that receive federal funding. FERPA affords parents the right to inspect and review their child's education records and restricts disclosure of such records without parental consent.

6.1 Scope of FERPA as Applied to RecruitOS

RecruitOS does not access, interface with, or receive student education records from any school district, high school, or educational institution. The platform does not receive academic transcripts, GPA data, disciplinary records, standardized test scores, or any other records maintained by a school in connection with an enrolled student.

FERPA does permit schools to designate certain categories of information as "directory information," which may include a student's name, participation in officially recognized school-sponsored extracurricular activities, and athletic statistics such as height and weight. Even where such information is classified as directory information, schools must provide notice and an opt-out mechanism before disclosing it. RecruitOS does not operate as a recipient of FERPA directory information directly from schools; all athlete data on the platform is submitted by athletic program organizations operating independently of school record systems.

6.2 Operator Compliance

Operators that are affiliated with or operated by public high schools are solely responsible for ensuring that their use of RecruitOS is consistent with FERPA's requirements and any applicable Virginia student data privacy laws, including but not limited to Va. Code Ann. § 23.1-405 and the Virginia Data Protection Act. Field-IQ does not act as a "school official" under FERPA and does not receive any data pursuant to a FERPA-compliant data sharing agreement with any educational institution.

§ 07 Disclosure and Sharing of Information

7.1 Within the Platform

Athlete profile data submitted by Operators is visible within the RecruitOS platform to:

• The submitting Operator and their authorized administrators;
• Authorized Recruiters who have been granted access to the relevant event or program through the platform's permission tier controls;
• Field-IQ personnel for support, maintenance, and compliance purposes.

7.2 Third-Party Service Providers

Field-IQ may engage third-party vendors and service providers to assist in platform operations, including cloud hosting, database management, analytics, and security services. Such providers receive access to personal data only to the extent necessary to perform services on our behalf and are contractually required to maintain appropriate confidentiality and security standards, consistent with the 2025 COPPA Final Rule's requirement for written security assurances from third parties handling children's data.

7.3 Disclosures Required by Law

Field-IQ may disclose information to government authorities, law enforcement agencies, or other parties when required by applicable law, lawful subpoena, court order, or regulatory directive, or when we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Field-IQ, our users, or the public.

7.4 Business Transfers

In the event of a merger, acquisition, asset sale, or other corporate restructuring involving Field-IQ Sports Solutions LLC, personal data held by the Company may be transferred to the successor entity. In such cases, Field-IQ will provide notice to affected users and ensure that the successor entity assumes obligations under this Privacy Policy or provides users an opportunity to delete their data prior to transfer.

7.5 No Sale of Athlete Data

Field-IQ does not sell, rent, lease, or commercially license personally identifiable athlete profile data to any third party. Aggregate, de-identified, and anonymized data may be used for platform analytics, industry reporting, and product development purposes, provided that such data cannot reasonably be used to identify any individual.

§ 08 Recruiter and Scout Access Controls

Access to athlete profile data within RecruitOS is governed by a tiered permissioning system. Field-IQ implements the following access control framework:

• Verified Institutional Affiliation: Recruiters must provide verifiable institutional affiliation (college program, professional organization, or licensed scouting service) at account registration. Field-IQ reserves the right to verify such affiliation and revoke access for misrepresentation;
• Event-Scoped Access: Recruiter access to athlete profiles is scoped to events, tournaments, or programs for which access has been granted by the relevant Operator;
• Scout Note Privacy: Recruiter-generated scouting notes are private to the generating account and not visible to athletes, parents, Operators, or other Recruiters unless explicitly shared within the platform's sharing tools;
• Access Logging: Field-IQ maintains logs of Recruiter access to athlete profiles for security auditing and compliance purposes;
• Prohibited Uses: Recruiters are prohibited from using data accessed through RecruitOS to contact minors directly, to solicit athletes in violation of NCAA, NAIA, or applicable high school athletic association rules, or to transfer data outside the platform for commercial resale.

§ 09 Data Retention and Deletion

Consistent with the data minimization and defined lifecycle requirements of the 2025 COPPA Final Rule and the VCDPA:

9.1 Retention Periods

• Athlete Profile Data: Retained for a maximum of three (3) years from the date of last active update by the submitting Operator, unless a deletion request is received earlier;
• Event and Game Data: Retained for a maximum of five (5) years for historical record purposes;
• Scout Notes: Retained for the duration of the generating Recruiter's active account, and deleted within ninety (90) days of account termination;
• Account Data: Retained for the duration of the account's active status and for up to two (2) years following account closure for legal, audit, and dispute resolution purposes;
• Log and Technical Data: Retained for a maximum of thirteen (13) months for security and analytics purposes.

9.2 Deletion Requests

Operators may request deletion of athlete profiles or event data at any time through the platform interface or by contacting Field-IQ at the address in Section 16. Parents or legal guardians of athletes under 13 may request deletion of their child's information in accordance with COPPA. Field-IQ will process verified deletion requests within thirty (30) days. Deletion of data from active systems will be followed by deletion from backup systems within the subsequent backup rotation cycle, not to exceed ninety (90) days.

9.3 Athlete Age-Out Deletion

Field-IQ will initiate deletion of athlete profile data associated with athletes who have completed high school eligibility upon notification from the submitting Operator, or automatically upon the athlete's projected graduation year plus one (1) calendar year, unless the Operator has renewed or updated the profile for a college-level application.

§ 10 Security Measures

Field-IQ employs commercially reasonable technical, administrative, and physical security measures designed to protect personal information from unauthorized access, use, alteration, disclosure, and destruction. These measures include:

• Encryption of data in transit using TLS 1.2 or higher;
• Encryption of sensitive data fields at rest;
• Role-based access controls (RBAC) limiting data access to personnel with a legitimate need;
• Row-level security (RLS) controls within the platform database architecture;
• Regular security assessments and vulnerability scanning;
• Multi-factor authentication available for Operator and Recruiter accounts;
• Audit logging of administrative access to data systems.

Notwithstanding the foregoing, no system is completely secure. Field-IQ cannot guarantee absolute security of information transmitted over the internet or stored in electronic systems. Users are responsible for maintaining the confidentiality of their account credentials and for notifying Field-IQ promptly of any suspected unauthorized account access.

10.1 Data Breach Notification

In the event of a data breach that poses a material risk of harm to affected individuals, Field-IQ will provide notification to affected Operators and, where required by applicable law, to relevant state authorities, within the timeframes prescribed by applicable breach notification statutes, including Virginia Code Ann. § 18.2-186.6.

§ 11 Virginia Consumer Data Protection Act (VCDPA)

Field-IQ Sports Solutions LLC is incorporated and operates in the Commonwealth of Virginia and is subject to the Virginia Consumer Data Protection Act, Va. Code Ann. §§ 59.1-571 through 59.1-585 (the "VCDPA"), as amended effective January 1, 2025, to include enhanced protections for children's personal data.

11.1 Consumer Rights Under the VCDPA

Virginia residents who are users of RecruitOS (acting in an individual, non-commercial capacity) have the following rights with respect to their personal data processed by Field-IQ:

• Right to Access: The right to confirm whether Field-IQ processes your personal data and to access that data;
• Right to Correction: The right to correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of processing;
• Right to Deletion: The right to request deletion of personal data provided by or obtained about you;
• Right to Data Portability: The right to obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format;
• Right to Opt Out: The right to opt out of the processing of your personal data for purposes of (a) targeted advertising, (b) sale of personal data, or (c) profiling in furtherance of decisions that produce legal or similarly significant effects. Field-IQ does not engage in the sale of personal data or targeted advertising to individual users.

11.2 Data Protection Assessments

Consistent with the January 1, 2025 VCDPA amendment, Field-IQ conducts data protection assessments for processing activities involving children's personal data, including the processing of athlete profile data submitted for individuals who are known minors. These assessments evaluate the purposes of processing, the benefits to the platform and its users, and the risks to the rights and interests of minor data subjects.

11.3 Sensitive Data

To the extent any personal data processed through RecruitOS constitutes "sensitive data" under the VCDPA (including but not limited to data that reveals racial or ethnic origin, mental or physical health diagnoses, or precise geolocation), Field-IQ obtains consent prior to processing such data. As a general matter, RecruitOS does not solicit or require submission of sensitive data categories as defined by the VCDPA.

11.4 Appeals Process

If Field-IQ declines to act on a VCDPA rights request, the requesting consumer may appeal the decision by submitting a written appeal to Field-IQ at the contact information in Section 16. Field-IQ will respond to appeals within sixty (60) days. If the appeal is denied, the consumer may submit a complaint to the Virginia Attorney General's Office pursuant to Va. Code Ann. § 59.1-581.

§ 12 Your Rights and Choices

12.1 Account Holders

Registered Operator and Recruiter account holders may, at any time:

• Access and update their account profile information through the platform interface;
• Download a copy of profile data associated with their account by submitting a request to Field-IQ;
• Request deletion of their account and associated data, subject to retention obligations described in Section 9;
• Opt out of non-transactional marketing communications by using the unsubscribe mechanism in any Field-IQ marketing email or by contacting us at the address in Section 16.

12.2 Parents and Guardians

Parents and legal guardians of student-athletes whose information has been submitted to the RecruitOS platform may contact Field-IQ to:

• Request confirmation of whether their child's information is present in the platform;
• Request review of their child's submitted profile data;
• Request correction of inaccurate information;
• Request deletion of their child's information from the platform.

Field-IQ will respond to verified parental requests within thirty (30) days. Requests may be submitted to the contact information in Section 16. Field-IQ may require reasonable verification of the requesting party's identity and parental relationship before processing a request.

12.3 Athletes

Student-athletes who are 18 years of age or older may exercise the rights described in Section 12.1 and Section 11.1 directly. Student-athletes under 18 must exercise rights through a parent or legal guardian.

§ 13 Cookies and Tracking Technologies

RecruitOS uses cookies and similar tracking technologies to support platform functionality, maintain user sessions, and analyze aggregate usage patterns. The platform employs the following categories of cookies:

• Strictly Necessary Cookies: Required for authentication, session management, and core platform security. These cookies cannot be disabled without impairing platform functionality;
• Functional Cookies: Used to remember user preferences and settings to improve the user experience;
• Analytics Cookies: Used to collect aggregate, anonymized data about platform usage patterns to support product improvement. Analytics data is not used to identify individual users or build personal profiles;
• Third-Party Analytics: Field-IQ may use third-party analytics services (such as Google Analytics 4) to process aggregate usage data. Such services are configured to anonymize IP addresses and are subject to applicable data processing agreements.

Users may manage cookie preferences through their browser settings. Disabling certain cookie categories may affect platform functionality. Field-IQ does not use cookies or persistent identifiers to serve targeted advertising or to track users across third-party websites.

§ 14 Third-Party Links and Services

The RecruitOS platform may contain links to third-party websites, services, or resources, including but not limited to athletic association websites, event management platforms, or social media profiles. Field-IQ is not responsible for the privacy practices or content of such third-party services. Users who navigate away from RecruitOS to third-party sites do so at their own risk and are subject to the privacy policies of those third parties.

RecruitOS may integrate with third-party data sources or platforms to enhance event coverage or athlete profile data, only where such integrations are disclosed to relevant Operators and conducted pursuant to applicable data sharing agreements.

§ 15 Changes to This Policy

Field-IQ reserves the right to update or modify this Privacy Policy at any time. When material changes are made, Field-IQ will:

• Update the "Last Revised" date at the top of this Policy;
• Provide notice to registered Operators and Recruiter account holders via the email address on file, at least thirty (30) days prior to the effective date of material changes;
• Where required by applicable law (including changes affecting the processing of children's data under COPPA), obtain any legally required affirmative consent before implementing such changes.

Continued use of RecruitOS following the effective date of a revised Privacy Policy constitutes acceptance of the updated terms. Users who do not agree to a revised Policy should discontinue use of the platform and contact Field-IQ to request account closure and data deletion.

§ 16 Contact Information and Data Requests

All privacy inquiries, data access requests, deletion requests, parental consent requests, COPPA-related inquiries, VCDPA rights requests, and appeals should be directed to:

For COPPA-specific parental requests, please include "COPPA Parental Request" in the subject line and provide your name, your child's approximate age, and the name of the athletic organization through which your child's information was submitted, if known.

Field-IQ will acknowledge receipt of all privacy-related requests within five (5) business days and will respond substantively within thirty (30) days, unless applicable law requires a shorter response period or permits an extension.

Virginia Attorney General

Virginia residents who believe their rights under the VCDPA have been violated may file a complaint with the Virginia Attorney General's Office at:

Federal Trade Commission

Individuals who believe their rights under COPPA have been violated may file a complaint with the Federal Trade Commission at www.ftc.gov or by calling 1-877-FTC-HELP.