Privacy Policy

Effective date: October 23, 2026

1. Scope, responsible company, and audience

Next Layer AI LLC ("Next Layer AI," "NLS," "we," "us") operates Next Layer Sports, a website and iPhone application for US-based sports Organizations and adult users. This Policy describes our handling of information relating to account holders, people visiting our public pages or forms, and Players whose details are supplied by adults. An Organization may make separate decisions about participation records and must also comply with applicable privacy duties. Contact hello@nextlayerai.com for NLS privacy questions. Each Organization decides how it uses participant information for its own programs, and NLS processes that information on its behalf; NLS independently handles NLS-wide accounts, platform-wide Player and Guardian records, security, moderation, safety and legal compliance.

The service is designed for adult users, not for children to operate directly. Player data can nevertheless describe children and may be associated with an adult's account and one or more Organizations.

2. Information we collect or receive

Account and identity information: adult users' names, email addresses, optional profile pictures, sign-in method, account/role identifiers, preferences, and evidence of acceptance of current and earlier legal documents and the 18+ confirmation. Supabase processes authentication credentials and time-limited verification codes; NLS staff do not see users' passwords in plaintext.

Organization and Player information: Organization identity, public profile, logos, locations, Programs, Groups, Training, roles, invitation email addresses, and Stripe Connect account references. Messages sent to an Organization through its public contact form are delivered by email to the Organization's Owner and are not stored in the NLS database. Player records include names, birth dates, gender, Guardian links and relationship/authority confirmations, registrations, memberships, bookings, assignments, attendance and RSVP activity, and limited identity-review records intended to prevent incorrect merges.

Payments and transaction history: amounts, status, date, Organization, related Player, payment-provider references, platform fee, refunds, and payments the Organization records as received outside NLS. Card numbers are entered on Stripe-hosted payment pages rather than stored in NLS. Stripe receives the purchaser's email and a checkout line item that names the Program or Training and a registration reference, not the Player's name.

Team Chat and moderation: messages, reactions, pins, read position, blocks, reports, reason for report, a restricted copy of reported text, moderator actions, posting suspensions, legal holds, and logs recording when authorized moderators view hidden messages or the restricted copy of reported text.

Notices and devices: in-app notification content and read/dismissed status, email and push preferences, and iPhone push registration tokens connected to signed-in sessions. The app's session credential is stored in the device Keychain; Apple's Password AutoFill/iCloud Keychain may store a saved password under settings controlled by the user and Apple.

Public forms and technical records: contact and request-access details submitted by visitors and delivered by email rather than stored as ordinary Platform database messages. A salted hash of a form submitter's network address may be kept for one day to limit spam. Limited anti-abuse records note the account, the type of action, any related record, and the time, and are deleted on short schedules described in Section 8. Infrastructure and sign-in providers may process technical requests, IP/network addresses, device/browser characteristics, and security logs under their own retention practices. NLS does not currently record a browser user-agent string as part of one-time-code verification.

3. Children and authority to provide Player information

NLS does not offer accounts to Players or let them sign in, post chat content, or directly supply information through the ordinary service. Guardians or authorized club Owners/Admins provide a child's record. Information can include the child's name, full date of birth, gender, relationships, and participation. We use it to support program eligibility, rosters, registration, scheduling, and authorized club administration.

NLS does not knowingly collect personal information online directly from children. Information about a child is provided by the child's parent or guardian or by an authorized Organization. If we learn that a child under 13 has given us personal information directly, for example by creating an account or using a public form, we will delete it and may close the account.

A Guardian confirms their legal or other valid authority to act for the Player. An Organization that creates an unclaimed Player record represents that it is authorized to do so. We may require additional information when authority is disputed. NLS does not independently determine legal custody by accepting these confirmations.

Authorized Guardians may request access, correction, association review, or deletion of Player information by contacting us. We verify authority before responding and may coordinate with an Organization when it controls the relevant registration or participation record. Some historical information may remain for lawful accounting, safety, fraud prevention, litigation, or other valid retention needs. If a child's final Guardian account is deleted while the child remains linked to an Organization, the record may be flagged as requiring a Guardian and temporarily retained for legitimate club needs rather than immediately removed. We review such a record about 12 months after the child's last participation and then delete or de-identify it unless the Organization has a legal reason to keep it.

NLS does not create an account or provide sign-in access for a Player who turns 18. A former minor who is now an adult may contact us to receive a copy of, correct, or delete their information, ask to remove Guardian links, and create their own account.

4. How and why we use information

We process information to manage accounts, validate roles and adult eligibility, connect Guardians and Players, administer Organization membership, operate registration, bookings, rosters and attendance, facilitate Stripe payments and recorded offline payments, send essential service messages, deliver push notifications with permission, and provide Team Chat.

We also use data for account security, limited spam prevention, detecting abuse and duplicate identities, moderation and child-safety escalations, responding to legal requests, enforcing rights, retaining compliance records, and resolving financial or operational disputes. We do not currently use advertising, user-behavior analytics tracking, data-broker services, or sale of personal information as described in the launch brief.

5. Who can see information and whom we share with

Organizations: the Organization's Owner/Admins may access the Player, Guardian, registration and transaction information relevant to that Organization. Assigned Coaches can access rosters and sessions within their roles, including a Player's full birth date and gender. Authorized Guardians can access the records associated with their Players. Organization data is separated by club permissions.

Chat: participants can see messages during their eligible periods; the Organization's Owners/Admins have broader chat oversight. NLS platform administrators handle applicable escalations and legal holds. Reports sent to club moderators generally conceal the reporter's identity. Restricted moderation and evidence records are made available only to personnel with an authorized need, subject to valid legal process.

Service providers: Supabase (database, identity, file storage, realtime), Stripe (online payments), Vercel (hosting), Resend (service email), Cloudflare Turnstile (bot checks where enabled), Expo's push service and Apple's Push Notification service (push delivery), Sentry (error monitoring), and related providers/subprocessors actually used in production. Stripe receives the purchaser's email and a checkout description with a registration reference rather than the child's name. Expo/Apple receive push tokens and the generic notification text required for delivery. Cloudflare may receive browser and network signals. We may disclose necessary data to legal authorities or other recipients where required or permitted by law.

Public materials: Organization public profiles and logos are intended for public display. Optional account profile images currently can be retrieved by a party possessing the associated storage URL, even when the image is not prominently shown to the public; do not upload images you want to keep strictly confidential. We may move profile images to access-controlled storage in the future.

Vendor processing locations: Our database, file storage, website hosting and error monitoring run in the United States. Payment, email and push-notification providers may process information in other countries under their own safeguards.

6. Emails, notifications, and mobile device functions

We send transactional and service emails such as sign-in codes, invitations, account/security notices, registration and schedule information, payment confirmations and refunds, and Guardian/Organization messages. Users can disable optional categories for participation, membership, Guardian, and Organization operations. Necessary security, payment, invitations, and verification messages may continue. We do not email Team Chat message text.

The iPhone app requests permission before registering for push notifications. Users may disable categories in NLS Settings and disable push permission in iOS Settings. Push notifications use club names and generic messages rather than Player names, financial amounts, or chat text; the notification recipient and device token are processed for delivery by Expo and Apple. In-app notifications and transactional emails may include children's names where needed to communicate with an authorized recipient.

On supported Apple devices, local device Keychain functionality stores sign-in session credentials. Password AutoFill and iCloud Keychain are controlled through Apple's services and settings. We do not receive your saved iCloud Keychain record merely because Password AutoFill is available.

The iPhone app asks for photo library access only so you can choose a profile photo or an Organization logo. It does not use the camera, collect your location or contacts, or include analytics or advertising software; it does include error-monitoring software that sends technical crash and error reports. Opening directions passes the address to your device's maps app.

7. Deletion and retained records

A signed-in user can delete their account from the website or app by confirming a one-time code. Account profile, sign-in, role links, preferences, ordinary notifications, and push registrations are removed or de-identified as implemented, subject to technical and lawful retention needs. The deletion process may require transfer of Organization ownership first, and cannot proceed while a payment for one of your Players is still in progress.

Registrations, bookings, payments, refunds, attendance, historical club memberships, legal acceptance evidence, and other records may remain as needed for Organization operations, accounting, disputes, or legal requirements, generally with a de-identified "Former member" reference. When a user deletes their account, ordinary authored chat text is removed from conversations. Copies already included in reports, legal holds, or other legitimate preservation systems may remain under restricted access. A child's record can remain with an Organization if the child's last Guardian deletes their account, subject to a defined retention review and verified new-Guardian claim. Deleted accounts cannot simply be restored.

8. Retention and preservation

We retain information only for as long as needed for the stated purposes and applicable obligations, subject to appropriate legal holds. Current operational schedules include: in-app notifications generally 30 days after read/dismissal and 90 days if unread; public-form hashed network identifiers one day; Checkout attempt records about one day; family sign-up and new-child records two days; invitation and join-code attempt counts, which apply over a rolling 24 hours and are cleared when the person next uses that feature; a chat push not sent within one hour, or any other push not sent within 24 hours, is never sent, and delivery records are deleted with the related notification; device push registrations are removed at sign-out, when the session ends, on account deletion, or after 60 days without renewal; one-time codes are stored only in hashed form, and expired codes are deleted daily while used or replaced codes are deleted after about seven days; and ordinary Team Chat messages for 12 months after the relevant Group or Program is archived, unless held.

Payment, attendance, and participation records may need longer retention for accounting, disputes, safety, or legal obligations. Moderation reports, copies of reported text, audit logs, legal acceptance records, and "Guardian Required" Player records follow the periods in the table above. In-app notifications, Team Chat messages, device push registrations, anti-abuse records and one-time codes are already deleted automatically on their schedules. For the other periods in the table, automated deletion is not yet active; it will be in place before any record reaches the end of its period.

Only authorized NLS personnel may apply or release a legal hold; held information is excluded from ordinary scheduled deletion while necessary. Legal holds currently apply to Team Chat content; other records needed for an investigation are preserved by separate restricted procedures. Certain legally reportable child-safety incidents can carry specific preservation duties. Vendor-controlled operational and security logs follow the verified periods for the relevant providers, subject to law.

9. Choices, requests, and rights

You can edit supported profile fields, change optional email and push preferences, and request account deletion through Settings. Depending on applicable law and your circumstances, you may have rights to access, correct, delete, or receive information or exercise additional privacy choices.

Contact hello@nextlayerai.com about an account or Player request, identifying the account or Player involved without sending unnecessary sensitive information. We may authenticate your identity or authority and coordinate with the Organization responsible for particular club records. Where permitted by law, we may explain a refusal or retention exception and available review or appeal options.

We verify requests by confirming they come from the email address on the NLS account, and may ask for more information. An authorized agent may submit a request with your signed permission, and we may ask you to confirm your identity directly. We respond within 45 days and may extend once by up to 45 more days where the law allows, explaining why. If we decline a request, you may appeal by replying to our decision; we respond within 45 days, and if you remain dissatisfied you may contact your state attorney general. We will not discriminate against you for exercising your rights. We offer this process to all users in the United States, wherever they live.

10. Security, other services, and changes

We use role-based access, authentication controls, and other technical and organizational measures, but no system guarantees absolute security. We cannot control every third-party website or service you choose to access, such as Stripe-hosted checkout or external mapping services, whose own policies may apply. We do not intentionally integrate advertising-tracking tools in the launch product as described.

We may update this Policy and will provide appropriate notice of material changes. Where NLS materially changes a data practice or adds a provider, we will assess applicable disclosures and permissions before enabling the new processing. The Policy's effective date will be set on publication, not retroactively.

11. Contact

Next Layer AI LLC / Next Layer Sports. Privacy and account requests: hello@nextlayerai.com. Mail: Next Layer AI LLC, 56647 Via Toscana, Macomb, MI 48042.