SandScore Privacy Notice

1. Who handles the data and how to contact us

The entity responsible for processing is SandScore, a Brazilian digital product in its operational stage. Our public contact channel is being prepared. Signups will remain closed until it is available.

Corporate identification and formal privacy contact details will be added before commercial availability. This pending step does not reduce your rights or authorize additional data use.

2. Data we collect

• Name, email, language and sport interest you submit.
• Version and timestamp of the notice, terms and age confirmation acceptance.
• A short-lived SHA-256 fingerprint derived from IP and browser with a server secret, used only for rate limiting. Raw IP and browser values are not stored in that table.
• Technical data processed by Cloudflare Turnstile and minimal infrastructure logs needed for security and availability.
• Account and contact data, sports profiles, schedules, Coach and Student relationships, bookings, lessons, registrations, payments, refunds, consents, and user-requested content.

3. Purposes and grounds

• Manage the waitlist and notify you about matching early-access spots.
• Record and respect consent, opt-out and data-subject requests.
• Prevent spam, fraud and abuse and protect the service.
• We do not sell waitlist data, use it for behavioral advertising or make legally significant automated decisions about you.
• Perform bookings, lessons, and payments, provide support, meet legal duties, prevent fraud, and maintain security. Depending on context, we rely on contract, legal duty, legal claims, assessed legitimate interest, or specific consent.

4. Children and teenagers

The initial operational release accepts new credential accounts only from people aged 18 or older. Minor profiles will be released only after legal and operational approval of guardian and purpose-specific consent flows.

5. Processors and international transfers

We use Supabase for database and Edge Functions, Vercel for website hosting and Cloudflare Turnstile for abuse checks. These processors receive only what is needed and may process data in other jurisdictions under their contracts and safeguards.

The waitlist is not shared with Arenas, coaches or sponsors and never grants access to private Scout data.

In the app, payment providers, Arenas, Coaches, and organizers receive only what is needed for the relevant purchase. Private Scouts belong to the athlete and are never released by an Arena, sponsorship, or plan.

6. Retention and security

Consented signups are kept until the beta closes or for up to 24 months after the latest confirmation, unless law requires otherwise or deletion is requested earlier. Legacy signups without versioned consent remain blocked until consent is renewed.

Rate-limit fingerprints expire within 30 minutes. We use origin controls, Turnstile, rate limiting, RLS and restricted operational access. No system is infallible; relevant incidents will be handled under applicable law.

7. Your rights

You may request confirmation, access, correction, sharing information, consent withdrawal, objection or deletion. Our public contact channel is being prepared. Signups will remain closed until it is available. We may request minimal information to verify identity and prevent third-party changes.

8. Cookies and analytics

Turnstile may use technical data strictly required for security. Optional analytics may only start according to the choice shown on the site and must never receive name, email or form content.

9. Changes

Material changes create a new version and, when purposes or consent change, require fresh acceptance. The effective date remains visible on this page.

Public references

• Data-subject rights — Brazilian ANPD
• Children and teenagers statement — Brazilian ANPD