Legal

Privacy Policy

Effective: June 12, 2026

1. About this Policy

This Privacy Policy describes how PlayCleared LLC ("PlayCleared," "we," "us") collects, uses, and protects information when you access our athletic eligibility platform (the "Service"). PlayCleared is built specifically for K–12 schools handling student athlete records, and this Policy is written with the unique privacy obligations of education service providers in mind, including the federal Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), and Louisiana Act 837.

2. Who We Serve

Our customers are schools, school districts, and athletic departments ("Schools"). We do not sell directly to students or parents. When students or their guardians interact with the Service, they do so on behalf of, and through, a participating School.

3. Information We Collect

3.1 Account holder information

When an Athletic Director, coach, or staff member creates a PlayCleared account, we collect: name, email address, school affiliation, role, and authentication credentials (managed by our identity provider, Clerk).

3.2 Student athlete information (Customer Data)

Schools upload information about student athletes to the Service, which may include: name, date of birth, grade level, sport(s) and roster assignments, eligibility status, parent or guardian contact information, and uploaded documents such as physicals, parent permission forms, transcripts, and report cards.

This information is provided to us by the School and remains the property of the School. PlayCleared acts solely as a service provider processing this information under the direction of the School.

3.3 Usage and technical information

We automatically collect log data and technical information for service operation: IP address, browser/device information, pages accessed, timestamps, and basic performance metrics. We do not use this data for advertising or marketing.

4. FERPA and Our Role as a "School Official"

Under FERPA (20 U.S.C. § 1232g; 34 C.F.R. Part 99), schools may share student educational records with outside parties acting as a "school official with a legitimate educational interest" (34 C.F.R. § 99.31(a)(1)(i)(B)). PlayCleared operates exclusively under this exception. Specifically:

We perform services that the School would otherwise use its own employees to perform
We are under direct control of the School with respect to the use and maintenance of educational records
We use educational records only for the authorized purpose of providing the Service
We do not disclose educational records to third parties except as the School directs
We do not re-disclose educational records or use them for any commercial purpose

5. Louisiana Act 837 and State Student-Privacy Laws

For Louisiana customers, PlayCleared complies with Louisiana Act 837 of the 2014 Regular Session (La. R.S. 17:3914), which restricts the collection, use, and disclosure of personally identifiable student information by online service providers. For customers in other states, PlayCleared complies with applicable state student data privacy laws.

6. How We Use Information

We use information collected through the Service strictly to:

Provide, maintain, and improve the Service
Process and evaluate athletic eligibility based on the school's state rules
Send service-related notifications (clearance alerts, weekly digests, account messages)
Provide customer support to authorized School staff
Comply with legal obligations and protect against fraud or abuse

We do not, and will not:

Sell student data or School data to any third party
Use student data for targeted advertising
Build profiles of students for non-educational purposes
Use student data to train any AI or machine-learning model, including our own, except where the model is operating directly on a specific School's data to deliver a specific Service feature for that School

7. Sub-processors

To operate the Service, we use a small set of trusted infrastructure providers. Each of these sub-processors has been selected for their security posture and contractual data protection commitments:

Sub-processor	Purpose	Data handled
Supabase	Database and file storage	All Customer Data (encrypted at rest)
Vercel	Application hosting and CDN	Application code, in-transit traffic
Clerk	User authentication and identity	Account holder email, name, password hash
Resend	Transactional email delivery	Recipient email + message body
Sentry	Error monitoring (with PII scrubbing)	Error stack traces; PII removed before transmission
Anthropic	AI-assisted document reading (when school has explicitly opted in)	Document content sent only when the school's AD has enabled AI features. Under Anthropic's standard commercial terms: data is not used for training and not re-disclosed to third parties. Anthropic retains inputs for up to 30 days for their trust-and-safety review, then deletes them. Schools whose districts require zero third-party retention can leave AI features off — the platform works fully without them.
Stripe	Payment processing and subscription billing	Billing contact name and email, and payment-card or bank-account details entered by the paying School. Card and bank numbers are sent directly to Stripe and are never stored on our servers. Stripe is a PCI-DSS Level 1 certified payment processor. No student data is sent to Stripe.

We will notify Schools at least 30 days before adding a new sub-processor or replacing an existing one, except where required immediately for security reasons.

8. Data Security

We protect information through:

Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)
Role-based access control within the Service (AD, coach, staff)
Multi-factor authentication on administrator accounts
Strict tenant isolation — each School's data is segregated by tenant ID
Audit logging of administrative actions
Routine security review and incident response procedures

9. Data Retention and Deletion

We retain Customer Data for as long as the School maintains an active subscription. On termination of a School's subscription, we will provide a reasonable export window (at least 30 days) during which the School can retrieve its data. After the export window closes, we delete Customer Data from active systems within 30 days and from backups within 180 days.

Schools may request earlier deletion of specific student records at any time through their Athletic Director dashboard or by writing to CoachDean@playcleared.com.

10. Children's Privacy (COPPA)

The Service is intended to be used by adults (school staff, coaches, administrators) managing student athlete records. Students do not directly create accounts on PlayCleared. Where information about students under 13 appears in the Service, it has been submitted by the School under the "school authorization" exception to COPPA: schools may consent to certain online service collection of personal information on behalf of parents for an educational purpose. PlayCleared uses such information solely for the educational purpose specified by the School.

11. Your Rights and Choices

11.1 For students and parents

FERPA grants parents (and students 18 and older) the right to inspect, review, request corrections to, and (in some cases) request deletion of educational records. These requests must be made through your School, not directly to PlayCleared. The School controls access to Customer Data and will work with PlayCleared as needed to honor FERPA requests.

11.2 For account holders

Account holders (AD, coach, staff) may update their account information from within the Service, or request account deletion by writing to CoachDean@playcleared.com.

12. International Transfers

PlayCleared infrastructure and operations are based in the United States. We do not currently market or sell the Service outside the United States. We do not intentionally transfer Customer Data outside the United States; the sub-processors listed above use U.S.-based primary data centers.

13. Security Incidents

In the event of a confirmed security incident affecting Customer Data, we will notify affected Schools without undue delay and no later than 72 hours after confirmation, in line with our Data Processing Agreement.

14. Changes to this Policy

We may update this Privacy Policy from time to time. We will notify Schools by email of any material changes at least 30 days before they take effect. Non-material clarifications will be reflected in an updated "Effective" date at the top of this page.

15. Contact

Questions about this Privacy Policy, or about how PlayCleared handles your School's data?

Email: CoachDean@playcleared.com
Mail: PlayCleared LLC, 80 Kisatchie Ln., Boyce, Louisiana 71409