Privacy Policy

Imagine Sport Systems Inc. (“Imaginess,” “we,” “us,” or “our”) operates the Imaginess platform, a sports organization management system. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and platform.

Clubs and Imaginess: who is responsible

Most of the personal information in Imaginess is entered by, or for, a sports organization that uses the platform (a "club"): its athletes, families, staff and contacts. The club decides what it collects and why, and is responsible for that information, including any consent it needs - for example a parent's consent for a child. Imaginess processes that information on the club's behalf and on its instructions, to provide the platform, and not for purposes of our own. If you have a question about what a club holds about you, or want to exercise a privacy right over it, start with the club; we help the club answer.

Imaginess is responsible for the information we collect for our own purposes: visits to this website, sales and support enquiries, and our billing relationship with each club.

1. Information We Collect

Personal Information

We may collect the following personal information:

• Name, email address, phone number, and mailing address
• Date of birth and age group (for athlete registration and age-appropriate program placement)
• Parent or guardian contact information (for minor athletes)
• Billing information for a club's own subscription. We never receive or store full card numbers - see section 3.
• Organization and role information (admin, coach, parent, athlete)
• Emergency contact information and medical notes (provided voluntarily for safety purposes)
• For a club's staff and coaches, where the club uses staff onboarding or payroll features: social insurance number (SIN), direct-deposit banking details, pay rates and hours worked. SIN and bank account numbers are stored encrypted.
• Electronic signatures on waivers, contracts and other documents: the drawn signature or typed name, when it was signed, and the IP address it was signed from
• Photos a club uploads, such as athlete profile photos and event galleries, and coaches' notes and assessments about athletes
• Voice, only when a staff member uses voice dictation in the Scout assistant. The audio goes from the browser to our speech-to-text provider to be turned into text; we do not store the recording.

Usage and Technical Data

• Browser type, IP address, device information, and operating system
• Pages visited, time spent, and navigation patterns
• Geolocation data (used for showing nearby programs, with your consent)
• Cookies and similar tracking technologies

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our platform
• Record registrations, the payments a club receives, and instalment plans
• Manage athlete profiles, team assignments, and program enrollment
• Send transactional communications (registration confirmations, payment receipts, schedule updates)
• Send marketing communications (only with your consent, and you can opt out at any time)
• Provide customer support
• Generate reports and analytics for sports organization administrators
• Improve our platform, detect fraud, and ensure security
• Comply with legal obligations

3. Payment Processing

Most clubs take money outside the platform, or through the methods the product records rather than processes - Interac e-Transfer, cheque and cash - where what we store is the club's own record of a payment, not a financial instrument.

Clubs that Imaginess has enabled for card payments take them through Stripe, a PCI-DSS Level 1 certified processor, using Stripe Connect. Each such club has its own Stripe account and is the merchant of record. Card details are entered into fields provided by Stripe and go directly to Stripe, not to our servers; we never receive or store a full card number. To take a payment, Stripe receives the card details and the payer's name, email address and billing details. We keep the payment's amount, status and Stripe reference, and the club's Stripe account identifier, so that receipts, refunds and the club's records stay accurate. Stripe handles that information under its own privacy policy (stripe.com/privacy).

Subscriptions to Imaginess are invoiced and paid outside the platform; no card is charged for them.

4. Data Sharing, Subprocessors and Where They Are

We do not sell your personal information. We share it only with the service providers below, only for the purposes named, and only to the extent each one needs to do its job.

None of these are in Canada. Personal information you give us is stored and processed outside the country, principally in the United States, and is therefore subject to the laws of the places listed. The application and its database are hosted in the United States (the database in Oregon, AWS us-west-2), and email is sent through Zoho's data centre in India. We will not claim Canadian-only residency, because it would not be true.

When you or your club's staff use the built-in Scout assistant, the text of that conversation - which may include personal information you reference in it - is sent to the model provider to generate the reply. We restrict routing to zero-data-retention endpoints, so those providers do not retain or train on conversation content. Images and PDF files attached to a conversation are sent the same way, to a model that can read them. Transcripts are stored by us, are visible only to the person who had the conversation, and can be deleted by that person at any time.

Voice dictation in Scout streams audio from the browser directly to Deepgram to be turned into text. We do not store the audio, and we instruct Deepgram not to keep it to improve its models.

If you choose to sign in with a Google, Microsoft or Facebook account, that company confirms who you are and shares your name and email address with us. Its own privacy policy covers what it does.

We do not send SMS or text messages. Beyond Google Analytics on this marketing website, which loads only after you accept it, we use no product analytics: what happens inside a club's account is not measured by a third party. If that changes, this policy will be updated before the new service processes anything.

Each provider is bound by its own privacy policy and by a data processing agreement with us.

5. Multi-Tenant Data Isolation

Imaginess is a multi-tenant platform serving multiple sports organizations. Each organization's data is logically isolated: every query is scoped to the organization it belongs to, and administrators of one organization cannot access data belonging to another. Underneath that, PostgreSQL row-level security is enforced on every organization-scoped table as a second, independent layer, so a query that forgot its tenant returns nothing rather than somebody else's rows.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you request account deletion, we aim to remove your personal data within 30 days, except where we are required to retain it for legal, accounting, or regulatory purposes. Payment transaction records may be retained for up to 7 years as required by financial regulations.

7. Children's Privacy

Our platform serves youth sports organizations, and athlete accounts for minors (under 18) are created and managed by their parents or legal guardians. We do not knowingly collect personal information directly from children without parental consent. The club that registers a child is responsible for obtaining the parent's or guardian's consent where it is needed. Parents and guardians can review, update, or request deletion of their child's information at any time by contacting the club or us, or through their account settings.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your personal information
• Withdraw consent for marketing communications - every marketing email carries an unsubscribe link to a preference page where you can opt out in one click, with no account or sign-in required. Withdrawal takes effect immediately (and in any case within 10 business days, as Canada's anti-spam law requires). Transactional messages about your registrations, payments, and schedules continue.
• Request a portable copy of your data
• Object to certain processing of your information

Two of these do not need us at all. A signed-in family can download a copy of everything held about them, and can request erasure, from their own account - the request runs through the product, removes the records it is able to remove, and reports back exactly what was retained and why. For anything else, or if you would rather ask a person, contact privacy@imaginess.ai. We answer within 30 days.

9. Canadian Privacy Law

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). We obtain meaningful consent for the collection, use and disclosure of personal information, and you may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.

For residents of Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, also applies. In particular: the information above about transfers outside Quebec is given before you provide anything; the person in charge of the protection of personal information (our privacy officer) is our Founder, who can be reached at privacy@imaginess.ai; and tracking on this website is off by default and requires your consent.

Alberta and British Columbia have their own Personal Information Protection Acts, which apply to organizations operating there. Where a provincial law gives you a stronger right than this policy describes, the provincial law governs.

Because our service providers are outside Canada (see section 4), your personal information may be accessible to the courts, law enforcement and national security authorities of those countries under their own laws. We tell you this rather than implying a Canadian-only arrangement we do not have.

10. Cookies

Essential cookies keep your session and your preferences. Analytics cookies are set on this marketing website only, only by Google Analytics 4, and only after you accept them - the script is not loaded at all until you do, and declining is remembered. The application at app.imaginess.ai sets no analytics or advertising cookies.

The Cookie Notice lists each cookie and carries the control for changing your answer.

11. Security

We implement industry-standard security measures including SSL/TLS encryption for all data in transit, encryption at rest for sensitive data, row-level tenant isolation in the database, role-based access controls, and regular security assessments. No cardholder data is handled by us today; when card payments are enabled, they will be processed by PCI-DSS compliant infrastructure rather than by our servers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the “Last updated” date. Continued use of our platform after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Imagine Sport Systems Inc.
Privacy officer: Founder, privacy@imaginess.ai
General: support@imaginess.ai