Privacy Policy

Imagine Sports Systems Inc. (“Imaginess,” “we,” “us,” or “our”) operates the Imaginess platform, a sports organization management system. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and platform.

1. Information We Collect

Personal Information

We may collect the following personal information:

• Name, email address, phone number, and mailing address
• Date of birth and age group (for athlete registration and age-appropriate program placement)
• Parent or guardian contact information (for minor athletes)
• Billing information for a club's own subscription. We do not collect card numbers anywhere in the product today - see section 3.
• Organization and role information (admin, coach, parent, athlete)
• Emergency contact information and medical notes (provided voluntarily for safety purposes)

Usage and Technical Data

• Browser type, IP address, device information, and operating system
• Pages visited, time spent, and navigation patterns
• Geolocation data (used for showing nearby programs, with your consent)
• Cookies and similar tracking technologies

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our platform
• Record registrations, the payments a club receives, and instalment plans
• Manage athlete profiles, team assignments, and program enrollment
• Send transactional communications (registration confirmations, payment receipts, schedule updates)
• Send marketing communications (only with your consent, and you can opt out at any time)
• Provide customer support
• Generate reports and analytics for sports organization administrators
• Improve our platform, detect fraud, and ensure security
• Comply with legal obligations

3. Payment Processing

Imaginess does not currently process card payments. We hold no payment provider account, no club has live card payments switched on, and there is nowhere in the product to enter a card number. No cardholder data is collected, transmitted or stored by us.

Clubs that take money today do so outside the platform, or through the methods the product records rather than processes - Interac e-Transfer, cheque and cash - where what we store is the club's own record of a payment, not a financial instrument.

When card payments are enabled they will run through a PCI-DSS compliant processor, card details will go directly to that processor rather than to our servers, and this policy will be updated to name it before the first charge is taken. We will not describe a payment relationship we do not have.

4. Data Sharing, Subprocessors and Where They Are

We do not sell your personal information. We share it only with the service providers below, only for the purposes named, and only to the extent each one needs to do its job.

None of these are in Canada. Personal information you give us is stored and processed outside the country, principally in the United States, and is therefore subject to the laws of the places listed. We will not claim Canadian-only residency, because it would not be true.

When you or your club's staff use the built-in Scout assistant, the text of that conversation - which may include personal information you reference in it - is sent to the model provider to generate the reply. We restrict routing to zero-data-retention endpoints, so those providers do not retain or train on conversation content. Transcripts are stored by us, are visible only to the person who had the conversation, and can be deleted by that person at any time.

We do not send SMS or text messages. Beyond Google Analytics on this marketing website, which loads only after you accept it, we use no product analytics: what happens inside a club's account is not measured by a third party. If that changes, this policy will be updated before the new service processes anything.

Each provider is bound by its own privacy policy and by a data processing agreement with us.

5. Multi-Tenant Data Isolation

Imaginess is a multi-tenant platform serving multiple sports organizations. Each organization's data is logically isolated: every query is scoped to the organization it belongs to, and administrators of one organization cannot access data belonging to another. Underneath that, PostgreSQL row-level security is enforced on every organization-scoped table as a second, independent layer, so a query that forgot its tenant returns nothing rather than somebody else's rows.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you request account deletion, we will remove your personal data within 30 days, except where we are required to retain it for legal, accounting, or regulatory purposes. Payment transaction records may be retained for up to 7 years as required by financial regulations.

7. Children's Privacy

Our platform serves youth sports organizations, and athlete accounts for minors (under 18) are created and managed by their parents or legal guardians. We do not knowingly collect personal information directly from children without parental consent. Parents and guardians can review, update, or request deletion of their child's information at any time by contacting us or through their account settings.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your personal information
• Withdraw consent for marketing communications - every marketing email carries an unsubscribe link to a preference page where you can opt out in one click, with no account or sign-in required. Withdrawal takes effect immediately (and in any case within 10 business days, as Canada's anti-spam law requires). Transactional messages about your registrations, payments, and schedules continue.
• Request a portable copy of your data
• Object to certain processing of your information

Two of these do not need us at all. A signed-in family can download a copy of everything held about them, and can request erasure, from their own account - the request runs through the product, removes the records it is able to remove, and reports back exactly what was retained and why. For anything else, or if you would rather ask a person, contact privacy@imaginess.ai. We answer within 30 days.

9. Canadian Privacy Law

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA). We obtain meaningful consent for the collection, use and disclosure of personal information, and you may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice.

For residents of Quebec, the Act respecting the protection of personal information in the private sector, as amended by Law 25, also applies. In particular: the information above about transfers outside Quebec is given before you provide anything; our privacy officer can be reached at privacy@imaginess.ai; and tracking on this website is off by default and requires your consent.

Alberta and British Columbia have their own Personal Information Protection Acts, which apply to organizations operating there. Where a provincial law gives you a stronger right than this policy describes, the provincial law governs.

Because our service providers are outside Canada (see section 4), your personal information may be accessible to the courts, law enforcement and national security authorities of those countries under their own laws. We tell you this rather than implying a Canadian-only arrangement we do not have.

10. Cookies

Essential cookies keep your session and your preferences. Analytics cookies are set on this marketing website only, only by Google Analytics 4, and only after you accept them - the script is not loaded at all until you do, and declining is remembered. The application at app.imaginess.ai sets no analytics or advertising cookies.

The Cookie Notice lists each cookie and carries the control for changing your answer.

11. Security

We implement industry-standard security measures including SSL/TLS encryption for all data in transit, encryption at rest for sensitive data, row-level tenant isolation in the database, role-based access controls, and regular security assessments. No cardholder data is handled by us today; when card payments are enabled, they will be processed by PCI-DSS compliant infrastructure rather than by our servers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the “Last updated” date. Continued use of our platform after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

Imagine Sports Systems Inc.
Email: privacy@imaginess.ai
General: support@imaginess.ai