Privacy Policy — Prospecta

Prospecta ("Prospecta," "we," "us," or "our") provides AI-powered college sports recruiting assessments, planning tools, and related services (collectively, the "Services") through getprospecta.ai and related domains. This Privacy Policy explains what information we collect, how we use and share it, and the choices you have. By using the Services you agree to this Policy and to our Terms of Service.

1. Who this Policy applies to

The Services are intended to be used by parents, legal guardians, and adult athletes (age 18+). When information about a youth athlete under 18 (a "Minor Athlete") is provided to us, we rely on the parent or legal guardian who created the account to have the right to share that information and to act as the Minor Athlete's authorized representative.

2. Information we collect

Information you provide

Account information — name, email, password, and authentication identifiers (including from Google sign-in).
Athlete profile data — athlete name, gender, grade, graduation year, sport, position, club, height, hometown, GPA, SAT/ACT scores, sport-specific metrics (e.g., UTR), tournament results, achievements, video links, headshots, and transcripts you upload.
Recruiting preferences — geographic flexibility, target division level, and other assessment inputs.
Outreach and notes — coach contact records, email drafts, status updates, and notes you create inside the platform.
Billing information — for paid subscriptions, payment details are collected and processed by our payment processor (Stripe). We receive limited information such as subscription status, plan, renewal date, and the last four digits of the card.
Communications — messages you send us by email or through support channels.

Information collected automatically

Usage data — pages viewed, features used, assessment activity, approximate location derived from IP address, device and browser information, and referring URLs.
Cookies and similar technologies — see Section 7.

Information from third parties

Authentication providers (e.g., Google) that you choose to use to sign in.
Payment processors that confirm subscription events.
Public information about college programs and coaches used to power our recruiting database.

3. How we use information

Provide, operate, and improve the Services and assessments.
Generate AI-assisted recommendations, school lists, and outreach drafts.
Manage your account, subscription, and customer support.
Send transactional messages about your account or the Services.
Detect, prevent, and respond to fraud, abuse, and security issues.
Comply with legal obligations and enforce our Terms.
With your consent, send product updates, recruiting tips, and marketing communications you can unsubscribe from at any time.

We do not sell personal information, and we do not use information about Minor Athletes for behavioral advertising or to train third-party AI models.

4. AI processing

The Services use third-party large language model providers to generate assessments, Scout chat responses, outreach drafts, decision briefs, portfolio drafts, visit prep, and other AI-assisted recommendations. Today those providers are Anthropic for Claude models, plus Google Gemini and OpenAI models accessed through Lovable AI. We do not set a separate provider service tier in code; access is controlled through our provider account and Lovable AI workspace credits.

Assessment inputs and product content needed for a requested AI feature may be sent to those providers to return the feature output to us. Our contracts and gateway controls restrict their use of that data to providing the service back to us and prohibit using it to train their models. We do not send direct identifiers such as full name, email, address, or phone number to these providers as part of assessment generation.

4a. Google user data (Gmail send-only)

Families who opt in can connect an athlete's Google account so that Prospecta sends coach-outreach emails from the athlete's own Gmail address. This section describes exactly what we access, what we do with it, and what we will never do — as required by the Google API Services User Data Policy (including the Limited Use requirements).

What we access

Send-only permission — the https://www.googleapis.com/auth/gmail.send scope only. We do not request any Gmail read, modify, metadata, or full-access scopes.
Basic profile fields provided during sign-in (name, email, avatar) solely to display which Google account is connected and to set the correct From address.

What we do with it

Send only the specific outreach emails the family reviews and approves, in scheduled batches the family controls.
Attach a per-outreach Reply-To address on our own domain so replies can be tracked without reading the athlete's inbox.
Retain the OAuth refresh token, encrypted at rest, only for as long as the connection is active. Revoking access deletes the token.

What we will never do

Read the athlete's Gmail inbox, threads, drafts, labels, or message metadata. We do not hold any Gmail read scope.
Store message bodies or attachments beyond the approved outreach draft the family created inside Prospecta.
Sell, rent, or share Google user data with third parties.
Use Google user data for advertising, profile enrichment, or to train generalized or third-party AI/ML models.
Allow humans to read Google user data, except with the user's explicit consent, for security or abuse investigation, to comply with applicable law, or when the data has been aggregated and anonymized so it cannot identify an individual.
Track opens with tracking pixels. We track replies (received at our tokenized Reply-To address) and say so plainly.

Minor athletes and Google

When the athlete is under 18, the connection is a two-step gate:

The parent or legal guardian on the family account must first review a plain-language approval screen and record their consent in Prospecta (we log who approved and when).
Only after that approval is on file may the athlete complete Google's own OAuth consent screen and connect their Google account.

Either the athlete or the family account holder may disconnect at any time, in two places:

Inside Prospecta — Settings → Coach outreach → Google connection → Disconnect. This immediately stops sending and deletes our copy of the OAuth refresh token.
In Google — myaccount.google.com/permissions and remove Prospecta.

Sharing with sub-processors

We transmit outreach messages through Google's SMTP send API and log operational metadata (message IDs, send timestamps, error codes) in our own database. We do not route Google user data through third-party AI model providers.

No Google user data — raw, aggregated, anonymized, or derived — is ever transmitted to any AI or machine-learning provider, used to train or improve AI models, or shared for any secondary purpose. Prospecta does not have permission to read Gmail messages, headers, attachments, labels, drafts, or metadata, so no Gmail-derived content can be used in AI features.

5. How we share information

Service providers who help us run Prospecta — including cloud hosting, database, authentication, email, payments, analytics, and AI providers — under written agreements requiring appropriate safeguards.
Public portfolio pages — if you choose to publish an athlete portfolio, the information you mark as visible becomes publicly accessible on the web. You control what is included and can unpublish at any time.
Legal and safety — to comply with law, valid legal process, or to protect the rights, property, or safety of Prospecta, our users, or others.
Business transfers — in connection with a merger, acquisition, or sale of assets, subject to this Policy.

6. Children and Minor Athletes

The Services are not directed to children under 13 and we do not knowingly collect personal information directly from a child under 13. Accounts must be created by an adult (18+). Parents and legal guardians may provide information about a Minor Athlete (including a child age 13 or older) for the purpose of recruiting assessments, planning, and outreach.

We apply additional protections to Minor Athlete data: we collect only the information needed to provide the Services, we do not use it for advertising, and we make portfolio pages private by default. A parent or legal guardian may request access to, correction of, or deletion of a Minor Athlete's information at any time by contacting help@getprospecta.ai. If you believe a child under 13 has provided us information without parental involvement, contact us and we will delete it.

7. Cookies and tracking

We use strictly necessary cookies to keep you signed in and to remember your settings, and optional analytics cookies to understand how the Services are used. You can accept or reject non-essential cookies using our cookie banner, and you can clear cookies at any time in your browser settings. We do not use third-party advertising cookies.

When you visit an athlete's public profile page (a "/p/" link) and later click "Sign up as a coach", we set a first-party cookie named prospecta_ref_slug (30-day expiry) that records which athlete's link you came from. If you go on to create a coach account, we log this as a referral so the athlete knows their share link recruited a coach. The cookie stores only the athlete's public profile slug, is scoped to Prospecta, and is never shared with third parties. Clear it any time via your browser settings or by declining the banner.

8. Data retention

We retain personal information for as long as your account is active or as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or de-identify your personal information within a reasonable period, except where retention is required by law.

9. Security

We use industry-standard administrative, technical, and physical safeguards — including encryption in transit, access controls, and row-level security on user data — to protect personal information. No system is perfectly secure; if we learn of a security incident affecting your information, we will notify you and the appropriate authorities as required by law.

10. Your choices and rights

Depending on where you live, you may have the right to:

Access, correct, update, or delete your personal information.
Object to or restrict certain processing of your information.
Port your information to another service.
Withdraw consent where processing is based on consent.
Lodge a complaint with a supervisory authority (residents of the EEA, UK, and similar jurisdictions).

California residents have specific rights under the CCPA/CPRA, including the right to know, delete, correct, and limit the use of sensitive personal information, and the right not to be discriminated against for exercising these rights. We do not "sell" or "share" personal information for cross-context behavioral advertising as those terms are defined under California law.

To exercise any of these rights, contact help@getprospecta.ai from the email address on file. We may need to verify your identity before acting on a request.

11. International users

Prospecta is operated from the United States. If you access the Services from outside the U.S., your information will be transferred to and processed in the U.S. and other countries that may have different data protection laws than your jurisdiction.

12. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or through a notice in the Services. The "Last updated" date above reflects the most recent revision.

13. Contact us

Questions or requests about this Policy or your information: help@getprospecta.ai.