GX1 Football Technology — Privacy Policy

1. About this Privacy Policy

This Privacy Policy explains what personal information GX1 Football Technology ("GX1", "we", "us") handles, why, and what choices you have. GX1 provides academy management software that football academies ("Academies") use to run their own operations. Each Academy is its own separate tenant on GX1: an Academy's staff, athletes, and families never see another Academy's data.

2. Operator

GX1 Football Technology operates the GX1 platform. GX1 is currently in an early pilot and testing phase (see section 36 of the Terms of Use) and is not currently a registered company, charity, or not-for-profit entity. If you are a parent, athlete, coach, or Academy Admin, your Academy is the one who invited you and who controls what information about you is entered into the system - GX1 provides and operates the Platform on the Academy's behalf, as the Academy's service provider.

3. Contact

Questions about this policy, or requests concerning your personal information, can be sent to gx1sportstechnologies@gmail.com.

4. Information We Collect

The sections below describe the categories of information GX1 handles. Not every category applies to every user - what is collected depends on your role and on what your Academy chooses to record.

5. Account Information

Every person who signs in to GX1 (Academy Admins, Coaches, Parents/Guardians, and platform Super Admins) has an account with:

• Name and email address - required, used to sign in and to receive account-related emails (invitations, password resets).
• Password - stored only as a salted cryptographic hash. GX1 staff cannot read your password.
• Phone/WhatsApp number - optional, if your Academy collects it for contact purposes.
• Optional two-factor authentication secret and one-time backup codes, if you choose to enable it.
• A record of your acceptance of these Terms and this Privacy Policy - see section 4 of the Terms of Use.

6. Parent/Guardian Information

A Parent/Guardian's profile includes their name, contact details, relationship to the athlete, and notification preferences. This is entered by the Academy or by the parent/guardian themselves through the registration or invitation process.

7. Player Information

Academies use GX1 to keep a player record for each athlete, which may include:

• name, preferred name, date of birth, gender, nationality;
• football-specific details: category, position, dominant foot, jersey number, current club, program/team assignment;
• contact and address details of the athlete or their guardians.

8. Coach/Staff Information

A Coach's profile can include name, date of birth, gender, nationality, role, preferred age category, Working With Children Check (or equivalent) number and expiry, contact details, emergency contact details, address, and notes an Academy Admin adds about that staff member.

9. Academy Information

An Academy's own profile includes its name, display name, contact and address details, and branding (logo, colours) used to personalise its GX1 account and, where applicable, a white-label app.

10. Football Information

Program, team, and venue structures an Academy sets up, and the assignment of athletes and coaches to them, are stored so the Academy can organise its own operations within GX1.

11. Teams/Sessions

Calendar events (training sessions, matches, and other activities), including recurring session series, are created by an Academy's staff and linked to the relevant team, program, and athletes.

12. Attendance

Coaches record attendance (present/absent/excused, etc.) against calendar events. This history is visible to the Academy's staff and to the relevant athlete's parent/guardian.

13. Development Reports

Coaches can complete structured skill assessments and development reports for an athlete (scores against categories/ criteria the Academy defines, written comments, goals, and PDF exports). Published assessments/reports are visible to the athlete's parent/guardian.

14. Match/Statistics

Where an Academy records match information (results, lineups, individual statistics), this is stored against the relevant athlete and team records.

15. Messages

GX1 includes a messaging feature for conversations between an Academy's staff and the families in that Academy. Message content is stored so the conversation history is available to its participants; it is not read or used by GX1 for any purpose other than delivering it to the people you're messaging.

16. Announcements

An Academy can broadcast announcements to some or all of its families. GX1 records who an announcement was sent to and, for each recipient, whether it has been read, so an Academy can confirm important information reached its intended audience.

17. Media/Uploads

Academies can upload a profile photo for an athlete or coach, and, through the registration flow, request supporting documents (for example, a medical/emergency action plan). Files are stored outside the public web folder and served only through an authenticated, permission-checked link - never a public URL.

18. Injury/Availability Information

Where an Academy chooses to record it, an athlete's profile can include medical information: allergies, injuries, medications, and disabilities/medical notes, along with emergency contact details. This is treated as sensitive information - entered by the Academy, or by a parent/guardian completing a registration form, for safeguarding and emergency purposes - and is visible only to that Academy's authorised staff and the athlete's own linked parent/guardian account.

19. Technical Information

GX1 automatically logs limited technical information needed to operate securely - for example, the timestamp, action, and originating IP address of security-relevant actions (see section 32) - and standard web server request logs.

20. Device/Browser Information

When you use the GX1 Android/iOS app, standard device information (such as operating system version and app version) may be visible to our hosting and app-distribution providers in the ordinary course of running the app; GX1 itself does not separately collect device analytics or fingerprinting data.

21. Push Notification Tokens

If you enable push notifications, GX1 stores a device token (an opaque identifier issued by the push notification service, not personal information on its own) linked to your account, so a notification can be delivered to your device. A token is removed if it becomes invalid or when you disable notifications. See section 29.

22. Children's Information

GX1 may process information relating to users under 18 - primarily young football players, who do not hold their own login. This information is supplied by an Academy, an authorised Coach, or a Parent/Guardian. GX1 aims to collect and process only the information reasonably necessary for the Platform's football-management functionality. A parent/guardian may request appropriate access, correction, or deletion of information relating to their own child, subject to verifying their authority to do so, and subject to any independent record- keeping obligation their Academy may have (for example, safeguarding records). This Privacy Policy does not represent that GX1 is certified compliant with any specific children's privacy regime; Academies remain responsible for their own independent obligations concerning the children's information they enter.

23. Why Information Is Collected

Information is collected and used to provide the GX1 platform: to authenticate accounts, to let an Academy manage its athletes, staff, and communications, to display relevant information to each role (a parent sees their own child's data; a coach sees the athletes assigned to them), to deliver notifications and messages, to support the Academy's football-related operations, to maintain security, and to troubleshoot problems.

GX1 is currently in an early pilot and testing phase (see section 36 of the Terms of Use). During this phase, information may also be used to test the Platform's functionality and to evaluate and improve the pilot - for example, identifying and fixing bugs, and understanding how features are used so they can be refined. This does not give GX1 unlimited permission to use personal information for unrelated purposes: information is still only used for the purposes described in this Privacy Policy, and is not used to train artificial intelligence or machine-learning systems.

24. How Information Is Collected

Information is collected directly from you (when you create or update your own profile), from your Academy (when staff enter athlete, program, or session information), and from a parent/ guardian completing a public registration form on behalf of their child.

25. Academy-provided Information

Most information on GX1 is entered by an Academy or its authorised staff, not by GX1 itself. GX1 stores and displays it as instructed; the Academy remains responsible for its accuracy and for having the right to submit it.

26. Role-based Access

GX1 restricts what each account can see based on its role: an Academy Admin sees their Academy's own records; a Coach sees the athletes/sessions assigned to them; a Parent/Guardian sees only their own linked athlete(s); a Super Admin operates the platform itself and does not routinely view an Academy's day-to-day records.

27. Academy/Tenant Separation

Each Academy is a separate tenant: its data is logically isolated from every other Academy's data at the database and application level. Academies never see each other's athletes, staff, or communications.

28. Service Providers

GX1 uses a small number of providers to operate the Platform. None of them are permitted to use your data for their own purposes:

Some Academies add their own links inside GX1 (for example, a payment page or an external form for the next season/term). These "Term Links" open in your device's own browser, outside the app - GX1 does not send your data to those external sites; you interact with them directly, under their own privacy terms, only if you choose to click the link.

We do not sell personal information, and we do not share it for advertising purposes.

29. Firebase/Push Infrastructure

Push notifications are delivered through Firebase Cloud Messaging, a Google service. GX1 sends Firebase only a device token and the minimal notification content (a title, a short body, and an in-app link to open) - never message content, medical information, or other sensitive data. Firebase's own privacy practices apply to its handling of the notification in transit to your device; see Google's own privacy documentation for details of Firebase's processing.

30. Hosting/Database Infrastructure

GX1's application and database are hosted on Render. Render manages the underlying servers and infrastructure GX1 runs on; it does not use GX1's data for its own purposes.

31. Overseas Processing

Some of GX1's service providers (see section 28) may be based, or may process or store information, outside Australia as part of how they deliver their services to us. We have not yet completed a full review confirming the exact locations and safeguards involved for every provider, so you should assume some information may be handled overseas. We do not represent that all information is stored exclusively within Australia. This section will be updated with confirmed provider locations and any applicable safeguards once that review is complete.

32. Security

• All traffic to GX1 (web and the Android/iOS app) is encrypted with HTTPS/TLS. The app never sends data over plain, unencrypted HTTP.
• Passwords are stored as salted hashes, never in plain text.
• Access is scoped per Academy (multi-tenant isolation) and per role - see sections 26-27.
• Security-sensitive actions (sign-in, invitations, password changes, and similar) are logged for audit purposes, including the originating IP address.

No system can be guaranteed completely secure, and we do not represent or warrant that GX1 is immune from unauthorised access, loss, or misuse.

33. Data Retention

Your data is retained for as long as your account or your Academy remains active on GX1, so the Platform continues to work correctly (an athlete's history, attendance, and assessments are part of what makes the record useful to their Academy and family). An Academy Admin can deactivate or remove specific records (for example, a parent's login) through the Platform. If an Academy stops using GX1, we retain its data only as long as reasonably necessary to wind down the account, then remove it.

34. Account Deletion

You can delete your own GX1 account (Academy Admin, Coach, or Parent/Guardian) at any time from Security Settings inside the app, or without the app installed - see our Account & Data Deletion page for exactly how, and for what is and isn't removed.

35. Access and Correction

Depending on your role and location, you may have the right to:

• ask to see what personal information GX1 holds about you;
• ask for corrections to inaccurate information; and
• ask for your information to be deleted, subject to your Academy's own record-keeping needs (for example, safeguarding records an Academy is required to keep).

Because each Academy controls its own roster, the fastest way to exercise these rights is usually to contact your Academy directly. You can also contact us using the details in section 41 and we will route your request appropriately.

36. Privacy Complaints

If you believe GX1 has mishandled your personal information, contact us at gx1sportstechnologies@gmail.com with details of your concern. We will investigate and respond within a reasonable time. If you are not satisfied with our response, you may be entitled to raise the matter with the Office of the Australian Information Commissioner (OAIC) or the equivalent regulator in your jurisdiction.

37. Data Breaches

If GX1 becomes aware of a data breach that is likely to result in serious harm to affected individuals, we will assess and respond in line with applicable notifiable data breach obligations, including notifying affected Academies and, where required by law, affected individuals and the relevant regulator.

38. Marketing

GX1 does not use your personal information for third-party advertising, and does not sell personal information. Account- related emails (invitations, password resets, and similar) are not marketing and cannot be opted out of while your account is active, as they are necessary to operate the account.

39. Automated Decision-making

GX1 does not use your personal information to make any automated decision that produces a legal or similarly significant effect on you. Development reports, statistics, and similar outputs are generated from data a human (a Coach or Academy Admin) entered and reflect their own judgment, not an automated evaluation of the athlete.

40. Changes to this Policy

We may update this Privacy Policy as GX1's practices change. Where a change is material, we will ask you to review and acknowledge the updated policy before you can continue using GX1, in the same way described in the Terms of Use. The version number and effective date at the top of this page reflect the current version.

41. Contact

Questions about this policy or your personal information can be sent to gx1sportstechnologies@gmail.com.