Privacy policy · Sport License Academy

Contents · 10 sections

Last updated: 7 October 2026

1. Data controller

Personal data processed through the Sport License Academy website and application available at sportlicenseacademy.com are processed by AZ GLOBAL ECOM LTD, a private limited company incorporated in England and Wales under company number 17219061, whose registered office is at 82a James Carter Road, Mildenhall, IP28 7DE, United Kingdom (“we”, “us”).

Contact for any question about your data: support@sportlicenseacademy.com.

Representative in the European Union (Article 27 GDPR): being appointed.

This policy is issued under Regulation (EU) 2016/679 (the “GDPR”), the GDPR as retained in United Kingdom law (the “UK GDPR”) together with the Data Protection Act 2018 and, where they apply, the data protection laws of your country of residence.

2. Data we process

Free account. When you create a free account, we collect your email address, your first name, your mobile number (with its country code) and, if you tick the box provided (never pre-ticked), your agreement to receive your training reminders and our offers by email and SMS (we keep the date, the wording you accepted and the channels it covers; consent given before 7 October 2026, under the “by email” wording, covers email only); a username is assigned to you automatically. No password is requested: a 6-digit code sent by email confirms your address. If you choose “Continue with Google”, Google sends us your name, your email address and your profile photo, which are kept by our authentication provider (Supabase). We only use your first name and your email address, and we never have access to your Google password. Google then acts as a separate controller, under its own privacy policy. These data are used to create and secure the account, to open the free version, to send you the messages relating to your account, to prevent multiple accounts (only one account per person) and, with your agreement, to send you your training reminders and our offers. The mobile number is also used for the security of connected devices. They are kept for the lifetime of the account, then for 3 years from the last contact for marketing purposes if you have consented to it. For accounts opened before 7 October 2026, we may also have recorded the password chosen (stored hashed) and the end date of a free trial (“Kick-off”).

a) Waiting list (where applicable)

First name, email address, mobile number, plan chosen, optional consent to receive our offers (box never pre-ticked) and date of the request.

b) Account

Username, login email address, password and, for accounts that have one, a recovery code. These codes are stored in hashed form: we never know them in plain text. The 6-digit codes sent by email (forgotten password, change of device) are also stored hashed and expire after 15 minutes. If you log in with Google: the technical identifier of your Google account and the information sent by Google (name, email address, profile photo).

c) Player card

Number, colours, team, club or nation chosen, occupation and motivation. This card is visible to other members in the leaderboard.

d) Registration questionnaire

Your expectations, the reasons for your choice and how you heard about Sport License Academy. These answers remain private.

e) Learning data

Answers to questions, progress, mock exam results, streaks.

f) Club and community

Chat messages, memes (photos, GIFs, videos of up to 15 MB), reactions and mentions.

g) Public profile and Network (optional)

Photo, title, status, city, bio, Instagram and LinkedIn accounts, email address and mobile number. Each field is displayed only if you choose so. Three modes are available:

hidden (default): nothing is displayed;
private: only your first name and your city are displayed;
public: the fields you have ticked are displayed.

In all cases, this information is visible only to logged-in members, never to the public or to search engines.

h) Security

Connected devices (device identifier, type, label, last activity), limited to two devices per account with only one in use at a time, in order to prevent account sharing; security log (logins, alerts, changes of device or password); hashed network fingerprint. Your IP address is never stored in plain text in our databases. When you log in, our authentication provider (Supabase) processes it to block abusive attempts; it only appears in its technical logs, which are kept for a limited period.

i) Notifications

If you enable them, your browser's notification subscription.

j) Payment and billing

Plan, amounts, payment status and technical identifiers assigned by our payment service provider. We never receive or store your card numbers.

k) Reports

Author of the report, content concerned and reason given.

l) The Sport License Academy assistant (sales page, blog, information pages)

The questions you ask the assistant and its answers, the page viewed, a random conversation identifier and a hashed network fingerprint used solely to limit abuse. You are not asked for any name or contact details: any email addresses and telephone numbers you enter are automatically masked before being recorded. The answers are generated by an artificial intelligence model and may contain errors.

If you ask to speak to the team from the assistant, your email address, your message and the current conversation are sent by email to our customer service, solely in order to reply to you.

l bis) AI coach in the application (students)

The questions you ask the coach and its answers, the extracts of the official texts and of the application's study sheets selected to answer them, the multiple-choice question concerned if you ask from an answer explanation, and a hashed identifier derived from your account, used solely to apply the daily question limit. No name or contact details are sent: any email addresses and telephone numbers entered are automatically masked before being recorded. The answers are generated by an artificial intelligence model, may contain errors and do not constitute legal advice.

l ter) Messages from the team (application and website)

A member of our team may write to you from our management tool: the message appears in your application (students) or in the website's help bubble during your visit (visitors). We record the messages exchanged and their date; for visitors, the random identifier of the current visit (the one used for the audience measurement described below), which is used solely to display the message in the right tab. You are not asked for any name or contact details, and you are free not to reply. When you reply, the team receives a notification and a copy of your message in the customer service mailbox.

m) Customer reviews

If you have bought a plan, you can leave a review from the application: a rating from 1 to 5 stars and a comment. We record the rating, the comment and its language, the country associated with your account if known, the plan purchased and the month of your first purchase, the dates of submission, editing and publication, the moderation decision (publication or rejection, with its reason) and any reply from our team. Once published, your review is visible to everyone, on our website and in the application, with your first name followed by the initial of your surname (or, failing that, your username), your country, the date of the review and the month of purchase; never your email address or your mobile number. About 7 days after your first purchase, we may send you a single email inviting you to leave a review; you can unsubscribe from that email. See the customer reviews policy.

n) Visit statistics and origin

To count our visits, without cookies: the page viewed and its title, the time, the domain name of the site you came from (for example google.com, without the full address), the origin of the visit (name of a campaign, “google-ads”, “instagram”, “direct”, etc.), the type of device (mobile, tablet, computer), the browser language, the time spent on the page, the steps taken during the visit (parts of the page viewed, answers to the demo questions, click towards the plan or the free test, sign-up form opened or started, account created) and a randomly generated visit identifier, kept in the tab and deleted when it is closed. Neither your IP address, nor your account, nor a persistent identifier is recorded with these statistics (see section 6).

We also record the city from which you are viewing the site, in order to see in real time where our visitors come from. It is derived from your connection by our host (Vercel) at the time of the visit. Your IP address is never stored, and the accuracy never goes beyond the city (coordinates rounded to about ten kilometres). As long as the tab remains open and visible, a signal sent every minute indicates that the visit is still in progress. If you go on to purchase, the step reached (payment window, payment page, successful payment) is recorded with this same anonymous visit, without any link to your account.

The origin of your visit is also kept for 30 days in your browser and, if you create an account or buy a plan, recorded with it, in order to know which campaigns and channels bring us students (the same mechanism as our campaign links).

For logged-in accounts, we count openings of the application (one per day and per device) in order to measure use of the service.

When you use the application while logged in to your account, your live presence is visible to the Sport License Academy administrator: your username, the city of your connection (derived by the host, never more precise than the city), the screen of the application that is open (for example the mock exam), the type of device and how long you have been connected. This information is used to monitor the service and to detect shared accounts, for example the same account used at the same time in two cities. It is automatically deleted 24 hours after your last visit, except the city and country of your last connection: they are kept with your account, visible to the administrator only (student list and profile), so that we know where our students come from, and deleted with your account. Your IP address is not stored. Legal basis: our legitimate interest (proper functioning of the service and protection of our content).

o) Emails to customer service (support@sportlicenseacademy.com)

Your email address, your name as it appears in the email, the subject and content of your messages, and our replies. Common questions (plan, payment, invoice, access) receive a reply written automatically by an artificial intelligence model, based on the information published on our site and, if your address matches an account, on the information of that account (username, plan, purchases, invoice links). Requests that commit Sport License Academy (refund, dispute, complaint, business proposal) are forwarded to a member of the team, who replies personally. The history of exchanges is accessible only to the customer service team.

3. Purposes, legal bases and retention periods

Purpose	Legal basis	Retention period
Processing your registration on a waiting list and notifying you when sales open	Pre-contractual measures taken at your request	3 years from the last contact if no purchase is made
Sending you your training reminders and our offers by email and SMS (box ticked at sign-up)	Consent, which can be withdrawn at any time (unsubscribe link in every email, reply “STOP” to an SMS, or a request to customer service)	Until consent is withdrawn, and no more than 3 years after the last contact
Creating and managing your account, providing the revision service (questions, progress, mock exams, leaderboard)	Performance of the contract	Lifetime of the account, then 12 months after its closure, before deletion or anonymisation
Operating the club and the community (chat, memes, reactions, mentions)	Performance of the contract	Lifetime of the account; authors can delete their memes at any time; content may be removed by moderation
Displaying the optional fields of your public profile / Network	Consent (choice of mode and fields), which can be changed at any time	Until changed or withdrawn, and no longer than the lifetime of the account
Sending push notifications	Consent, which can be withdrawn from the application or the browser	Until deactivated, and no longer than the lifetime of the account
Securing accounts, preventing fraud, limiting account sharing to two devices	Legitimate interest (security of the service and protection of our content)	Security log: 12 months
Improving the service (based on the registration questionnaire and internal statistics)	Legitimate interest	Lifetime of the account, then 12 months after its closure, before deletion or anonymisation
Answering visitors' questions with the AI assistant, improving our information pages and preventing abuse	Legitimate interest (informing visitors and security of the service)	90 days, then automatic deletion
Answering students' revision questions with the application's AI coach and applying the daily question limit	Performance of the contract	Conversations: 90 days, then automatic deletion; question counter: 60 days
Exchanging with you through messages from the team (application and website help bubble)	Performance of the contract for students; legitimate interest (replying to visitors and helping them choose a plan) for visitors	Students: 12 months; visitors: 30 days, then automatic deletion; copy in the customer service mailbox: 24 months after the last exchange
Replying to your emails to customer service (automatic replies to common questions, follow-up of requests by the team)	Performance of the contract for students; pre-contractual measures taken at your request or legitimate interest (replying to people who write to us) in other cases	24 months after the last exchange, then automatic deletion
Replying to a contact request forwarded from the assistant	Pre-contractual measures taken at your request	The time needed to handle the request, then no more than 3 years from the last contact
Measuring the effectiveness of our Google Ads adverts (knowing which advert led to a sign-up, a completed quiz, a click on payment or a purchase) and, if you accept, personalising adverts	Consent (cookie banner), which can be withdrawn at any time via “Manage my cookies”	Choice remembered for 6 months, then asked again; advertising cookies: no more than 13 months (see section 6)
Measuring the effectiveness of our adverts on Facebook and Instagram (Meta pixel: sign-up, completed quiz, click on payment, purchase) and showing you suitable Sport License Academy adverts on those services	Consent (cookie banner, “Meta ads” option), which can be withdrawn at any time via “Manage my cookies”	Choice remembered for 6 months, then asked again; `_fbp` and `_fbc` cookies: 90 days (see section 6)
Producing anonymous attendance statistics for the site and the application (visits, pages viewed, origin, city, devices, time spent, steps taken during the visit, visitors present at the moment and step reached towards payment)	Legitimate interest; audience measurement carried out without consent under the conditions described in section 6, with a right to object via “Manage my cookies”	Visit identifier: deleted when the tab is closed; statistics: 13 months, then automatic deletion
Knowing which campaign or channel (search engine, social network, advert) led to a sign-up or a purchase	Legitimate interest (measuring the effectiveness of our campaigns)	30 days in the browser; then with the account or the purchase concerned
Counting openings of the application by logged-in accounts (one per day and per device)	Legitimate interest (measuring use of the service in order to improve it)	13 months, then automatic deletion
Seeing in real time the students logged in to the application (username, city, screen open, device, since when), to monitor the service and detect shared accounts	Legitimate interest (proper functioning of the service and protection of our content)	24 hours after the last visit, then automatic deletion; city and country of the last connection: until the account is deleted
Inviting you to review Sport License Academy, only once, by email and in the application, about 7 days after your first purchase	Legitimate interest (collecting genuine reviews from all our buyers); you can unsubscribe from the email	A single email; the record that it was sent is kept for the life of the account
Verifying the purchase, moderating and publishing buyers' reviews on our website and in the application, and replying to them	Consent for publication (voluntary submission of the review, which can be withdrawn at any time by withdrawing the review); legitimate interest for verification and moderation (authenticity of reviews)	Published review: until it is withdrawn, and for no more than 3 years after its publication; rejected review: 1 year after the decision; in all cases, deleted with the account
Handling reports and moderating content	Performance of the contract and legal obligations (Regulation (EU) 2022/2065)	12 months after the report has been handled
Collecting payments, issuing invoices, keeping accounts	Performance of the contract and legal obligation	10 years (accounting and tax obligations)
Establishing, exercising or defending our legal rights	Legitimate interest	Duration of the applicable limitation period

Where providing data is necessary to create the account or to conclude the contract, the form says so. Without it, we cannot give you access to the service. No decision producing legal effects concerning you is taken solely on the basis of automated processing.

4. Recipients and processors

Your data are accessible only to authorised Sport License Academy personnel and to our technical providers, to the extent necessary for their tasks:

Vercel Inc. (United States): hosting of the site and the application; at the time of the visit, Vercel also derives the approximate city from the connection, the only location information passed on to us;
Supabase Inc.: database, file storage and authentication, in the region to be specified shortly;
Stripe Payments Europe, Ltd. (Ireland): payment processing. Your card details are entered directly with Stripe and never pass through our servers. For its own obligations (fraud prevention, tax and regulatory obligations), it acts as a separate controller, under its own privacy policy.
Hostinger International Ltd (Cyprus): sending and receiving emails (account-related messages, reminders, messages received and customer service replies) on our address support@sportlicenseacademy.com;
Google Ireland Limited (Ireland) and Google LLC (United States): measurement of Google Ads advertising conversions, only if you have accepted it in the cookie banner. For these cookies, Google acts as a separate controller, under its own privacy rules.
Meta Platforms Ireland Limited (Ireland) and Meta Platforms, Inc. (United States): measurement of Facebook and Instagram advertising conversions (Meta pixel), only if you have accepted it in the cookie banner. For the collection and transmission of these data, Sport License Academy and Meta Platforms Ireland Limited are joint controllers (Article 26 GDPR); Meta then processes the data as a separate controller, under its own privacy policy (facebook.com/privacy/policy).
Anthropic, PBC (United States): generation of the answers of the Sport License Academy assistant and of the application's AI coach from the questions asked, and of the automatic replies to emails received by customer service. In accordance with its commercial terms, the data sent are not used to train its models.

Other members only see the information described above as visible (player card, content published in the community, profile fields you have chosen to display).

Your data are never sold or rented. They may be disclosed to the authorities where required by law.

5. Transfers outside the European Union and the United Kingdom

Hosting by Vercel Inc., the assistant and the AI coach provided by Anthropic, PBC and, if you have accepted it, advertising measurement by Google LLC and Meta Platforms, Inc. involve transfers to the United States. They are governed by the EU–US Data Privacy Framework and its UK extension and/or by the European Commission's standard contractual clauses (and the corresponding UK addendum).

The data managed by Supabase are hosted in the region to be specified shortly. If this region is located outside the European Union, transfers are governed by standard contractual clauses.

If you live outside the European Union and the United Kingdom, your data are transferred to and processed in the United Kingdom, the European Union and the United States, with the safeguards described above.

You can obtain a copy of the applicable safeguards by writing to us.

6. Cookies and local storage

Sport License Academy uses no third-party audience measurement tool (no Google Analytics): we produce our own visit statistics, which are anonymous and cookie-free (see below). Fonts are hosted on our own servers: no third-party service is called when pages are displayed. The only possible third-party trackers are the Google Ads tag and the Meta pixel described below, each only if you accept it.

Storage necessary for operation

The application uses your browser's local storage in order to work: keeping your session open, progress, settings and offline mode. On the sales page, the blog and the information pages, the conversation with the assistant is kept in the tab (session storage) for the duration of your visit, then deleted when the tab is closed; the same applies to the conversation with the AI coach in the application. Your cookie choice is also kept in local storage (with its date, as proof of your choice). This information is strictly necessary to provide the service you have requested: it is therefore exempt from consent (Article 5(3) of Directive 2002/58/EC, as transposed in each Member State of the European Union; regulation 6 of the Privacy and Electronic Communications Regulations 2003 in the United Kingdom).

Anonymous visit statistics (cookie-free, with a right to object)

Purpose: solely to produce attendance statistics for our own use (number of visits, most viewed pages, origin of visitors, city, type of device, time spent, share of visitors who left after a single page, steps taken during the visit, visitors present at the moment and step reached towards payment), in order to improve the site. They are not used for advertising or to track you on other sites, and they are never cross-referenced with your account or with other processing.
How it works: no cookie is placed. A randomly generated visit identifier is kept in the tab's storage (sessionStorage): it disappears when the tab is closed and is renewed after 30 minutes of inactivity. Your IP address is not recorded, and of the site you came from, only the domain name is kept. The city is derived from your connection by our host at the time of the visit, never more precise than the city. As long as the tab is open and visible, a signal is sent every minute to indicate that the visit is in progress.
Legal basis: our legitimate interest in knowing how our site is visited. This audience measurement is designed to meet the conditions for audience measurement exempt from consent set by the French data protection authority (CNIL): strictly statistical purpose, anonymous data, no cross-referencing, limited retention periods.
Recipients: Sport License Academy only; the data are hosted by Supabase Inc. (see section 4).
Retention: visit data are automatically deleted after 13 months; only totals without any identifier may be kept beyond that.
Objecting: at any time, with the “Don't count me in the statistics” option: stop being counted (also available via Manage my cookies › Customise). Your choice is kept in your browser: nothing more is then sent, neither page, nor city, nor presence signal. Robots and automated browsers are not counted.

Google Ads advertising cookies (with your consent)

On your first visit, a banner offers you the choice to accept, refuse or customise advertising cookies. Refusing is as easy as accepting, and the site works in the same way in both cases.

Purpose: measuring the effectiveness of our Google Ads adverts, that is to say knowing whether a person who arrived via an advert then created an account, completed the quiz, clicked to pay or bought the plan (with the amount of the plan), so that we spend our advertising budget wisely. If you also enable the “Ad personalisation” option, Google may use this information to show you suitable Sport License Academy adverts.
Legal basis: your consent (Article 5(3) of Directive 2002/58/EC and the corresponding national rules; Article 6(1)(a) GDPR). Without your consent, the Google tag is not loaded at all and no information is sent to Google.
Cookies concerned: _gcl_au, _gcl_aw (on sportlicenseacademy.com) and Google's advertising cookies on the google.com and doubleclick.net domains.
Recipients: Google Ireland Limited and Google LLC. The transfer to the United States is governed by the EU–US Data Privacy Framework.
Duration: no more than 13 months for the cookies; your choice is remembered for 6 months, after which the banner is shown to you again.
Withdrawing or changing your choice: at any time, using the Manage my cookies link at the bottom of each page (and, in the application, in the legal documents section). Withdrawing is as easy as consenting: the Google Ads cookies placed on our domain are then deleted.

Meta pixel: Facebook and Instagram (with your consent)

Purpose: knowing whether a person who arrived via one of our Facebook or Instagram adverts then created an account, completed the quiz, clicked to pay or bought the plan (with the amount of the plan), and allowing Meta to show you suitable Sport License Academy adverts.
Legal basis: your consent, given with the “Meta ads” option of the banner, which is independent of the Google choice (Article 5(3) of Directive 2002/58/EC and the corresponding national rules; Article 6(1)(a) GDPR). Without your consent, the pixel is not loaded at all and no information is sent to Meta.
Data sent: the pages visited, the event concerned and its amount, as well as technical information (IP address, browser, Meta cookie identifiers). When you make a purchase, our servers also confirm the purchase directly to Meta (Conversions API) with the plan, the amount, the same technical information, and your email address and account identifier in hashed form (irreversibly transformed into a SHA-256 fingerprint, which only allows the purchase to be matched with an existing Meta account). This is only sent if you have accepted the “Meta ads” option. No name or telephone number is sent.
Cookies concerned: _fbp and _fbc (on sportlicenseacademy.com) and Meta's cookies on the facebook.com domain if you are logged in to it.
Recipients: Meta Platforms Ireland Limited and Meta Platforms, Inc. The transfer to the United States is governed by the EU–US Data Privacy Framework.
Duration: 90 days for _fbp and _fbc; your choice is remembered for 6 months, after which the banner is shown to you again.
Withdrawing or changing your choice: using the Manage my cookies link; the Meta cookies placed on our domain are then deleted.

You can also delete local storage and cookies at any time from your browser settings; you will then need to log in again, and data not yet synchronised may be lost.

7. Security

We implement appropriate technical and organisational measures: encryption of exchanges (HTTPS), hashing of access and recovery codes, hashing of the network fingerprint, access control to data, limitation of the number of devices and a security log. As no system is infallible, we invite you to keep your password confidential.

8. Minors

The service is intended for adults. By way of exception, a minor aged 16 or over may use it with the permission of their parent or legal guardian, who takes responsibility for that use. If you notice that a minor has sent us data without this permission, please write to us so that we can delete them.

9. Your rights

You have the following rights over your data:

access: obtain confirmation that we process your data and receive a copy of them;
rectification of inaccurate or incomplete data;
erasure, in the cases provided for by law;
restriction of processing;
portability: receive the data you have provided to us in a structured, machine-readable format;
objection to processing based on our legitimate interest, on grounds relating to your particular situation, and, at any time and without giving reasons, to direct marketing;
withdrawal of your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;
where the law of your country provides for it (for example in France), the right to give instructions regarding what happens to your data after your death.

How to exercise them

Write to us at support@sportlicenseacademy.com, from the address or with the username associated with your account. We may ask you for information to verify your identity if we have reasonable doubts. We reply within one month, which may be extended by two months for complex or numerous requests; you will be informed if this is the case.

Account deletion: you can request the deletion of your account at any time by contacting support from the application or by email. Only the data that the law requires us to keep (billing) are then archived for the legal period.

Unsubscribing: every marketing email contains an unsubscribe link, and you can reply “STOP” to any marketing SMS.

Complaints

If you consider that your rights have not been respected, you can lodge a complaint with the UK Information Commissioner's Office (ICO, ico.org.uk), with the supervisory authority of the European Union Member State in which you live or work (for example the AEPD in Spain, aepd.es, or the CNIL in France, cnil.fr) or, if you live elsewhere, with the data protection authority of your country. We invite you to contact us first so that we can try to resolve the matter.

10. Changes

We may change this policy, in particular in the event of a new feature or a change in the regulations. In the event of a significant change, we will inform you in the application or by email before it takes effect. The date of the last update appears at the top of this page.