At-a-glance commitments Lyvboard does not sell Student Data or children’s personal information, use those data for targeted advertising or unrelated commercial profiling, or publicly disclose a minor’s information or media without recorded Parent authorization and Organization approval. Lyvboard’s launch model permits under-13 use only in a documented school-directed environment. Direct under-13 accounts, automated subscription payments, coaching payments, and marketplace payments are not active.
This Privacy Policy and Children's Privacy Notice (this “Policy”) explains how Lyvboard, Inc. (“Lyvboard,” “we,” “us,” or “our”) collects, uses, discloses, protects, retains, and deletes personal information through Lyvboard's websites, applications, and athletics-management platform (the “Services”). It also explains how Lyvboard handles information about students and children, including children under 13.
This Policy should be read with the Multi-Role Terms of Service, any Student Data Protection Addendum (“DPA”), the applicable school's or organization's notices, and any Parent or Guardian Consent and Media Authorization. Where a DPA or mandatory law provides greater protection for Student Data, that protection controls.
1. Scope and Data Roles
1.1 Organization-controlled Student Data. When a school, school district, club, league, or other organization (an “Organization”) uses Lyvboard to manage students or participants, Lyvboard generally processes the information submitted or generated for that Organization on the Organization's behalf and under its instructions. The Organization determines the educational or team-management purpose, authorized Users, and access decisions. Lyvboard acts as a restricted service provider, contractor, or school official only to the extent stated in the DPA and applicable law.
1.2 Direct account information. When an adult creates or administers an account, contacts Lyvboard, or provides information for Lyvboard’s own account administration, support, security, or legal compliance, Lyvboard determines the purposes described in this Policy. Parent Accounts used at launch are linked through an Organization’s roster and approval process and receive only Parent-visible information for the linked child. That linkage does not convert Organization-controlled Student Data into Direct Account Data or independently verify legal guardianship. Lyvboard does not currently permit a direct account for a child under 13, and automated billing is not active.
1.3 Mixed data. Information linked to an Organization and a Parent Account remains subject to the DPA and the Organization’s lawful instructions to the extent it is Student Data. Lyvboard applies this Policy to adult account administration and other Direct Account Data. A roster match, team approval, or Parent acceptance does not transfer ownership, create a new consumer-data basis, or authorize a use or disclosure that the Organization or law prohibits.
1.4 Outside scope. This Policy does not govern a third-party website, social network, recruiting site, payment processor, or service that independently determines how it uses information. A provider engaged by Lyvboard to process data for the Services is a subprocessor and remains subject to Lyvboard's contractual and legal responsibilities.
2. Information We Collect
| Category | Illustrative data | Typical status |
|---|
| Adult, account, and role information | First and last name, email, password/authentication credentials, selected role, account identifiers, team code or invitation token, Organization, title, account status, and support communications | Adult, Organization, or Student Data depending on the account and context |
| Authentication, device, and security | Session metadata, IP-derived identifiers, device/browser information, login and recovery events, rate-limit records, audit events, error reports, and bounded account-scoped browser caches and preferences | Operational/security data; Student Data when linked to a student |
| Organization and team information | School, organization, team, sport, mascot, colors, logos, roster status, and team level | Organization data and Student Data |
| Student roster and athletics identity | Student or display name, Parent linkage, jersey number, position, graduation year, depth-chart information, and other roster fields | Student Data; public use separately restricted |
| Playbooks and team operations | Playbooks, formations, concepts, assignments, diagrams, notes, tags, shifts, routes, revisions, practice plans, scout scripts, opponents, schedules, locations, and game information | Customer Data and Student Data |
| Communications | Messages, announcements, polls, reactions, attachments, recipients, timestamps, delivery status, and read state | Customer Data or Student Data; subject to safeguarding and retention controls |
| Learning | Learning materials, quizzes, answers, correctness, scores, attempts, progress, and response time | Student Data |
| Weightroom and performance | Assignments, exercises, sets, repetitions, weight, results, notes, sport statistics, measurements, goals, progress, and Coach observations | Student Data; not medical advice and no medical records authorized |
| Equipment | Equipment assignments, condition, size, identifiers, value, and transaction history | Customer Data and Student Data |
| Media and recruiting | Recruiting profiles, statistics, achievements, film, photographs, video, social links, measurements, Coach contact information, uploaded documents, team logos, and avatars | User Content and Student Data; minor content private unless separately authorized |
| Notifications | Notification preferences, email-delivery status, device push tokens, and related delivery metadata | Account and Student Data depending on recipient |
| Consent and authority records | Age-routing result, school authorization, Parent/student relationship record, notice and document versions, media selections, approvals, revocations, timestamps, and audit evidence | Compliance and authorization records |
| Billing and payments | No payment-card data are currently processed. Future adult or Organization billing may include plan, invoice, transaction, refund, and processor identifiers after separate activation. | Not active at launch; adult or Organization data only if enabled |
2.1 Data minimization and prohibited categories. Lyvboard does not intentionally collect Social Security numbers, government identifiers, financial-account data, payment-card data, home addresses, medical information or diagnoses, discipline records, or unrelated demographic information through the current Services. Those categories are not authorized by the current launch scope or DPA. Any future collection requires a documented purpose, minimum necessary fields, security and retention controls, an amended data schedule, and separate legal review before activation.
2.2 Required and optional fields. Player signup requests birth month and year before other Student-Athlete profile information. The server-side signup function calculates and retains the applicable age band; the entered birth month and year are not intended to remain in long-lived account metadata. New Google/OAuth account creation is blocked for this pathway, and role, URL, API, browser-storage, or session changes must not bypass server checks. For an Organization associated with a school, Player and Parent registration must remain blocked until Lyvboard records formal school or district authorization and expressly activates that Organization for the relevant account types.
2.3 Inferences and excluded technologies. Lyvboard may derive limited operational information, such as account role, feature eligibility, team relationship, or security risk. Lyvboard does not create unrelated advertising, credit, insurance, employment, or commercial profiles from Student Data or children’s personal information. The current launch scope does not authorize continuous or background precise geolocation, biometric identifiers or templates, facial recognition, detailed medical data, or general-purpose AI analysis of identifiable Student Data or minor media.
3. Sources of Information
- Adults, Parents, Student-Athletes, Coaches, Administrators, and other Users who enter or upload information.
- Organizations that create rosters, invite Users, configure accounts, or transmit data through approved integrations.
- Other authorized Users, such as a Parent linking a child, a Coach recording team activity, or a User sending a message.
- The User's browser, device, network, and interaction with the Services.
- Service providers supporting hosting, authentication, communications, security, analytics, support, and payments.
- Third-party integrations enabled by an authorized adult or Organization.
- Public sources only when a feature expressly permits and the collection is lawful and appropriate for minors; Lyvboard does not routinely scrape public student profiles for commercial enrichment.
4. Purposes of Collection and Use
4.1 Provide the Services. Lyvboard uses information to create and authenticate accounts; manage schools, organizations, rosters, teams, schedules, locations, playbooks, practices, scout materials, learning content, quizzes, communications, weightroom and performance records, equipment, media, and authorized recruiting profiles; provide notifications and support; maintain audit and security functions; and provide exports and deletion workflows.
4.2 Organization instructions. For Student Data, Lyvboard uses information only to perform the services and purposes documented by the Organization, provide support, secure the Services, comply with law, and perform other uses permitted by the DPA. Lyvboard does not independently expand an Organization's educational or team-management purpose.
4.3 Authority and permissions. Lyvboard uses age, relationship, school-authorization, account-approval, and consent records to route Users, apply role- and age-based permissions, administer Parent-visible access, manage media selections, and honor withdrawals. At launch, under-13 use is available only through a documented school-directed pathway; Lyvboard does not use an ordinary checkbox or team code as direct verifiable parental consent.
4.4 Safety, security, and integrity. Lyvboard uses information to prevent fraud and abuse; detect and investigate unauthorized access; moderate prohibited content; protect children and Users; troubleshoot; maintain logs and backups; and enforce applicable agreements.
4.5 Support and communications. Lyvboard uses contact and account information to answer requests, deliver transaction and security notices, communicate feature or policy changes, and send marketing only to eligible adults under applicable consent and opt-out rules.
4.6 Billing and administration. Lyvboard uses adult and Organization information to administer plans, invoices, renewals, cancellations, taxes, refunds, chargebacks, and accounting. A child is not responsible for payment.
4.7 Improve the Services. Lyvboard may analyze service telemetry and appropriately de-identified or aggregated information to improve reliability, accessibility, security, and features. Lyvboard does not use identifiable Student Data or children's personal information to train a general-purpose artificial-intelligence model or create an unrelated commercial product.
4.8 Legal compliance. Lyvboard may use and preserve information to comply with legal obligations, respond to lawful process, establish or defend legal claims, protect rights and safety, and document compliance, subject to the DPA and applicable notice restrictions.
5. Disclosure of Information
5.1 Organizations and authorized Users. Lyvboard discloses information within the applicable Organization or linked family only according to role, team, Parent, and feature permissions. An Organization may access Organization-controlled messages, roster records, and other Student Data as permitted by law and policy.
5.2 Service providers and current vendor status. Supabase is enabled for database, authentication, storage, realtime, and Edge Functions and may process account, Organization, Student Data, files, and application records. Netlify is enabled for web hosting, deployment, and server functions. Resend is enabled for transactional and operational email. Sentry is enabled for redacted technical error monitoring; it is not intended to receive tokens, messages, Student Data, or sensitive request bodies. Geoapify is enabled for school and general-location lookup and is not intended to receive student names, home addresses, or student records. Google Cloud/Gemini is enabled only for Coach-controlled play imports and diagram processing and is not available to Player accounts or approved for identifiable Student Data or minor media. Upstash Redis is enabled for rate limiting and abuse prevention using pseudonymous actor/IP-derived keys, counters, and expiry values. Expo Push, Twilio, and Stripe are disabled at initial launch. Social embeds are click-to-load only; no provider request should occur before the intentional click. Processing regions, contractual terms, provider retention/deletion, backup behavior, and final external-library inventory must be documented before Player or Parent launch or district delivery.
5.3 User-directed recipients and public destinations. An authorized adult or Organization may direct Lyvboard to disclose information to an approved integration, recruiter, public recruiting profile, social platform, or other recipient. YouTube, Instagram, TikTok, X, or similar services may receive ordinary browser or request information if user-selected content is embedded or opened. A Student-Athlete or Coach may propose content, but a minor profile or media may not be made public without recorded Parent authorization and Organization approval. Once information reaches an independent recipient, that recipient’s terms and privacy practices may apply.
5.4 Legal and safety disclosures. Lyvboard may disclose information when reasonably necessary to comply with law or lawful process; protect a child or other person from serious harm; investigate security, abuse, fraud, or illegal activity; enforce agreements; or protect rights and property. Lyvboard will notify the applicable Organization or adult when permitted and appropriate.
5.5 Corporate transactions. Lyvboard may disclose information in diligence for a financing, merger, acquisition, reorganization, or sale, subject to confidentiality, data-minimization, and applicable Student Data restrictions. A successor must assume applicable privacy and DPA obligations, and Lyvboard will provide any notice or choice required by law or contract.
5.6 De-identified information. Lyvboard may disclose information that has been de-identified or aggregated so it cannot reasonably identify a student or individual under the applicable standard. Recipients may not re-identify it.
6. No Sale, Targeted Advertising, or Unauthorized Commercialization
6.1 No sale. Lyvboard does not sell Student Data or children's personal information for money or other valuable consideration. Lyvboard does not disclose those data in exchange for cross-context behavioral advertising or data-broker enrichment.
6.2 No targeted advertising. Lyvboard does not use Student Data, child personal information, or information gathered through school-authorized use to target advertisements to a student, Parent, or household. Lyvboard does not allow third-party advertising pixels or software development kits in child-directed or authenticated Student Data areas.
6.3 No unrelated profiles. Lyvboard does not use Student Data to create a profile for a purpose unrelated to the authorized school or athletics service, including credit, insurance, employment, housing, or unrelated commercial eligibility decisions.
6.4 No unauthorized monetization. Lyvboard does not license Student Data, public minor media, or child profiles for endorsements, commercial datasets, biometric identification, facial recognition, or general-purpose AI training. A future commercial use would require separate legal review and, where permitted at all, specific authorization.
7. Public Profiles, Media, and Recruiting
7.1 Private default. Minor recruiting profiles and media are private by default. Player or Coach selections are proposals only and cannot themselves authorize publication. Public profiles for children under 13 are disabled initially. For an eligible older minor, the live product may publish only after the required Parent/guardian authorization and Organization approval records are present and identify the approved fields or media, audience, purpose, effective period, and withdrawal status.
7.2 Required authorization. A minor’s public recruiting profile or media may be enabled only after Lyvboard records the applicable Parent authorization and Organization approval. The record must identify the selected content, audience and purpose, public fields, duration, and withdrawal method. A Player or Coach selection, team code, school authorization for core services, directory-information designation, or Terms acceptance is not sufficient.
7.3 Data minimization for public profiles. Public pages should avoid home address, personal phone, private email, precise routine location, full date of birth, medical information, school schedule, or other information that creates an unnecessary safety risk. Contact should be routed through an adult or Organization-approved channel.
7.4 Search and redistribution. Information intentionally made public may be indexed, copied, downloaded, or redistributed by third parties. Lyvboard will unpublish content after a valid withdrawal or account instruction within the operational period stated below, but cannot guarantee deletion from third-party caches, screenshots, downloads, or independent recipients.
7.5 Advertising, trade use, and endorsement. Lyvboard does not use a student's name, portrait, picture, voice, or likeness in Lyvboard advertising, sales, case-study, investor, fundraising, or other trade materials without a separate written Commercial Publicity Consent from the Parent or guardian and any additional consent of the minor required by applicable law. That consent is separate from a platform visibility setting, school authorization, and directory-information designation. A media authorization does not permit Lyvboard or another party to imply a student's endorsement, sell or license the media to an independent third party, materially alter it in a misleading way, perform biometric identification or facial recognition, generate synthetic or AI-created media resembling the student, or use it for a new advertising purpose without a new, specific written authorization.
8. Cookies, Analytics, and Similar Technology
8.1 Strictly necessary technology. Lyvboard may use cookies, local storage, and similar technology required for authentication, security, session continuity, preferences, load balancing, and core functionality.
8.2 Limited analytics. Lyvboard may use first-party or contracted analytics to understand reliability and feature use. In authenticated student or child areas, analytics must be configured to minimize identifiers, avoid advertising uses, restrict retention, and prohibit cross-service tracking or independent provider use.
8.3 No advertising technology in child areas. Lyvboard does not deploy behavioral advertising cookies, retargeting pixels, or advertising SDKs in child-directed or authenticated Student Data portions of the Services. The public marketing site must be separately scanned and configured before this statement is published.
8.4 Controls and opt-out preference signals. Browser controls may block some technology but can impair the Services. Where law requires consent for nonessential technology, Lyvboard will present the required choice before activating it. Where applicable law requires recognition of a legally valid opt-out preference signal, Lyvboard will treat a frictionless signal, such as Global Privacy Control, as a request to opt out of sale, sharing, or targeted advertising for the associated browser or device without requiring an additional step. Lyvboard does not sell personal information or use Student Data for targeted advertising. An opt-out signal does not restrict processing necessary to provide, secure, or administer the Services or processing that applicable law excludes from the opt-out right.
9. Payments and Billing
9.1 Current status. Lyvboard does not have an active Stripe integration or automated checkout during the current free Coach-only evaluation period. The contemplated initial paid use is an institutional school or district subscription purchased by an authorized representative. No Parent, Coach, Student-Athlete, coaching-service, marketplace, or transaction-payment flow is included at initial launch. Any future payment functionality requires an updated Policy and separate review of the live processor, checkout, renewal, cancellation, refund, PCI, and data flows before activation.
9.2 Future processor and card data. If payments are later enabled, Lyvboard expects to use Stripe or another identified processor with hosted or tokenized components so that full payment-card numbers and card security codes are submitted directly to the processor rather than Lyvboard. This statement must be validated against the live integration before publication of a payment-enabled Policy.
9.3 No minor billing. A minor may not provide payment information or authorize a purchase. Billing records are associated with the responsible adult or Organization and are not used for student advertising or unrelated profiling.
9.4 Future billing retention. No payment tokens, invoices, automated-renewal records, refunds, or chargeback records are generated by an active platform payment flow today. If payment processing is activated, Lyvboard will state and implement the retention periods for adult or Organization billing, tax, accounting, dispute, and processor records and will not associate those records with a child for advertising or unrelated profiling.
10. Student Data and FERPA
10.1 School-official arrangement. Where an Organization determines that Lyvboard receives education records under the school-official exception, the Organization must designate Lyvboard as performing an institutional service for which the Organization would otherwise use employees, establish that Lyvboard is under the Organization's direct control regarding use and maintenance of the records, and limit use and redisclosure to the authorized purpose. The DPA documents those controls.
10.2 Organization control. The Organization determines authorized Users and lawful instructions regarding Student Data. Parent and eligible-student access to education records ordinarily occurs through the Organization's FERPA process, although Lyvboard will provide reasonable technical assistance and direct-account rights where applicable.
10.3 Use and redisclosure. Lyvboard uses and rediscloses Student Data only for the purpose for which the Organization disclosed it, as permitted by the DPA and law. A subprocessor must be under equivalent restrictions. Lyvboard does not claim independent ownership of education records.
10.4 Access and correction. Lyvboard will provide Organization Administrators with available tools to access and correct Student Data or will assist the Organization with a verified request. Lyvboard will not resolve disputes over the substantive accuracy of a school record without the Organization's instruction.
10.5 End of service. Upon the Organization's verified instruction or termination, Lyvboard will return, export, delete, or de-identify Student Data as stated in the DPA, subject to limited legal holds, security logs, and backups. Student Data retained in a backup remains protected and is not restored to active use except for disaster recovery or legal necessity.
11. Children's Privacy Notice: Children Under 13
Direct notice to Parents At launch, Lyvboard permits a child under 13 to use the Services only in a documented school-directed environment authorized by an eligible school or district. Lyvboard does not permit an independent direct under-13 account. Form 1 and the direct VPC provisions are reserved for a future pathway and may not be activated without an updated notice, verified Parent relationship, approved VPC method, and stronger step-up method for public or other non-integral disclosure.
11.1 Operator. The operator is Lyvboard, Inc., 11357 Nuckols Road, Suite 103, Glen Allen, Virginia 23059. Questions and Parent requests should be sent to privacy@lyvboard.com. The final published notice must list every operator collecting or maintaining children's information if more than one operator is required to be listed.
11.2 Information from children. In an authorized school-directed pathway, Lyvboard may collect the categories listed in Section 2 that the Organization has enabled for the documented educational or athletics-administration purpose, including roster and team data, learning and playbook records, communications, weightroom and performance information, equipment, media, recruiting content, and operational identifiers. The current scope does not authorize Social Security numbers, government identifiers, home addresses, medical information or diagnoses, discipline records, financial-account data, full payment-card data, continuous precise geolocation, biometric identifiers, or facial-recognition templates.
11.3 How information is collected. Information may be entered by the child after authorization, provided by a Parent, supplied by an Organization or Coach, generated through use of the Services, or received from an approved integration. Lyvboard may use persistent identifiers for internal operations such as authentication, security, session continuity, and service analytics configured under this Policy.
11.4 Uses. Lyvboard uses the child's information to provide the authorized roster, team, schedule, playbook, messaging, performance, equipment, media, recruiting, support, safety, security, and compliance functions; to maintain consent and access records; and to respond to lawful Organization and Parent requests. Lyvboard does not use it for targeted advertising, unrelated profiling, sale, or general-purpose AI training.
11.5 Disclosure. Lyvboard may disclose the child's information to the authorizing Organization and its authorized Users; the child's verified Parent; service providers that support the Services under written restrictions; recipients specifically directed by an authorized adult; and legal or safety authorities where permitted. Lyvboard does not publicly disclose a child's personal information or media without separate Parent authorization and any required Organization approval.
11.6 School authorization. An eligible school or district may authorize collection from an under-13 student only for a documented school-directed educational context. Lyvboard requires a written DPA/NDPA, pilot agreement, Order, or equivalent approval from an authorized representative identifying the approving entity and representative, covered team or roster, permitted uses, and effective period. Existing Coach-only evaluations do not satisfy this requirement and their team codes may not enable Player or Parent accounts. Lyvboard will not use school authorization for public media, advertising, unrelated commercialization, or a purpose outside the approved school context.
11.7 Reserved future direct-consent pathway. Lyvboard has not selected or implemented a direct verifiable-parental-consent method and does not permit an under-13 child to create a direct account outside an authorized school environment. Before any future direct pathway is enabled, Lyvboard must provide the required direct notice, verify the Parent relationship, select and test a VPC method reasonably calculated to identify the Parent, and implement a stronger step-up method before any public, recruiting, or other non-integral disclosure. An ordinary checkbox, child email, team code, or unverified Parent name is not VPC.
11.8 Separate consent for disclosure. When a feature would disclose a child's personal information to the public or to an independent third party and the disclosure is not integral to the activity for which the Parent previously consented, Lyvboard will obtain a separate, specific Parent consent. A Parent may consent to collection and use without consenting to public disclosure.
11.9 Parent choices. A verified Parent may review the child's personal information, request correction or deletion, refuse further collection or use, revoke consent, and authorize or decline selected public-disclosure features. Withdrawal may disable the child's direct account or affected feature. Lyvboard will not condition participation on broader disclosure than reasonably necessary.
11.10 Consent renewal. Lyvboard may request renewed consent if the data categories, purpose, recipients, disclosure practice, verification method, or feature materially changes; if the child joins a new Organization; or if Lyvboard cannot verify that an existing consent remains valid.
11.11 Provisional records. The launch flow should not create a direct under-13 provisional account. Before school authorization is matched, Lyvboard may retain only the minimum age-routing, team-routing, and security information needed to complete or reject the school-directed pathway. Any future direct VPC flow must state and implement a short provisional-record deletion period before activation.
12. Users Ages 13–17
12.1 Parent and Organization control. A User under 18 may access only functions authorized by the Organization and Parent. The Parent is the contracting adult for direct accounts, purchases, public media, and material privacy choices unless applicable law permits the minor to make a particular decision.
12.2 Age-appropriate design. Lyvboard will apply age-appropriate defaults and notices, minimize public exposure, and avoid manipulative design that pressures a minor to disclose information, enable publicity, or make purchases.
12.3 Transition and conversion. When a User reaches 18, Lyvboard may require the User to confirm account information and directly accept applicable adult terms. Reaching adulthood, graduation, transfer, departure from a team, or termination of an Organization relationship does not automatically transfer an Organization's education records or convert Student Data into Direct Account Data. A lawful conversion requires an affirmative request by the Parent or adult Student-Athlete, a new direct notice and acceptance or consent event, and a new legal-basis record. Prior school permissions, media authorizations, public settings, and commercial-use consents do not carry over automatically.
13. Retention and Deletion
Lyvboard retains personal information only as long as reasonably necessary for the authorized purpose, the Organization relationship, a documented security or legal need, or a valid instruction. The following schedule incorporates the periods and workflows confirmed by Lyvboard. Items identified as “to be confirmed” must be completed against the production database, backups, logs, and district requirements before publication or execution:
| Record category | Current or intended retention / action | Conditions and remaining confirmation |
|---|
| Active Organization and team data | Stored during the active Organization relationship; active Student Data targeted for deletion within 30 days after termination or a verified deletion request. | Subject to documented legal, safety, investigation, or dispute holds; school-request timing may be shorter under an applicable state supplement. |
| Removed User access | Access should end immediately when the User is removed from the Organization or team | Underlying Organization records remain subject to the Organization’s retention and deletion instructions |
| Individual account deletion | Separate from full school or Organization deletion | Verification, completion timing, and interaction with linked Student Data must be finalized |
| Media-processing and job records | 30 days after processing completes. | Applies to job status, timestamps, errors, and technical metadata, not automatically the underlying media. |
| Messages and team content | During the active account/Organization term; delete active copies within 30 days after termination or a verified deletion request. | Documented legal, safety, investigation, or dispute holds may require limited retention. |
| Audit, security, fraud-prevention, legal, and contractual records | Ordinary security/access/application/Sentry logs: target one year. Higher-level incident, fraud, and contract records: up to seven years after the relevant matter or relationship ends. | Minimize Student Data, message content, secrets, and sensitive media in logs; extend only for documented legal/investigation needs. |
| Backups | Maximum target of 90 days after active deletion. | Subject to documented legal or safety holds; provider region, backup/PITR configuration, rotation, and restoration testing must be verified. |
| Aggregated or genuinely de-identified information | May be retained after it can no longer reasonably identify an individual or school | No re-identification or use that recreates identifiable Student Data |
| Payment and billing records | No active platform payment records at launch | Add a retention schedule before payment functionality is enabled |
| Consent and school-authority evidence | Up to seven years after the applicable relationship or authorization ends. | Retain minimized evidence of notice, acceptance, authority, versions, approvals, and withdrawal—not underlying Student Data solely for evidentiary convenience. |
13.1 Deletion method. Lyvboard will use reasonable methods designed to render data unreadable or unrecoverable in active systems and will require processors to follow applicable deletion instructions. Where immediate backup deletion is not feasible, the data remain protected and are deleted through the ordinary rotation.
13.2 Legal holds and exceptions. Lyvboard may retain limited information necessary for legal compliance, security, fraud prevention, dispute resolution, consent evidence, or an active legal hold. Retained information remains subject to use restrictions and is not used for advertising, profiling, or unrelated product development.
13.3 Organization requests. An Organization should submit Student Data export or deletion instructions through an authenticated Administrator or designated privacy official. Full Organization deletion requires authority verification, review and preview of the affected data, explicit confirmation, and any requested export opportunity. Removing a User is a separate access action and does not itself delete Organization records. Lyvboard may preserve narrowly limited records for a documented legal, security, fraud-prevention, or contractual reason.
14. Security and Incident Response
14.1 Current program and remaining confirmations. Lyvboard is founder-operated. Gavin Nomberg is the current internal security owner and incident coordinator. The selected policy requires MFA for internal privileged accounts controlling production, source code, cloud services, email, domain/DNS, monitoring, and secrets, with quarterly review and review on onboarding, role change, and offboarding; provider-by-provider enforcement evidence remains incomplete. Lyvboard’s selected targets are a 24-hour RPO, 24-hour RTO, maximum 90-day backup-deletion period, annual restoration testing, and remediation targets of immediate containment and 72 hours for critical issues, 14 days for high, 30 days for medium, and 90 days for low. These are selected requirements or targets, not measured certifications, until implementation evidence is completed. Lyvboard has no SOC 2, ISO certification, cyber insurance, or independent penetration-test report at present.
14.2 Controls implemented today. Confirmed controls include Supabase email/password authentication; email confirmation and account recovery; role-based access; PostgreSQL Row Level Security; immutable Organization-owner and team identifiers; same-Organization checks in sensitive database functions; scoped storage paths and authorization policies; server-side validation and content filtering; rate limiting; password-strength and common-password controls; audit and security-event logging; private-media access and temporary signed URLs; HTTPS/TLS; server-side handling of privileged or service-role credentials; Sentry default PII collection disabled and diagnostic redaction; bounded account-scoped browser caching; and CI dependency/code-security checks. An independent penetration test has not yet been completed. Exact provider encryption-at-rest settings, backup/PITR configuration and region, restoration evidence, and provider-level privileged MFA evidence remain pre-launch verification items.
14.3 No guarantee. No system is perfectly secure. Users must protect credentials and devices and promptly report suspected unauthorized access. Lyvboard will not state that it is “fully secure,” “breach-proof,” or certified to a standard unless the representation is accurate and documented.
14.4 Incident notice. Lyvboard will investigate suspected incidents and notify affected Organizations, adults, regulators, or individuals as required by the DPA and law. Notice timing, content, and coordination may depend on confirmation, law-enforcement restrictions, and the need to avoid compromising containment. The DPA may impose a shorter contractual notice period for Student Data.
14.5 Child-safety events and mandatory reporting. Lyvboard owns child-safety reports, preservation, and escalation; Gavin Nomberg is the current internal owner and safety@lyvboard.com is the selected channel. Before Player or Parent access, the channel must pass send/receive, routing, backup-responder, and escalation testing. A report involving abuse, exploitation, grooming, threats, or imminent harm is handled under Lyvboard’s safety escalation and legal obligations. Where Lyvboard obtains the knowledge that triggers a mandatory report under 18 U.S.C. § 2258A or another applicable law, Lyvboard will follow the applicable reporting and preservation requirements, with counsel involvement as appropriate. A privacy request, account closure, or deletion instruction does not override a mandatory reporting or preservation duty.
15. Access, Correction, Deletion, and Other Rights
15.1 Requests. An adult may request access, correction, deletion, withdrawal of consent, or information about disclosure by contacting privacy@lyvboard.com. The request should identify the adult, child, Organization, team, account email, requested action, and the adult's authority.
15.2 Verification. Lyvboard will take reasonable steps to verify identity and Parent, Organization, or account authority before disclosing or changing information. Lyvboard may request additional information or route an education-record request through the Organization.
15.3 Virginia student rights. For Student Data governed by Virginia law, Lyvboard will support the Organization's and Parent's lawful access and correction processes; collect, use, and disclose only for authorized purposes; delete at the school's request as required; and provide an electronic copy when required. Lyvboard will not target advertising, sell Student Data, create unauthorized profiles, or monitor students except as authorized for the service and safety purposes.
15.4 State consumer rights. Depending on residence and the context in which Lyvboard acts, an adult may have rights to know, access, correct, delete, obtain a portable copy, or appeal a denial. Student and child-specific laws may provide additional or different rights. Lyvboard will not discriminate for exercising a lawful right.
15.5 Limitations. A request may be limited where information is controlled by an Organization, another person's rights would be affected, identity or authority cannot be verified, retention is legally required, or an exception applies. Lyvboard will explain a denial or limitation when required.
15.6 Appeal. A requester may appeal a denied applicable state privacy request by replying “Privacy Appeal” to the decision or emailing privacy@lyvboard.com. Lyvboard will respond within the period required by applicable law.
16. Communications and Choices
16.1 Transactional messages. Lyvboard sends authentication, security, consent, account, team, schedule, billing, and service messages reasonably necessary to provide the Services. Users may not be able to opt out of essential messages while an account remains active.
16.2 Marketing. Lyvboard sends marketing only to eligible adults and provides a legally sufficient unsubscribe method. Lyvboard does not market directly to a child using Student Data or a school-authorized account.
16.3 Push and SMS. Push notifications and text messages are enabled only under the applicable device, account, and consent settings. The responsible adult is responsible for carrier charges. A child-directed SMS program is not enabled without separate review and consent.
17. International Access
17.1 United States launch. The initial Services and this Policy are designed for United States use. Lyvboard does not represent that this Policy satisfies the laws of another country or that cross-border access is authorized by an Organization.
17.2 Processing location. Information may be processed in the United States and other locations used by approved providers. An Organization must not deploy the Services outside the approved geography or transfer Student Data internationally without confirming the required contractual and legal safeguards.
18. Changes and Contact Information
18.1 Policy changes. Lyvboard may update this Policy prospectively. Lyvboard will provide conspicuous notice of material changes and obtain renewed consent when required, including when children's data categories, purposes, recipients, public-disclosure practices, or consent methods materially change. Lyvboard will not apply a materially expanded use retroactively without a lawful basis and required consent.
18.2 Effective date and versions. The published Policy will state its effective date and prior versions will be retained to document the terms presented to Users. Consent records will identify the applicable Policy version.
18.3 Contact. Lyvboard, Inc., 11357 Nuckols Road, Suite 103, Glen Allen, Virginia 23059. Privacy and children’s-data inquiries: privacy@lyvboard.com. Security reports: security@lyvboard.com. Child-safety reports: safety@lyvboard.com. General support: support@lyvboard.com. Gavin Nomberg is the current responsible internal owner for the security and safety channels; operational monitoring, routing, backup-responder, and escalation testing must be completed before Player or Parent access.
18.4 Organization contact. Questions about an Organization's educational records, roster decisions, coach conduct, team policy, or Parent access process should ordinarily be directed to that Organization. Lyvboard will assist as required by the DPA and law.
