Security & your families' data

The short version, for the board member who asked.

Your families' information is the most sensitive thing your association holds, and you're right to ask where it goes before you move it anywhere. Here is how InSeasonHQ handles it — in plain language, with the legal documents linked under every claim so your board (or your district, or your insurer) can read the binding version.

Kids never hold accounts

No player signs up for InSeasonHQ. There is no child login, no child-facing messaging, and no way for a child to create a profile. Accounts belong to adults: parents and guardians, and the staff and volunteers who run your organization.

Information about a child reaches us one of two ways — a parent or guardian enters it when they register their child, or your organization enters it from its own records. Where your organization supplies it, our agreement with you requires that you hold the parental consent you need. A parent can review what is held about their child, correct it, request its deletion, or refuse further collection.

Full text: Children's Privacy Notice

Your data is yours. Other organizations never see it.

Every organization's data is isolated from every other organization's — enforced in code, not just promised in a policy. Within your organization, access follows the role: a coach sees their own team, a registrar sees registrations, a treasurer sees payments. A saved report can carry money columns only the treasurer sees.

We process your families' information only on your organization's instructions, to run your season. We do not use it for our own purposes.

Full text: Data Processing Addendum

We never sell it, and there is nothing to sell it to

No advertising. No behavioral profiles. No selling or sharing family or player information to third parties for their own purposes. No marketing to children, ever. InSeasonHQ is not a media company — we charge for software, so your families are the customers, not the product.

That applies to our own analytics too: we count visits without cookies. There is no ad tracker on our site to banner about, which is why you never saw a cookie popup here.

Full text: Privacy Policy

The technical measures

These are the measures named in our Data Processing Addendum — the binding version your organization signs up to:

• Encryption in transit for data moving between families, your staff, and the platform.
• Hashed passwords — account passwords are stored hashed, never in plain text.
• Per-organization data isolation, as described above.
• Role-based access — staff see only what their job requires, and your organization controls who holds which role.
• Audit logging of administrative actions — who did what, on the record.
• Card numbers never touch our servers. Payments run through your organization's own Stripe account; money settles to your bank, and your organization's name is what families see on their statements.

Full text: Data Processing Addendum — Security

Who else touches the data: four companies, named

We use a short list of service providers, each bound by contract to process information only on our instructions and never for their own purposes:

No analytics networks, no ad networks, no data brokers. If this list changes, the Data Processing Addendum changes with it.

If something goes wrong

If we become aware of a personal-data breach affecting your organization's data, we notify your organization without undue delay, with the information it needs to meet its own obligations. That commitment is in the Data Processing Addendum, not just on this page.

Leaving takes your data with you

Export your rosters, registrations and player records to CSV/Excel from the app, today, whenever you want — no export fee, no lock-in negotiation. When a subscription ends and the wind-down period passes, your personal information is deleted from active systems and from backups on the normal backup cycle, except records the law requires us to keep (such as financial records for tax). Your Stripe account is yours and stays with you.

Full text: Terms of Service · Data Processing Addendum — Deletion and return

What we don't have — said plainly

We are a small, young company, and this page would rather tell you that than borrow credibility we haven't earned:

• We do not hold SOC 2, ISO 27001, or any other third-party security certification, and we won't claim one until an auditor has actually signed it.
• There is no dedicated security team — the measures above are implemented and owned by the people who built the platform, whose names are on the About page.
• What we offer instead of certificates: the binding commitments in the Data Processing Addendum, a named and short sub-processor list, your data exportable at any time, and direct answers. If your board or district has a security questionnaire, send it to privacy@inseasonhq.com and we will complete it honestly — including the questions where the answer is "not yet."

Questions

• Privacy and data questions: privacy@inseasonhq.com
• Legal and DPA questions: legal@inseasonhq.com
• Everything else: support@inseasonhq.com

The documents: Privacy Policy · Children's Privacy Notice · Data Processing Addendum · Terms of Service