Privacy Policy

1. About This Policy

Sports Admin Pro ("we", "us", "our") is committed to protecting the privacy of the schools and individuals who use our platform. This Privacy Policy explains how we collect, use, store, and protect personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy also addresses the handling of information relating to students (persons under 18 years of age), which is treated with the highest level of care given the sensitive nature of that data and the obligations of Australian schools under state and federal privacy law.

By using Sports Admin Pro, you agree to the collection and use of information as described in this policy.

2. Who We Are

Sports Admin Pro is operated by One Step AI (ABN: [TBC — pending ABN registration]), an Australian software business providing a SaaS platform for school sports administration.

For privacy enquiries, contact us at:

• Email: support@sportsadminpro.com.au
• Contact form: sportsadminpro.com.au/contact

3. What Information We Collect

3.1 Account and Organisation Information

When you create an account, we collect:

• Your first name, last name, and email address
• Your password (stored as a bcrypt hash — we never store your plain-text password)
• School or organisation name and address
• Account creation date, last login date, and activity timestamps
• The version of these Terms and Privacy Policy you agreed to, and the date of agreement

3.2 Sports Administration Data (Entered by School Staff)

The following data is entered by your school administrators and relates to your school's sports programme. We collect this data only to provide the service you have requested:

• Fixture HQ / Tournament Generator: team names, fixture draws, match results, venues
• Bus Boss / Bus Scheduler: venue names and addresses, travel distances, bus departure and return times
• CourtRank: staff or player names, ELO ratings, match outcomes
• StatTracker: team and player names, game statistics
• Rotation Roster: player names, availability, court rotation plans
• Referee Roster: referee names, contact details (if entered), fixture assignments, pay rates
• Venue & Court Booking Manager: venue names, booking dates, hirer names and contact details
• Day Carnival Manager: student names, house names, age groups, event entries, times, and results
• First Aid Roster: first aid company names, staff assignments, venue details
• Best Players Voting: team and player names, vote submissions (no voter identity is stored beyond a temporary IP rate-limit record)
• Timesheet Manager: staff names, work dates, hours worked, activity descriptions, pay amounts
• Budget Planner: budget categories, amounts, financial year summaries (no individual financial account data)

3.3 PE Tools — Student Data (Sensitive)

When a teacher creates a PE session, the following data about students may be collected:

• Student first name and last name — entered by the teacher when setting up the session
• Psychomotor and performance data — students' shot placements, pre-shot planning data, post-shot outcomes, and self-reflection notes captured during the activity
• AI-generated coaching feedback — if the teacher enables the AI Coach feature, individual performance data is sent to a third-party AI service (see Section 7) to generate personalised feedback. This data is processed in real time and is not retained by the AI provider beyond the immediate API call.
• Session metadata — date, session name, number of ends/holes played

Students do not create accounts. Student participation is managed by the teacher who creates the session. Students access the tool via a session join code — no email address, password, or personal login is required from the student.

Teacher responsibility: By using the PE Tools, the school administrator (teacher) confirms that they have the authority under their school's privacy policies and applicable Australian law to collect and process student data in this way, and that appropriate consents or authorisations have been obtained.

Data retention for PE sessions: PE session data (including student performance records) is retained as long as the school's account is active. Teachers can delete individual sessions from the teacher dashboard at any time. On account deletion, all PE session data is permanently removed within 30 days.

3.4 Table Tennis Competition Data

The Table Tennis ELO Ladder (available to Concordia College users) stores student names, match results, and ELO ratings. This data is entered by school staff. The same student data handling principles described in section 3.3 apply.

3.5 Usage and Technical Data

• IP addresses (used for security rate limiting and audit logging only — not shared or sold)
• Tool usage logs (which tools are accessed and when, for platform analytics and billing)
• Uploaded fixture files (CSV/XLSX format, stored in your organisation's file library)
• Browser session identifier (stored in a secure HTTP-only cookie)

4. Why We Collect This Information (APP 3 & APP 5)

We collect personal information only for the following purposes, and only where collection is reasonably necessary:

• To provide the Service: all account, organisation, and sports data is collected solely to operate the platform features you use
• To authenticate and secure accounts: email, password hash, 2FA data
• To send transactional emails only: email verification and password reset — we do not send marketing emails
• To protect the platform: IP rate limiting, audit logging, fraud prevention
• To improve the platform: aggregate, anonymised usage analytics only
• To comply with legal obligations

We do not sell, rent, or share your personal information with third parties for marketing purposes. Your school's data and student data are never used to train AI models or shared with any party outside of providing the service to you.

5. How We Store and Protect Your Data (APP 11)

5.1 Where Data Is Stored

Your data is stored on servers located in Australia (Sydney, NSW) using Render's Sydney region infrastructure. We are committed to keeping all school and student data within Australian borders.

5.2 School Data Isolation

Sports Admin Pro is a multi-tenant platform. Each school's data is completely isolated by a unique organisation identifier:

• No school can access, view, or modify another school's data under any circumstances
• All database queries are filtered by your organisation's ID at every layer
• Aggregate platform analytics contain no school-identifying information

5.3 Technical Security Safeguards

• All connections encrypted using HTTPS/TLS (HSTS enforced in production)
• Passwords hashed using bcrypt (cost factor 12) — we cannot recover your password
• Security tokens (password resets, email verification, invite links) are single-use cryptographic tokens
• Two-factor authentication (2FA) available for all accounts via email or authenticator app
• Failed login attempts are rate-limited to protect against brute-force attacks
• HTTP security headers applied on all responses (Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options)
• CSRF (cross-site request forgery) protection on all state-mutating requests
• All SQL queries use parameterised placeholders — no SQL injection risk
• Database backups managed by Render with encryption at rest

5.4 Data Retention

Your data is retained for as long as your account is active. When you close your account or request deletion, all organisation and student data is permanently removed within 30 days. Anonymised, non-identifiable aggregate usage data may be retained for platform analytics after deletion.

6. Your Rights (APP 12 & APP 13)

Under the Australian Privacy Act 1988, you have the right to:

• Access the personal information we hold about you or your school (APP 12)
• Correct inaccurate, out-of-date, or incomplete information (APP 13)
• Delete your account and all associated data — via Settings > Delete Account, or by contacting us
• Export your school's data before closing your account (available from your account settings)
• Opt out of non-essential communications — we only send transactional emails, so there is nothing to opt out of
• Complain if you believe your privacy rights have been breached

To exercise any of these rights, contact us at support@sportsadminpro.com.au. We will respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

7. Third-Party Services

We use the following third-party services to operate Sports Admin Pro. We only share data with these providers to the extent necessary to provide the Service:

7.1 Render (Hosting & Database)

All application servers and the PostgreSQL database are hosted on Render in the Sydney, Australia region. Render acts as a data processor under our instructions. Your data does not leave Australia.

7.2 Resend (Transactional Email)

Resend is used solely to send transactional emails — email address verification and password reset emails. Only your email address and first name are passed to Resend for this purpose. Resend does not use this data for any purpose other than delivery.

7.3 Google Maps API (Bus Scheduler)

The Bus Scheduler tool optionally uses the Google Maps Distance Matrix API to calculate travel times between venues. Only venue addresses (not any personal data) are passed to this API. If no Google Maps API key is configured, travel times are estimated locally.

7.4 Anthropic Claude API (AI Coach — PE Tools)

• AI Coach feedback is generated by Anthropic's Claude AI models
• The data sent to Anthropic includes: the student's shot/performance data (positions, outcomes) and the activity type. Student names are not sent to Anthropic — only anonymised performance data is transmitted.
• Anthropic processes this data only to generate the feedback response and does not retain it for AI training purposes under our API agreement
• AI Coach feedback is supplementary and educational only — it does not replace qualified coaching or professional advice
• Teachers can disable AI Coach at any time from the teacher dashboard — this prevents any data being sent to Anthropic
• If your school's policy prohibits student data being processed by overseas AI systems, do not enable the AI Coach feature

We do not use advertising networks, social media trackers, or analytics platforms that collect personal data.

8. Data Relating to Minors

Sports Admin Pro is designed for use by school sports administrators and teachers. Some tools involve the collection of data about students who are under 18 years of age. We handle this data with particular care:

• Student data is entered by, and under the responsibility of, authorised school staff — not by the students themselves
• Students do not create accounts and are not directly identified to us beyond the data their teacher enters
• We do not collect student email addresses, contact details, or any data beyond what is necessary for the specific educational activity
• Student performance data (PE Tools) is used only to provide feedback within the session — it is not shared, sold, or used for any other purpose
• All student data is deleted when the school's account is closed (within 30 days)
• We do not run advertising against student data under any circumstances

Schools are responsible for ensuring that their use of Sports Admin Pro complies with their obligations under the applicable State and Territory education privacy legislation, their school's privacy policy, and any applicable student data governance requirements.

9. Cookies and Session Data

Sports Admin Pro uses a single, secure session cookie to maintain your login state. This cookie:

• Contains only your session identifier and organisation context — no tracking data
• Is marked HttpOnly (not accessible to JavaScript) and SameSite=Lax
• Is marked Secure in production (transmitted over HTTPS only)
• Expires after 30 days of inactivity

We do not use third-party cookies, advertising cookies, or tracking cookies of any kind.

10. Data Breach Notification

We have procedures in place to detect and respond to data breaches. In the event of a data breach that is likely to result in serious harm to individuals:

• We will investigate and contain the breach as quickly as possible
• We will notify affected account administrators by email within 30 days of becoming aware of the breach
• Where required by the Privacy Act 1988 Notifiable Data Breaches scheme, we will notify the Office of the Australian Information Commissioner (OAIC)
• Our breach notification will describe: what data was affected, what we believe happened, and what steps we are taking

To report a suspected security vulnerability or breach, contact us immediately at support@sportsadminpro.com.au.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email to account administrators at least 14 days before the changes take effect. The "Last updated" date and version at the top of this page will always reflect the most recent version.

Continued use of the Service after the effective date of any change constitutes acceptance of the updated policy.

12. Contact Us

For privacy enquiries, access or correction requests, or complaints:

• Email: support@sportsadminpro.com.au
• Contact form: sportsadminpro.com.au/contact

We will acknowledge your enquiry within 5 business days and respond substantively within 30 days.