Privacy Notice | PMAAZ NIL Hub

1. Who we are

Gilbert Services Southwest ("we", "us", "our"), operating the PMAAZ NIL Hub (the "Service"), is the data controller for the personal data described in this Privacy Notice. This notice explains what personal data we collect, why we collect it, who we share it with, and the rights you have.

2. Personal data we collect

Account and contact data: name, email address, and any information you choose to provide when creating an account or contacting us.
Content you submit: messages sent to the AI Assistant, contract text pasted into the NIL Risk Scanner, and any files or notes you save in the Service.
Usage and device data: pages viewed, features used, approximate location derived from IP address, browser, operating system, and device identifiers.
Support communications: messages you send us and our replies.
Payment-related identifiers: we do not receive or store your full payment card details. Our payment provider, Paddle, collects and processes payment information directly and shares limited transaction data (such as customer email, country, subscription status, and a transaction reference) back to us.

3. How and why we use your data

To create and manage your account and provide the Service (legal basis: performance of a contract).
To process purchases and provide access to paid features (contract; legal obligation for tax/records).
To respond to support requests (contract; legitimate interests).
To secure the Service, prevent fraud and abuse, and enforce our Terms (legitimate interests; legal obligation).
To improve the Service, including debugging and analyzing feature usage (legitimate interests).
To send service-related communications and, where permitted, marketing (consent or legitimate interests, with opt-out).

4. Sharing your data

We share personal data only with the following categories of recipients:

Merchant of Record - Paddle: Paddle.com Market Limited acts as our reseller and Merchant of Record for all sales. Paddle processes payments, handles subscription management, calculates and remits sales tax/VAT, issues invoices, and manages refunds. See Paddle's Privacy Notice.
Hosting and infrastructure providers: Lovable Cloud (which uses Supabase and Cloudflare) hosts the Service, stores data, and serves it to your browser.
AI providers: prompts and inputs to AI features are processed by the Lovable AI Gateway and its underlying model providers (such as Google and Anthropic) to generate a response.
Professional advisers (legal, accounting) where necessary.
Authorities and third parties where required by law, court order, or to protect our rights, users, or the public.

We do not sell your personal data.

5. International transfers

We are based in the United States, and some of our service providers process data outside of your country of residence. Where required, we rely on appropriate safeguards such as standard contractual clauses or the service provider's approved transfer mechanisms.

6. Data retention

Account data: kept for as long as your account is active, then deleted or anonymized within 12 months of account closure, unless we must retain it for legal, tax, or dispute-resolution purposes.
Content you submit (AI messages, scanned contract text): retained while your account is active; you can request deletion at any time.
Billing and transaction records: retained by Paddle and by us for the period required by applicable tax and accounting law (typically 7 years).
Server logs and security telemetry: typically 30-90 days.

7. Security

We use appropriate technical and organizational measures to protect personal data, including HTTPS in transit, encryption at rest at the hosting layer, access controls, and row-level security in our database. No system is perfectly secure, and we cannot guarantee absolute security.

8. Your rights

Depending on where you live, you may have the right to:

access the personal data we hold about you;
correct inaccurate or incomplete data;
delete your data ("right to erasure");
restrict or object to certain processing;
receive a copy of your data in a portable format;
withdraw consent where we rely on consent; and
lodge a complaint with your local data protection authority.

To exercise these rights, contact us through the Service. We will respond within the period required by applicable law (typically within 30 days).

9. Children

The Service is designed for youth athletes and their families. Where a user is a minor, a parent or legal guardian is responsible for creating and managing the account. We do not knowingly collect more personal data from a child than is necessary to provide the Service. If you believe a child has provided data without appropriate consent, contact us and we will delete it.

10. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, remember your preferences, and provide the Service. We use limited analytics to understand how the Service is used. Paddle's checkout may set additional cookies when opened. You can manage cookies in your browser settings.

11. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be notified through the Service. The "Last updated" date at the top reflects the latest version.

12. Contact

For privacy questions or to exercise your rights, please contact Gilbert Services Southwest through the Service's contact channels. See also our Terms & Conditions and Refund Policy.