Privacy Policy

1. Who we are

Upryst ("we", "us", "our") is a rugby scouting platform that connects players with scouts and clubs. This Privacy Policy explains how we collect, use, share and protect personal data when you use our website and services.

We are the data controller for the personal data we hold about you, unless stated otherwise.

2. What we collect

Account information

• Name, email address, password (stored hashed)
• Account type (player or scout) and, for scouts, club or organisation affiliation

Profile information (players)

• Position, age, club history, school or college, location
• Match footage, performance data, and a profile photograph if you choose to provide one

Profile information (scouts)

• Role, organisation, professional credentials submitted during the approval process

Usage data

• Pages viewed, search queries, IP address, browser and device information
• Anti-abuse signals collected via Cloudflare Turnstile

3. How we use it

• To create and operate your account
• To make player profiles discoverable to approved scouts
• To verify identity and prevent fraud or abuse
• To send service-related communications (e.g. account changes, security alerts)
• With your consent, to send marketing emails — you can opt out at any time

4. Legal basis (UK GDPR)

We process personal data on the following bases:

• Contract — to provide the service you've signed up for
• Legitimate interests — to keep the platform secure, prevent abuse, and improve our service
• Consent — where you've explicitly opted in (e.g. marketing)
• Legal obligation — where we're required to retain or disclose data by law

5. Sharing your data

Player profile information is visible to approved scouts on the platform. We don't sell your data. We share data with:

• Infrastructure providers (Cloudflare for hosting, edge security and Turnstile)
• Email service providers for transactional and marketing email
• Analytics providers (where you have not opted out)
• Law enforcement or regulators where required by law

6. Retention

We keep your account data for as long as your account is active. If you delete your account, we delete your profile within 30 days, except where we're required to retain certain records (e.g. for tax, fraud or legal purposes).

7. Your rights (UK GDPR)

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure ("right to be forgotten")
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk)

To exercise any of these rights, email us at the address in section 11.

8. Security

We use Cloudflare's edge network, TLS encryption in transit, hashed password storage, and Cloudflare Turnstile for bot protection. No system is perfectly secure — if we ever suffer a personal data breach we'll notify affected users and the ICO as required.

9. Cookies

We use a small number of cookies and similar technologies for:

• Keeping you signed in
• Preventing abuse (Cloudflare Turnstile)
• Anonymous usage analytics

You can control cookies through your browser settings.

10. Changes

If we make material changes to this policy, we'll update the "last updated" date and, where appropriate, notify you by email or in-app message.

11. Contact

Questions, requests or complaints: privacy@upryst.com.