Privacy Policy

This policy covers three parties. squadXL builds and runs the platform. An Academy is the gymnastics or sports business that signs up for squadXL and manages its own classes, students, and staff inside it. End users are everyone who logs into an Academy's account: owners, managers, staff, instructors, parents, and students.

Parents and students don't sign up for squadXL directly. They're invited in by an Academy they're already enrolled with, and the account they use belongs to that Academy, not to squadXL.

For the personal information an Academy enters about its own students and families, the Academy is the data controller: it decides what gets collected and why, and it's responsible for having the right to collect it in the first place. squadXL acts as the data processor, storing and handling that information only to run the service the Academy signed up for, not for purposes of our own.

For the information tied to running squadXL itself, an Academy's billing details, the login credentials of its owner and staff accounts, squadXL is the controller.

What ends up in squadXL falls into three groups:

• Academy account information: business name, location(s), and the name, email, and role of each owner/staff/instructor account
• Student and family information an Academy enters: student name, date of birth, parent/emergency contact details, class enrollments, skill and attendance history, and payment status
• Usage information collected automatically: device and browser type, IP address, and activity logs, used to keep the service secure and to fix problems

squadXL does not collect or store payment card numbers. Payments are recorded as reported by a parent and confirmed by staff, not processed through squadXL, so no card data ever passes through the platform.

Information is used to run the features an Academy is actually using: enrolling a student, tracking their skill progress, taking attendance, calculating a monthly bill, and letting a parent check in on all of it. It's also used to keep the service secure, to respond to support requests, and to meet legal obligations where they apply.

It is not sold, and it is not used to build advertising profiles. squadXL has no advertising or tracking network integrations to share it with in the first place.

Most of the individuals squadXL holds records for are minors. That data is entered by the Academy, typically sourced from a parent or guardian at enrollment, not collected directly from a child. Where a student has their own portal login, what they can do with it is limited to viewing their own schedule and progress and making requests that still route through the Academy or an instructor for approval.

Collecting a child's information and having the appropriate consent from a parent or guardian to do so is the Academy's responsibility as the controller of that data, not squadXL's. An Academy using squadXL confirms it has that consent before entering a student's information into the system.

Data entered by one Academy is never visible to another Academy on the platform; the multi-tenant separation between academies is enforced at the account level, not just the interface. Within an Academy's own account, what a given user can see follows their role: an instructor sees their own classes, a parent sees only their own children.

squadXL shares information with a small number of infrastructure providers needed to run the service itself (hosting and database providers), each bound to protect it. It is not shared with any other third party for their own purposes.

Information stays in the system for as long as an Academy's subscription is active and the Academy chooses to keep it. If an Academy cancels, its data is retained for 180 days to allow for export or reactivation, then deleted, except where a shorter or longer period is required to meet a legal obligation.

Access to an Academy's data is scoped by role and location, and the same activity log used to answer "who changed this record" internally within the product also supports reviewing access from a security standpoint. Every request runs over an encrypted connection, staff permissions are individually grantable rather than bundled into one fixed tier, and each Academy's data is kept isolated from every other Academy on the platform at the account level, not just in the interface. No system is guaranteed to be completely secure, and this policy doesn't claim otherwise.

Because an Academy controls its own students' and families' data, a request to access, correct, or delete that information should go to the Academy first. squadXL supports Academies in fulfilling those requests through the product itself (most of it is already visible and editable from a student's own profile) and directly where the product doesn't cover it.

For information squadXL controls directly, an Academy's own account and billing details, a request can be sent to the contact below.

The marketing site (this site) uses only the cookies needed for basic functionality, such as remembering a light/dark theme preference. It does not run advertising or analytics trackers. Cookie use inside the squadXL product itself is limited to session authentication.

If this policy changes in a way that meaningfully affects how information is handled, Academies will be notified before the change takes effect. The "Last updated" date at the top of this page always reflects the current version.

Questions about this policy can be sent to privacy@squadxl.com. For a request about a specific student or family's data, please contact the Academy directly, they're best placed to handle it quickly.