Privacy Policy

1. Who We Are

MERIT Sports Platform Inc. (“Merit,” “we,” “us,” or “our”) operates the Merit Sports platform, including the website at meritsports.ca and our mobile applications (collectively, the “Service”). We are a Canadian company. Our primary database is hosted in Canada (Supabase, Canada Central region, since June 30, 2026). Some of the other service providers we rely on (listed in Section 5) are based in the United States and process data under their own standard regions and practices — see Section 5 for the full list.

This Privacy Policy describes how we collect, use, disclose, and protect personal information in accordance with the Personal Information Protection and Electronic Documents Act(PIPEDA) and applicable provincial privacy legislation. If your association is based in Quebec, additional obligations under Quebec’s Law 25 may apply — we encourage Quebec-based associations to seek their own legal advice on this.

2. Information We Collect

We collect the following categories of personal information:

• Account information: name, email address, and password when you register.
• Player profile data: date of birth (encrypted at rest), jersey number, position, Hockey Canada Registry (HCR) number where applicable, phone number, and emergency contact name/phone.
• Performance data: game statistics, evaluation scores, and season history recorded by coaches and evaluators.
• Roster and team data: team memberships, roles (coach, manager, parent, etc.), and availability.
• Financial information: registration fees and payment records are processed by our third-party payment processors (SportsPay and Stripe). Merit does not store full card numbers or banking details.
• Volunteer information: volunteer date of birth, credentials, certifications, availability windows, and any notes an association administrator records about a volunteer.
• Signed waivers: liability waivers signed through the platform are stored together with the signer’s name, phone number, and signature image.
• Communications: messages sent through in-app team chat, emails, and feature requests submitted through the platform.
• Device information: push notification tokens for sending game and event alerts to your device.
• Usage data: pages visited and features used, collected through our error-monitoring service to improve platform reliability.

3. How We Use Your Information

We use personal information only for the purposes for which it was collected:

• To create and manage your account and authenticate your identity.
• To operate team and league management features, including rosters, schedules, and evaluations.
• To process registration fees and record payment history.
• To send transactional emails (invitations, schedule updates, reminders) and push notifications you have opted into.
• To calculate and display career statistics and milestone achievements.
• To coordinate volunteer assignments and send duty reminders.
• To maintain coach safety records in accordance with applicable sport-governing body requirements.
• To improve the platform through anonymized usage analytics and error reporting.
• To display sponsor/advertiser messages, which may be targeted by age group and general program participation (see Section 5) — never using health, financial, or other sensitive categories of information.

We do not sell personal information to third parties.

4. Children’s Privacy

Merit Sports is used by sports associations that manage programs for minors. Player profiles, statistics, and evaluation records are intended to be accessible only to authenticated members of that same association. Date of birth information for minor players is encrypted at rest and is used solely for age-group verification and registration eligibility.

Some information is not private by default: a player (or their parent/guardian) can opt in to a public player profile, which makes a limited set of information (name, stats, achievements) visible outside the platform; associations may also publish public season schedules, tournament results, and award pages that can include a player’s name. None of this is on by default — it requires an explicit opt-in or an association’s own choice to publish a given page.

Parents or guardians may contact us at any time to request access to, correction of, or deletion of their child’s personal information — see Section 8.

5. Disclosure of Information

We share personal information only in the following circumstances:

• Within your association: Coaches, managers, and association administrators can view roster and stat information for the teams and age groups they are authorized to manage.
• Service providers (processors): we use the following providers, each of which is contractually or by its own terms restricted to using your information only to provide its service to us:
  • Supabase — database hosting (Canada Central region)
  • Vercel — application hosting
  • Stripe and SportsPay — payment processing
  • Resend — transactional email delivery
  • Firebase (Google) — mobile push notifications
  • Sentry — error monitoring (processes diagnostic data in the United States; configured not to collect personal information by default)
  • Anthropic — used for a small number of staff-facing document-parsing features (e.g. reading an uploaded ice-rental contract PDF); not used to process player or parent personal information
• Marketplace, Interlock, and League features: if your association activates these optional modules, limited information (e.g. a listing contact, an ice-sharing request, or a league roster) may be shared with other participating associations or league administrators as part of using that feature.
• Advertising program: associations may opt in to an advertiser program that displays sponsor messages targeted by age group and general program participation. Advertisers do not receive your personal information directly.
• Public pages: an association may choose to publish public season schedules, tournament results, or award pages; a player may separately opt in to a public player profile. See Section 4.
• Legal requirements: we may disclose information if required by law or to protect the safety of our users or the public.
• Business transfers: in the event of a merger, acquisition, or sale of assets, personal information may be transferred, with notice provided to affected users.

6. Data Storage and Retention

Our primary database is hosted in Canada. We retain personal information for as long as your account or your association’s use of the Service is active. A player or volunteer record with no season enrollment or role activity for 7 years is flagged for review by our Privacy Officer, who will delete or scrub it unless there is a specific reason to keep it. Coach safety records (including incident logs and suspension records) are retained for a minimum of seven years in accordance with sport-governing body standards. You may request deletion of your account and associated data at any time (Section 8); requests are typically processed within 30 days. Where data is scrubbed rather than deleted outright (for example, to preserve season/career statistics for other players on a shared roster), we retain only what is needed for that purpose and remove direct identifiers.

7. Security

We use industry-standard security measures including encryption in transit (TLS), encryption at rest for sensitive fields (including date of birth), role-based access controls limiting who within your association can view your information, and an access log recording when staff view another person’s detailed personal information. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but are committed to protecting your information using commercially reasonable practices and to continuing to review and improve these safeguards.

8. Your Rights

Under PIPEDA you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Withdraw consent for non-essential communications (such as marketing emails) at any time using the unsubscribe link in any email.
• Request deletion of your account and personal data, subject to legal retention requirements.
• File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

To exercise any of the rights above, or to ask a question about this policy, contact our Privacy Officer through meritsports.ca/contact. We will confirm your identity before acting on an access, correction, or deletion request. This process is currently handled directly by our Privacy Officer rather than through an automated self-service tool.

9. Push Notifications

If you use our mobile application, we may send push notifications for game reminders, RSVP requests, roster updates, and other team events. You can disable push notifications at any time through your device settings. Disabling push notifications does not affect your ability to use the platform.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Each version is dated and versioned (see the top of this page) — the version you agreed to at registration is recorded on your record. When we make material changes, we will notify users by email or through a notice on the platform at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the revised policy.

11. Contact Us

If you have any questions or concerns about this Privacy Policy or our privacy practices, please contact us: