Privacy policy

1. Who we are

OurHoop Basketball Academy ("we") offers basketball training in Montreal. We take the protection of personal information seriously — especially children's — in accordance with Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25).

[TO COMPLETE: legal entity, business address, NEQ if applicable]

2. Person in charge of personal information

Person in charge: [Nom du responsable — à compléter]. Email: ourhoop@gmail.com.

3. Information we collect

• Account holder (parent, guardian or adult): first and last name, email, phone (optional), language, password (stored as an irreversible hash).
• Participants: first and last name, date of birth (to check program eligibility), emergency contact.
• Sports safety information (allergies, asthma, injury…): only if you choose to provide it and consent. Only you and the coach can see it.
• Bookings and payments: sessions, amounts, statuses. Card details are processed exclusively by Stripe and never stored on our servers.
• Messages sent through the contact form.
• Minimal technical data: a hashed fingerprint of your IP address, used only to prevent abuse. No advertising cookies; a session cookie keeps you logged in.

4. Purposes

• Manage your account, registrations and bookings.
• Check participant eligibility (age) and ensure their safety during sessions.
• Process payments, refunds and receipts.
• Send session-related communications.
• Reply to your messages.
• Send academy news, only if you consented.

5. Children and parental consent

Accounts can only be created by people aged 18 and over. A child's information is provided by their parent or legal guardian, who gives consent. For minors under 14, consent of the person having parental authority is required by law.

No photo or video in which a minor is identifiable is published without the parent's or guardian's written authorization, which is optional and revocable at any time.

6. Third parties and hosting

We never sell your information. It is only shared with service providers needed to run the service:

• Stripe (payments).
• Resend (emails).
• Vercel (hosting) and [database provider to specify].
• These providers may process data outside Quebec. Under Law 25, a privacy impact assessment must be carried out before such transfers. [TO CARRY OUT AND DOCUMENT]

7. Retention

• Account and participants: while the account is active, then deleted or anonymized after [24 months] of inactivity or upon request.
• Safety information: deleted when the participant is removed or upon request.
• Payment records: kept as required by tax laws (generally 6 years).
• Contact messages: [12 months].

8. Your rights

You can request access, correction, withdrawal of consent or deletion of your data (and your children's) from your account (Profile › My personal data) or by writing to the person in charge. We reply within 30 days. You may also file a complaint with the Commission d'accès à l'information du Québec.

9. Security

Encrypted connection (HTTPS), hashed passwords, server-side protected admin access, health information restricted to the coach, login rate limiting. In the event of a confidentiality incident presenting a risk of serious injury, we will notify affected people and the Commission d'accès à l'information.