Children's Privacy Notice
Last updated: June 2026
US COPPA Compliance · GDPR Art. 8 · Global Children's Data
This Children's Privacy Notice is directed at
parents and guardians whose children may be tracked in LVL·UP by their tennis coach. It explains how LVL·UP handles information about players under 13 years of age, what we collect and do not collect, and the rights you have as a parent or guardian. For a broader account of our privacy practices, see the full
Privacy Policy and the
Junior Player Privacy Notice (GDPR-focused).
1. About LVL·UP and COPPA
LVL·UP Tennis operates a professional coaching planner at lvluptennis.com. The Service is used by tennis coaches — adults who subscribe to plan sessions, track player progress, and build training programmes.
The Children's Online Privacy Protection Act (COPPA), enforced by the US Federal Trade Commission (FTC), imposes requirements on operators of websites and online services that are directed to children under 13, or that have actual knowledge they are collecting personal information directly from children under 13.
LVL·UP's Classification Under COPPA
LVL·UP is not directed at children. The Service is a professional tool for adult coaches. Children do not register for LVL·UP accounts, do not log in to the Service, and do not interact with it directly in any way. LVL·UP passes all nine criteria the FTC uses to determine whether a service is "directed to children": the subject matter is professional sports coaching; all visual content, marketing, and language is adult-professional in tone; no animated characters, child-oriented music, celebrities who appeal to children, or child-facing incentives are used; all testimonials and depicted users are adult coaches.
Accordingly, COPPA does not apply to LVL·UP as a service directed to children. However, because coaches may enter information about players under the age of 13 into the system, we believe transparent disclosure of how that data is handled is the right practice — regardless of whether COPPA strictly requires it.
Coach responsibility. Under COPPA and equivalent laws, the coach is the party who collects information about an under-13 player and inputs it into LVL·UP. LVL·UP is a professional recordkeeping tool, like a physical coaching notebook stored in the cloud. The coach is responsible for ensuring they have appropriate parental consent before recording information about any minor. LVL·UP's Terms of Service explicitly place this obligation on the coach, and LVL·UP provides consent tools to help coaches discharge it (see Section 5 below).
2. Does LVL·UP Collect Information Directly From Children Under 13?
No. LVL·UP does not collect any personal information directly from children under 13. Children do not have LVL·UP accounts. Children do not fill in forms, enter data, or communicate with LVL·UP in any way. All information about child athletes in the system is entered by their coach — an adult professional.
LVL·UP does not:
- Contact children directly by email, push notification, or any other channel
- Market products or services to children
- Display advertising to children
- Use personal information about children for any purpose other than providing the coaching planner service to the coach
- Sell, share, or disclose children's personal information to third parties for marketing or advertising purposes
- Build profiles of children for behavioural advertising or commercial exploitation
3. What Information a Coach May Enter About Under-13 Players
When a coach adds a player profile in LVL·UP, they may enter the following information. This is the complete list — the Service does not collect anything beyond these fields:
| Data field | Purpose in the app | Available for under-13? |
|---|
| Player name | Identifies the player in the coach's session plans and notes | Yes |
| Age group (e.g. U12, U10) | Tailors programme intensity and drill selection to the player's competitive age category | Yes |
| Playing hand (left / right) | Used in tactical and technical drill planning | Yes |
| UTR or playing level | Matches the player to appropriate drills and programme difficulty | Yes |
| Squad or group name | Organises the player into the coach's training groups (e.g. "Red Ball", "Junior Elite") | Yes |
| Coaching notes and focus areas | The coach's professional observations on technique, tactics, or areas to develop | Yes |
| Session logs | A record of sessions attended and activities completed, with the coach's rating and notes | Yes |
| Performance test results | Results from structured performance benchmarks the coach conducts | Yes |
| Injury and health records | Injury type, severity, restrictions, return-to-play status | No — permanently blocked |
🔒 Injury and health data: permanently blocked for all under-18 players. The LVL·UP injury log is disabled at the application level for every player who has not been explicitly confirmed as 18 years of age or older. This is a structural control — it applies to all under-18 players, including those under 13, and cannot be overridden by the coach. No date-of-birth data is collected; only a categorical age group (e.g. "U12") is stored.
4. How Children's Information Is Stored and Protected
Where it is stored. All player data is stored in Supabase, a database platform hosted on EU-based AWS infrastructure in Frankfurt, Germany. Data is encrypted in transit (HTTPS) and encrypted at rest at the database layer.
Who can access it. Only the coach who created the player profile can access the data. LVL·UP staff do not access individual coaching records in the normal course of operations. Row-level security enforced at the database level ensures no cross-account data access is possible.
What LVL·UP does not do with the data. Children's information is not shared with advertisers, data brokers, analytics platforms, or any third party other than Supabase (storage/sync) and, only where applicable, Netlify (hosting infrastructure). It is never used to train AI models. LVL·UP does not sell data of any kind.
How long it is kept. Player data is retained for as long as the coach's LVL·UP account is active. When the coach deletes their account, all associated player data — including any under-13 player records — is removed from production systems within 30 days. Parents may also request deletion at any time (see Section 6).
5. Parental Consent — How LVL·UP Helps Coaches Obtain It
LVL·UP recognises that coaches have a legal obligation to obtain appropriate parental consent before recording information about minor players, particularly those under 13. We provide the following tools to help coaches discharge that obligation:
1
Parental consent form (/consent)
Coaches can generate a secure, tokenised consent link for any player and send it to the player's parent or guardian. The link expires after 7 days. Parents are shown a clear summary of what data is stored, who can see it, and how to request deletion — before they consent.
2
Junior Player Privacy Notice (/player-privacy)
A dedicated parent-facing notice — available in plain English — explains exactly what LVL·UP stores about under-18 players, what is never stored (health data), where the data lives, and what GDPR rights parents have.
3
Coach onboarding acknowledgement
During signup, every coach must acknowledge that they are the data controller for player information and are responsible for obtaining all consents required by applicable law — including parental consent for minors.
4
In-app terms reminder
The in-app Terms of Service modal explicitly states that coaches confirm they hold a lawful basis to collect and store information about each player, including under-18 players, and that they will honour any access, correction, or deletion requests from players or their legal guardians.
Parents: if you have not been asked for consent. If your child's coach uses LVL·UP and has not sent you a consent form, you can contact them directly to ask whether your child's information is stored in the app and request that they send the consent link or delete your child's profile. You may also email LVL·UP directly at
hello@lvluptennis.com — we will assist in identifying the relevant coach account and ensuring appropriate action is taken within 7 days.
6. Parental Rights Under COPPA and GDPR
As the parent or legal guardian of a player under 13, you have the following rights with respect to information about your child held in LVL·UP:
Under COPPA (US Law)
- Review: You may request to review the personal information collected about your child.
- Delete: You may request the deletion of your child's personal information. We will delete the player's profile from LVL·UP's systems within 30 days of a verified request.
- Refuse further collection: You may direct LVL·UP and the coach to stop collecting or using your child's personal information. Note that this may mean the coach can no longer use LVL·UP to plan sessions for your child.
- Opt out of disclosure: We do not disclose children's personal information to third parties for commercial purposes. You do not need to opt out of something that does not occur.
Under GDPR / UK GDPR (EU and UK)
- Access (Art. 15): Request a copy of the personal data held about your child.
- Rectification (Art. 16): Request correction of inaccurate or incomplete data.
- Erasure / Right to be forgotten (Art. 17): Request deletion of your child's data.
- Restriction (Art. 18): Request that processing be paused while a query or dispute is being resolved.
- Objection (Art. 21): Object to the processing of your child's data on grounds relating to your particular situation.
- Withdraw consent: Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.
- Lodge a complaint: You may lodge a complaint with your local supervisory authority: in the UK, the ICO at ico.org.uk; in the EU, your national data protection authority; in the US, the FTC at reportfraud.ftc.gov.
To exercise any of the above rights, email hello@lvluptennis.com with the subject line "Children's Data Request" and include: the child's first name and age group, the coach's name or club if known, and the action requested. We will respond within 7 days for children's data requests (faster than the standard 30-day window for adult requests).
7. Verifiable Parental Consent Process
When a coach chooses to use LVL·UP's built-in consent tool for a player, the following process applies:
- The coach generates a unique consent link from within the app and sends it to the parent or guardian by their preferred method (email, message, etc.).
- The parent or guardian opens the secure link at
lvluptennis.com/consent/[token]. The link is only valid for 7 days.
- The parent is shown: the player's name, the specific data fields that will be stored, who can see the data, that health data is never stored for under-18 players, how to request deletion, and a link to the full Privacy Policy.
- The parent taps "I consent on behalf of [player name]." This action is timestamped and stored in LVL·UP's database as the consent record for that player.
- Consent may be withdrawn at any time by emailing hello@lvluptennis.com.
Note on the consent architecture. The consent page is designed to meet the standard of "verifiable parental consent" as interpreted by the FTC under COPPA — specifically, the "email plus" method: the parent takes an affirmative action (clicking consent), a confirmation is sent, and LVL·UP maintains a timestamped record. For higher-risk processing (e.g., health data for under-18 players), a stronger consent method would be required. In v1, injury data for under-18 players is structurally blocked and this higher-risk scenario does not arise.
8. Our Commitment to Children's Privacy
LVL·UP was designed from the ground up with junior athlete privacy as a priority consideration, not an afterthought. The structural block on under-18 health data, the dedicated parental consent infrastructure, and the transparent disclosure of what data is collected about minor players reflect our belief that children's data deserves a higher standard of care.
We are committed to:
- Never collecting more information about children than is needed for the coaching planner to function
- Never using children's information for any commercial purpose other than providing the service to their coach
- Never storing health or injury data on under-18 players without explicit structural safeguards (structural block in v1; guardian consent workflow in v1.1)
- Responding to parental data requests within 7 days
- Reviewing and updating this notice annually or upon any material change to how children's data is handled
- Maintaining and publishing our full Data Protection Impact Assessment as required by GDPR Art. 35
9. Changes to This Notice
We may update this Children's Privacy Notice from time to time as the Service evolves (for example, when v1.1 introduces injury-log access for under-18 players with guardian consent). Material changes will be posted on this page with an updated date, and coaches will be notified by email at least 14 days before such changes take effect.
10. Contact — Children's Privacy