1. Introduction
BluPlay ("we," "us," or "our") is committed to protecting the privacy of all users, including student athletes and minors. This Privacy Policy explains how we collect, use, disclose, and safeguard information in compliance with the Family Educational Rights and Privacy Act (FERPA), the Children's Online Privacy Protection Act (COPPA), the Payment Card Industry Data Security Standard (PCI DSS), and all applicable federal and state laws governing the collection and disbursement of funds.
2. FERPA Compliance
BluPlay acts as a "school official" under FERPA when processing student education records on behalf of schools and school districts. We adhere to the following FERPA requirements:
- We access student education records only to provide contracted services to the school.
- We do not disclose personally identifiable information (PII) from education records without written consent from parents or eligible students, except as permitted by FERPA.
- We maintain reasonable security controls to protect education records from unauthorized access or disclosure.
- Upon termination of service, we return or destroy all education records in our possession as directed by the school.
- Schools retain full control over student education records. Parents and eligible students may request access, amendment, or deletion through the school's designated FERPA officer.
3. COPPA Compliance
We do not knowingly collect personal information directly from children under the age of 13 without verifiable parental consent or school authorization. Specifically:
- Student data is provided to BluPlay by schools or authorized school administrators — not collected directly from students.
- We do not use student data for advertising, profiling, or any commercial purpose unrelated to the educational service.
- We do not share student personal information with third parties for their own commercial purposes.
- Parents may request to review, correct, or delete personal information about their child by contacting their school or emailing support@bluplay.app.
- We limit our collection of student data to only what is necessary to provide the platform's educational and athletic management services.
4. Information We Collect
We collect the following categories of information through school administrators:
- Student Information: Name, grade, date of birth, gender, student ID, contact information, sport participation, and athletic eligibility status.
- Parent/Guardian Information: Name, email address, and phone number for emergency and communication purposes.
- School Staff and Coach Information: Name, email, role, and school affiliation.
- Event and Athletic Data: Game schedules, scores, team rosters, and ticket purchase records.
- Payment and Financial Information: Ticket purchase data, official pay rates, and payment processing data. We do not store full payment card numbers, CVV codes, or full bank account numbers. Financial data is processed through PCI DSS-compliant third-party payment processors. We may retain the last four digits of a card, transaction IDs, and payment method type for recordkeeping.
- Official / Payee Tax Information: For officials and other payees receiving compensation through BluPlay, we may collect taxpayer identification information (e.g., W-9 data including name, address, SSN or EIN) to comply with IRS reporting requirements, including issuance of Form 1099-NEC where applicable.
- Usage Data: Log data, IP addresses, browser type, and platform usage metrics for security and service improvement.
5. How We Use Information
- To operate, maintain, and improve the BluPlay platform.
- To manage athletic rosters, events, ticketing, and official payments on behalf of schools.
- To send transactional communications (e.g., event confirmations, ticket receipts, payment vouchers).
- To fulfill IRS tax reporting obligations, including issuing 1099-NEC forms to qualifying payees.
- To comply with legal obligations and enforce our Terms of Service.
- We do not sell student data to any third party.
- We do not use student data to build advertising profiles or target advertising.
6. Information Sharing and Disclosure
We may share information only in the following limited circumstances:
- With Schools: Data is shared back with authorized school administrators and staff who have a legitimate educational interest.
- Payment Processors: Financial transaction data is shared with PCI DSS-compliant payment processors solely to complete transactions. These processors are bound by data processing agreements prohibiting independent use of the data.
- Tax Authorities: We may share payee information with the IRS and applicable state tax authorities as required by law (e.g., 1099-NEC filings).
- Service Providers: We may share data with trusted vendors (e.g., cloud hosting) under strict agreements prohibiting independent use of the data.
- Legal Requirements: We may disclose information when required by law, court order, or governmental authority, including financial regulators.
- Safety: We may disclose information when necessary to protect the safety of students or others.
7. Financial Data and PCI DSS Compliance
BluPlay takes the security of financial data seriously and operates in alignment with the Payment Card Industry Data Security Standard (PCI DSS):
- Cardholder data (full card numbers, CVV, expiration dates) is never transmitted to or stored on BluPlay servers. All card transactions are handled directly by our PCI DSS-compliant payment processor.
- We use tokenization and end-to-end encryption for all payment flows.
- Bank account information provided by officials for direct deposit is encrypted at rest and in transit and is used solely for disbursing earned payments.
- Access to financial records within BluPlay is role-restricted to authorized administrators only.
- We do not operate as a money transmitter. All fund movement is processed through licensed third-party payment processors subject to applicable state and federal money transmission laws.
8. Data Security
We implement industry-standard technical, administrative, and physical safeguards to protect personal information from unauthorized access, disclosure, alteration, or destruction. This includes encrypted data transmission (TLS 1.2+), AES-256 encryption at rest, role-based access controls, and regular security reviews. However, no method of transmission over the Internet is 100% secure.
9. Data Retention
We retain student and school data for as long as the school maintains an active subscription with BluPlay, or as required by law. Financial records — including transaction logs, payment records, and tax documents — are retained for a minimum of seven (7) years to comply with IRS recordkeeping requirements and applicable financial regulations. Upon contract termination, schools may request deletion of their non-financial data within 60 days. Anonymized, aggregated data may be retained for platform improvement purposes.
10. Rights of Parents and Students
Under FERPA and COPPA, parents and eligible students (18+) have the right to:
- Inspect and review education records held by the school.
- Request corrections to inaccurate or misleading records.
- Consent to or restrict disclosure of personally identifiable information.
- File a complaint with the U.S. Department of Education's Family Policy Compliance Office (FPCO) if they believe their FERPA rights have been violated.
To exercise these rights, contact your school's designated FERPA administrator, or email us at support@bluplay.app.
11. Cookies and Tracking
We use essential cookies and session tokens to authenticate users and maintain secure sessions. We do not use advertising cookies or third-party tracking technologies that profile students.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify schools of material changes via email or an in-platform notice. Continued use of BluPlay after changes constitutes acceptance of the updated policy.
13. Contact Us
For privacy-related questions, data requests, or to report a concern, contact us at:
support@bluplay.app
BluPlay · Athletic Management Platform