4CM — Privacy Notice

In force. Cleared for publication on the first-pass clearance record of 2026-07-25 (counsel-role review), countersigned by the founder/DPO 2026-07-26, with the banner-gating items X1–X3 evidenced and the messaging-relay corrections applied. Claim-by-claim verified against production behaviour — see docs/legal/notice-claim-verification.md. Version: 2.0 · Effective from: 2026-07-26 Data Protection Officer: Peter Bull — dpo@4cmcoaching.co.uk

Subject in all respects to external counsel ratification of the five open determinations recorded in docs/legal/first-pass-clearance-banner-gating.md. Those affect future behaviour, not the accuracy of this notice as at the effective date.

---

This notice explains how personal data is handled when you use 4CM, the youth football coaching and player development platform operated by 4CM, Inc. (“4CM”, “we”, “us”).

It applies to coaches, parents, players (13+) and club admins. A separate, age-appropriate version for young players is at /legal/privacy-for-young-players.

Questions? Contact our Data Protection Officer: dpo@4cmcoaching.co.uk.

---

1. Quick summary

• Your club is in charge of its data. For almost everything you do on 4CM, your club is the “controller” and we process data on the club’s instructions.
• 4CM is for users aged 13 and over. If you’re 13–17, you consent yourself and we let a parent know.
• Health-related information (wellness logs, height/weight) is optional — a player chooses whether to record it, and it is never shown in ranked or comparative views.
• AI development analysis for players is off by default for under-18s.
• We use vetted technology providers to run the service. We never sell your data and never use it for advertising.
• You have rights under UK law to access, correct, delete, restrict or export your data — see Section 9.

2. Who is responsible for your data

This is important and slightly unusual, so here it is plainly:

Data	Who decides why/how it’s used (controller)	Who processes it
Everything your club does on 4CM — player profiles, ratings, wellness logs, video tags, welfare records, team management, consent records	Your club	4CM, on the club’s documented instructions (Data Processing Agreement, Schedule 3 of the club’s subscription agreement)
Club administrators’ own account + billing contact details	4CM, Inc.	4CM
Enquiries sent to us from the pilot page on our website, before a club joins	4CM, Inc.	4CM
Anonymised, aggregated statistics (e.g. benchmarks)	No one — properly anonymised data is not personal data	4CM

What this means for you: your club is the first port of call for decisions about your data, and we act on the club’s behalf. You can still exercise all your rights directly in the app (Section 9) — we handle requests and keep your club informed, so you don’t have to work out who to ask.

Processor (platform operator)	4CM, Inc., a Delaware corporation, file number 10715824
Registered office	Northwest Registered Agent Service, Inc., 8 The Green, Ste B, Dover, DE 19901, United States
Controller (for club data)	Your club — shown in the app under Settings → My club
Data Protection Officer	Peter Bull — dpo@4cmcoaching.co.uk

The registered office above is an address for formal service of documents. For anything you actually want answered, use dpo@4cmcoaching.co.uk — it reaches a person, and the postal address does not.

3. What personal data is collected

When you create an account

Data	Required	Why
Name	✅	To identify you in the platform
Email	✅	Sign-in, password reset, essential service emails
Date of birth	✅	Age checks and UK-GDPR / DPA 2018 protections; players’ age band
Role	✅	Coach, parent, player or club admin — controls what you can see and do
Club / team affiliation	✅	To connect you to the right people

Under-13s cannot create accounts in v1; the signup gate blocks it and the attempted date of birth is not kept.

For coaches

Data	Required	Why
Enhanced DBS certificate details	✅	Statutory + FA safeguarding requirement — encrypted at rest
FA Safeguarding Children certificate	✅	FA requirement
FA RESPECT acknowledgement	✅	FA requirement

When players use the platform

Data	Required	Why
Coach ratings of player	Optional	Development tracking on the FA 4 Corner Model
Self-ratings, journal entries, goal cards	Optional	Player-led reflection and portfolio
Wellness logs (mood, sleep, soreness, RPE)	Opt-in, default off	Welfare monitoring — health data
Bio-band measurements (height, weight, maturity offset)	Opt-in, default off	Maturation-aware coaching only; never used for team selection, ranking or release decisions
Video clip metadata (URL, timestamps, coaching note)	Optional	Educational + portfolio use; videos stay on YouTube/Veo/Hudl, not 4CM

Communications and safety

Data	Why
Coaching notes attached to clips, sessions and ratings	Service operation + safeguarding. 4CM has no private messaging — notes are attached to a coaching record and visible to the player they are about.
Welfare incident reports	Safeguarding — visible to the club Welfare Officer only, not club admins

When your club enquires about the pilot

If someone at your club fills in the enquiry form on our website, we receive what they typed: the club’s name, their name, their role at the club, an email address, and optionally the county FA or league, roughly how many teams you run, and a free-text note.

We ask for nothing about individual children and the form says so. It is emailed to us and not stored in any database — answering an enquiry needs an inbox, not a record system.

Operational telemetry

Data	Why
Pseudonymised user ID + crash reports (Sentry)	Bug fixing — consent-gated, see Cookie & PECR Statement

When you send us feedback

Only if you choose to use Send feedback in the app.

Data	Why
What you write or dictate, and whether it’s a bug, an idea or praise	So we can understand and fix what you’re telling us about
The screen you were on, your app version and device type	So we can reproduce the problem without having to ask you
A screenshot, only if you attach one	So we can see what you saw

Feedback goes to the 4CM team. Your club does not see it — not your club admin, not your welfare officer.

If you attach a screenshot we ask you to confirm it doesn’t show any players’ names, and the app will not send it until you do. Screenshots are stored privately, are not published anywhere, and can only be opened by 4CM. Please crop players’ names out, or describe what you saw instead.

If you dictate rather than type, the recording is transcribed by OpenAI — see section 5.

4. Why, and on what legal basis

The club’s full lawful-basis register is maintained and reviewed annually. In summary:

Purpose	Lawful basis (UK-GDPR Art 6)	Special-category basis (Art 9)
Account creation, sign-in, service operation	Contract	n/a
Coach safeguarding compliance (DBS / FA certs)	Legal obligation + legitimate interests	n/a
Coach ratings	Legitimate interests (sport development)	n/a
Self-ratings, journal, goal cards	Consent	n/a
Wellness logs	Explicit consent	Art 9(2)(a) — health data
Bio-band measurements	Explicit consent	Art 9(2)(a) — health data
AI development analysis (player-facing)	Consent — opt-in, default off for under-18s	n/a
AI coach assistant (coach-only surfaces)	Legitimate interests	n/a
Welfare incident reporting	Recognised legitimate interests (safeguarding a vulnerable person — DUAA 2025)	Art 9(2)(g) substantial public interest
Messaging + safeguarding logging	Contract / legal obligation	n/a
Replying to a club’s pilot enquiry	Legitimate interests — answering an enquiry the club sent us	n/a
Marketing emails (over-18s only)	Opt-in consent — no marketing to under-18s, ever	n/a
Telemetry (Sentry)	Consent via the cookie banner	n/a
Feedback you send us about the app	Legitimate interests (improving a product you rely on)	n/a

A pilot enquiry is used only to reply to that enquiry. It is not marketing, it does not go on a mailing list, and we do not use it to contact you about anything else. If we ever want to send a club marketing email we will ask first and you can say no — see the marketing row above.

5. Where your data goes

We use third-party providers (“sub-processors”) to deliver the service, each under a written data processing agreement. Where data leaves the UK, we rely on the UK Extension to the EU-US Data Privacy Framework (“UK Data Bridge”) or Standard Contractual Clauses / the IDTA.

Provider	Role	Data	Location
Supabase	Hosting (database, auth, storage)	All platform data	EU (Frankfurt)
Anthropic	AI inference for coaching insights	Coaching context — PII redacted before send	US
ElevenLabs	Spoken Brain replies — optional, off by default	Only if a coach turns it on: the reply text Brain speaks, which can include a player’s name	US
OpenAI	Two separate things: (a) speech-to-text — transcribing anything you dictate, anywhere in the app, including feedback; (b) spoken Brain replies — optional, off by default	(a) the audio you record while dictating, and the text it becomes; (b) only if a coach turns it on: the reply text Brain speaks, which can include a player’s name	US
Voyage AI	Text embeddings for the knowledge base	Knowledge-base content (no personal data)	US
Modal Labs	Video processing (player tracking)	Video frames — no face recognition, no identity matching, no biometric templates, ever	US
Sentry	Crash reporting (consent-gated)	Pseudonymised ID + stack trace	EU/US
Resend	Transactional email (account verification, sign-in links, consent notices, data-request delivery, pilot enquiries from our website)	Email address, name, message context	EU (eu-west-1) — underlying AWS SES; SCCs where data reaches the US
Cloudflare	Hosting our website, and running the small piece of code that passes a pilot enquiry to Resend	Website request metadata; the contents of an enquiry form as it is passed on	UK + global

Brain speaks using your own device’s voice by default: no reply text is sent to a voice provider unless a coach deliberately chooses a cloud voice. Dictation is separate — whenever you use a microphone in 4CM, the recording is sent to OpenAI to be turned into text.

We do not sell personal data and do not use it for behavioural advertising. Parental identity verification (Yoti) is not part of v1; it arrives with under-13 support in v2 and this notice will be updated first.

6. How long data is kept

Defaults below; your club can shorten some windows. Full detail is in the club-facing Data Retention Policy.

Data	Default retention
Account	Lifetime + 30-day grace period
Coach DBS / safeguarding cert records	7 years post-account-deletion
Coach ratings, self-ratings	3 years
Wellness logs	90 days
Bio-band measurements	12 months
Journal entries	3 years (you can delete any entry at any time)
Video tag metadata	1 year
Welfare incident records	Until the subject reaches age 25 (legal hold can extend)
Consent records	Account lifetime + 7 years after final processing
Crash logs (Sentry)	30 days
Feedback you send us (and any screenshot attached)	90 days, deleted automatically
Pilot enquiries	12 months from our last contact about it, then deleted from the inbox

7. Children’s privacy

The age of digital consent in the UK is 13 (DPA 2018 §9).

• Under 13: cannot use 4CM in v1. Signup is blocked at the date- of-birth step and nothing is stored.
• 13–17: from age 13, UK law makes your consent the one that counts — you agree to things yourself when you sign up. We let a parent know you’ve signed up and what you chose, and they always have a way to raise a concern with us. Right now, a linked parent can also help manage some optional settings from their account. We’re changing this so optional features can only be switched on from your own login, with parents keeping a protective “pause” and a heads-up before certain features start — we’ll update this notice when that change goes live.
• 18+: standard adult signup.

We follow the ICO Children’s Code: wellness logs and bio-band measurements are optional and recorded only if a player chooses to, AI analysis is off by default for under-18s until they opt in, there is no advertising use of children’s data, no nudges to reduce privacy, and an age-appropriate version of this notice.

8. Cookies and similar technologies

Essential cookies (sign-in, security, remembering your consent choices) don’t need consent. Everything else — analytics, crash reporting — is off until you say yes on the cookie banner, one toggle per category, none pre-ticked, “Reject all” as prominent as “Accept all”. There are no advertising cookies at all.

The full inventory and rules are in the Cookie & PECR Statement; change your choices any time at Settings → Privacy → Cookies.

9. Your rights

You can exercise all of these at Settings → Privacy or by emailing dpo@4cmcoaching.co.uk. Because your club is the controller for club data, we process your request on the club’s behalf and keep the club informed — you don’t need to contact the club separately. We aim to respond within 5 working days (the legal limit is one month).

Right	What you can do
Access (Art 15)	Download a copy of your data (JSON/CSV)
Rectification (Art 16)	Correct inaccurate data
Erasure (Art 17)	Delete your account and most data; some safeguarding records are kept for statutory reasons
Restriction (Art 18)	Pause processing during a dispute
Portability (Art 20)	Take your data elsewhere
Objection (Art 21)	Object to legitimate-interests processing (e.g. coach ratings, analytics)

You can withdraw any consent at any time; withdrawal stops future processing but doesn’t undo the past. If you’re 13–17 you exercise your own rights; a parent can help you do so.

10. Complaints

You can complain to the ICO (ico.org.uk/make-a-complaint, 0303 123 1113) about data protection, or to Ofcom (ofcom.org.uk) about online safety. We’d appreciate the chance to fix things first — dpo@4cmcoaching.co.uk — but you don’t have to.

11. Security

HTTPS everywhere; AES-256 encryption at rest for sensitive fields; row-level security segregating data by user, club and team; role-based access controls; MFA for staff; audit logging on sensitive access; regular security reviews and penetration testing. Suspected compromise: security@4cmcoaching.co.uk.

12. Changes to this notice

We update the date at the top, email you about significant changes, and show an in-app notice at next sign-in. Changes affecting lawful bases or introducing new providers trigger a fresh consent check where required.

13. Contact

General	support@4cmcoaching.co.uk
Data Protection Officer	dpo@4cmcoaching.co.uk
Data subject requests	Settings → Privacy, or email the DPO
Security	security@4cmcoaching.co.uk
Postal	4CM, Inc., c/o Northwest Registered Agent Service, Inc., 8 The Green, Ste B, Dover, DE 19901, United States. Formal service only — email reaches us far faster.

---

Glossary

• Controller — decides why and how personal data is used (your club, for club data)
• Processor — handles data on the controller’s instructions (4CM, and our sub-processors)
• UK-GDPR / DPA 2018 — the UK’s data protection law
• Special category data — extra-sensitive data (e.g. health) with heightened protection
• PECR — UK rules for cookies and electronic marketing
• ICO / Ofcom — the UK data protection and online safety regulators
• DBS — Disclosure and Barring Service criminal-record check
• FA — The Football Association