Loading Starting XI...
Effective May 26, 2026
Applies to the SXI Website (sxi-app.vercel.app) and the SXI Recruiting Platform
Starting XI - College Soccer Recruiting LLC ("Company," "Starting XI," "SXI," "we," "us," or "our") respects your privacy. This Privacy Policy explains how we collect, use, share, and protect personal information when you use our website, the SXI recruiting platform, and any related applications, tools, features, and services (collectively, the "Services").
We do not sell your personal information to advertisers or data brokers — ever. We do not use your personal information for cross-context behavioral advertising. We collect only the information needed to operate the Services and support your college recruiting process.
This Privacy Policy applies to information we collect through the Services. It does not apply to third-party websites or services that may be linked from our platform; those have their own privacy practices.
By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you are a parent or legal guardian of a user under the age of 18, you are also acknowledging this Privacy Policy on behalf of the minor.
We collect the following categories of information:
2.1 Account Information. Name, email address, hashed password, account role (Student, Parent/Guardian, or Company Staff), and date of account creation.
2.2 Student Athlete Profile. Information you provide to build your recruiting profile, including graduation year, primary playing position, gender, date of birth, GPA and academic information, intended major or academic interests, current club team and competition level (for example, ECNL or MLS Next), athletic history, and recruiting preferences.
2.3 Parent/Guardian Information. For users under 18 and for parent-linked accounts, we collect the parent or legal guardian's name, email address, and phone number for purposes of consent, account oversight, and billing.
2.4 Recruiting Activity. Your target school list, recruiting stage and status, outreach history, coach replies, camp and showcase interest, and notes you record on the platform.
2.5 Video Information. Links (URLs) to videos you submit, along with descriptive metadata you provide. We do not host video files; we store the links and information about them.
2.6 Gmail Account Data (Optional). If you connect a Gmail account, we collect your Gmail address and the Google OAuth tokens that authorize Starting XI to act on your behalf (stored encrypted at rest — see Section 3.3), along with recruiting-related email content (emails sent through the Services and coach replies received).
2.7 Platform Communications. Messages exchanged between you, your linked parent or guardian, and Company staff through the platform's messaging features.
2.8 Educational Content Activity. Your progress through the interactive recruiting textbook, including chapter completion, checklist items, and journal entries you author.
2.9 AI Chatbot Interactions and AI-Assisted Content. Questions you submit to the AI chatbot, prompts you provide to AI email-drafting features, and the responses each returns. In the de-identified and aggregated form described in Section 5A, we may use these interactions to operate, evaluate, and improve the Services, including through the training and refinement of AI models that support the Services. We do NOT use identifiable minor data for any AI training purpose (see Section 5A.3).
2.10 Technical Information. IP address (logged at events such as email opens, link clicks, and account sign-in), browser type and user agent, device type, operating system, approximate location based on IP, time zone, and platform activity logs.
2.11 Billing Information. If you purchase paid Services, billing is managed by the Company outside the platform. We retain limited billing contact information, invoice records, and payment confirmation status. We do not store full credit card numbers on our systems.
2.12 Communications with Us. When you contact us by email, support form, or chat, we retain the content of those communications for support and recordkeeping purposes.
Our platform connects to your Gmail account directly through Google's Gmail API. Starting XI is the OAuth client: when you connect your Gmail account, you authorize Starting XI through Google's standard OAuth 2.0 flow, and no third-party email infrastructure provider sits in between. Your email content flows between Starting XI and Google's servers as part of normal Gmail operation. Starting XI also uses Google Cloud Pub/Sub (a Google service) to receive notifications when new mail arrives in your connected inbox.
3.1 Scopes Requested. The Gmail API scopes we request are: gmail.send (to send recruiting outreach emails on your behalf) and gmail.readonly (to read and classify incoming coach replies). We request no broader Gmail scopes — in particular, nothing that can modify or delete your mail. These scopes are used solely for your college soccer recruiting activity.
3.2 What We Access. We access only emails to and from college coaches on your target school list. Non-recruiting messages are not retained or made available to Company staff except where strictly necessary (for example, to investigate a security incident or comply with law). Automated processing classifies incoming messages to identify recruiting-related replies.
3.3 Where Your Tokens Are Stored. Your Google OAuth access and refresh tokens are held by Starting XI, stored in our database encrypted at rest with AES-256-GCM. The decryption key is held separately in our hosting environment's configuration, and the encrypted token values are not readable by user-facing application sessions. Tokens are used solely to perform the actions described in this Section 3 on your behalf.
3.4 No Selling, No Ads, No Human Reading (with Exceptions). We do not use your email data for advertising. We do not sell your email data. We do not allow humans to read your email content except (i) with your affirmative consent, (ii) as necessary for security purposes such as investigating abuse, (iii) to comply with applicable law, or (iv) where the data has been aggregated and anonymized for internal operations.
3.5 Disconnection. You can disconnect your Gmail account at any time through Settings → Connected Accounts or by emailing Getstarted@sxirecruiting.com. Disconnecting immediately revokes Starting XI's authorization with Google and deletes the OAuth tokens stored on our side, stopping all Gmail API access for your account. Email content already retained on the platform is handled according to our retention rules in Section 9.
4.1 Service Directed to Minors. Our Services are intended primarily for high school and middle school student athletes, many of whom are under 18. We design the Services with this audience in mind.
4.2 Children Under 13 — COPPA. We do not knowingly collect personal information from children under 13 without verifiable parental consent. Before a user under 13 may create an account or have personal information collected through the Services, we require:
4.3 Parent Rights. A parent or legal guardian of a user under 13 may, at any time: (a) review the child's personal information collected through the Services; (b) request that we delete the child's personal information; or (c) refuse to permit further collection or use of the child's personal information. Requests should be sent to Getstarted@sxirecruiting.com.
4.4 Users 13 to 17. For users between 13 and 17, we require parental or guardian involvement consistent with our Terms of Service. A parent or guardian must agree to our Terms on behalf of the minor and is given a linked read-only account with the ability to monitor recruiting activity.
4.5 No Behavioral Advertising. We do not engage in any form of behavioral advertising or build advertising profiles based on minors' activity. We do not share minor users' personal information with advertising networks, data brokers, or third-party advertisers.
4.6 Enhanced Parental Controls for Minor Users. In addition to the rights set forth in Sections 4.2 and 4.3, parents and legal guardians of minor users have the following operational controls through the linked parent account and the platform Parent Settings interface:
4.7 Coach–Student Communication Framework. Direct communication between the minor student athlete and Company coaches through the SXI platform is an intentional element of Company's coaching model. All such communications are governed by the Coach–Student Communication and Safe Messaging Policy, which addresses coach background-check standards, prohibited communications, mandatory reporting under Cal. Penal Code §§ 11165–11174.3, and incident response. The parent-linked account provides monitoring and control per Section 4.6 but does not participate as the student in coach communications.
We use the information we collect to:
We do not use your personal information for advertising or behavioral profiling, and we do not sell or rent your personal information. We do not use AI chatbot interactions or user profile data to train third-party AI models in any way that would expose your individual information to the model provider for general training purposes.
5A.1 Purpose. Company uses artificial intelligence and machine-learning features to deliver the Services (including the chatbot, email-reply classification, and email draft assistance). To improve those features over time, Company may use certain user interaction data — subject to the strict de-identification requirements in this Section 5A — to train and refine AI models used in the Services.
5A.2 De-Identified and Aggregated Only. Company uses only de-identified and aggregated data for AI model training and improvement. Before any user interaction data is admitted to Company's training corpus, Company removes all direct identifiers, including name, email address, hashed and unhashed passwords, date of birth, school name, current club team, geographic location, IP address, video links, unique account identifiers, and any content strings that could reasonably link the interaction to a specific user (collectively, "Direct Identifiers"). Company then aggregates the resulting data such that individual sessions cannot be reconstructed and no individual user can reasonably be re-identified.
5A.3 Absolute Prohibition on Identifiable Minor Data. Company does not use identifiable personal information of any user under the age of 18 for AI training purposes. This prohibition applies regardless of the type of interaction (chatbot, email drafting, coaching messages, journal entries, or any other feature) and CANNOT be overridden by parental consent, opt-in, or any other user action. This prohibition is a design constraint enforced at the data-pipeline level, not a policy commitment that could be inadvertently violated by staff action.
5A.4 De-Identification Standard. Company's de-identification methodology follows the standards described in NIST Special Publication 800-188 (2023, "Trustworthy AI") and the Federal Trade Commission's guidance on de-identification of children's data under the COPPA Rule (16 C.F.R. Part 312). De-identified data is not "personal information" under COPPA (16 C.F.R. § 312.2), the California Consumer Privacy Act as amended by CPRA (Cal. Civ. Code § 1798.140(v)), or applicable state youth-privacy laws.
5A.5 No Sale, No Sharing, No Third-Party Model Training. Company does not sell or share de-identified training data with third parties. Company's contractual arrangement with OpenAI (see Section 6.1) excludes SXI-submitted content from OpenAI's general-purpose model training under OpenAI's API terms then in effect. Company does not permit any third-party AI or machine-learning provider to use SXI training data to improve its own general-purpose models.
5A.6 Adult User Opt-Out. Users who are 18 or older may opt out of having their de-identified interaction data included in Company's training corpus at any time through Settings → Data Preferences or by emailing Getstarted@sxirecruiting.com. Minor users are effectively opted out of identifiable training data by Section 5A.3 as a matter of design; aggregated statistical trends across the user base may still inform Service improvements without violating this Section.
5A.7 Retention of De-Identified Training Data. De-identified and aggregated training data may be retained indefinitely for research, model improvement, and Service enhancement purposes, consistent with Section 9.6.
5A.8 Deletion Requests and AI Training. A deletion request under Section 10 or applicable law does not require Company to alter or retrain existing AI models, because no identifiable minor data has been used for training. If Company ever changes this practice, this Section 5A must be updated to describe the new practice and Company must implement a technically feasible deletion mechanism at that time, subject to Company- and counsel-level approval.
5A.9 Prohibition on RAG and Fine-Tuning Using Minor Data. Company does not use identifiable minor data in retrieval-augmented generation ("RAG"), fine-tuning, or similar model-adaptation pipelines. If Company deploys any such feature in the future, this Section 5A must be updated before deployment and Company must confirm that no identifiable minor data is included in the pipeline.
We share personal information only with the following categories of recipients and only as needed to operate the Services or as required by law:
6.1 Service Providers (Sub-Processors). We rely on a small number of vendors to host and operate the Services. These vendors are contractually limited to using your information only for the purpose of providing services to us. As of the Effective Date, our key sub-processors are:
This list may change as our Services evolve. The current list of sub-processors is available on request by emailing Getstarted@sxirecruiting.com. Material changes that involve new categories of recipients will be disclosed through an update to this Privacy Policy in accordance with Section 13.
6.2 College Coaches and Programs. When you use the outreach features, content you send (emails, profile links, video links) is delivered to the college coaches you choose to contact. Once delivered, the recipient's use of that information is governed by their own institution's practices, not by this Privacy Policy.
6.3 Linked Parent or Guardian Accounts. If your account is linked to a parent or guardian account, that parent or guardian has read-only access to the student's profile, recruiting activity, and communications visible on the platform, as described in our Terms of Service.
6.4 Scheduling Links (Calendly). Our website and platform include links to scheduling pages hosted by Calendly, a third-party scheduling service. When you click a booking link and interact with Calendly, you are navigating to Calendly's own website and any information you provide (such as your name, email address, and meeting preferences) is collected and processed by Calendly under their own privacy policy, not this one. Starting XI does not receive or store the personal information you submit directly to Calendly.
6.5 Company Staff. Authorized Company staff access your information solely as needed to deliver Services under your Client Service Agreement, support your account, or respond to inquiries. Staff are subject to confidentiality obligations.
6.6 Legal Disclosures. We may disclose information when required by law, court order, subpoena, or other legal process; to enforce our Terms of Service or Client Service Agreement; to protect the rights, property, or safety of Company, our users, or others; or to investigate suspected fraud, security incidents, or violations of applicable law.
6.7 Business Transfers. If we are involved in a merger, acquisition, financing, sale of assets, or similar transaction, your information may be transferred as part of that transaction. We will notify you (by email or by an in-product notice) of any change in ownership or use of your personal information.
6.8 With Your Consent. We may share personal information for purposes not described in this Policy with your consent.
6.9 We Do Not Sell. We do not sell or rent personal information to advertisers, data brokers, or marketers. We do not engage in cross-context behavioral advertising. We have not sold or shared personal information for advertising purposes in the preceding twelve (12) months.
7.1 Where We Store Data. Personal information is stored on servers located in the United States. By using the Services, you consent to the transfer and storage of your information in the United States, which may have data protection laws that differ from those in your country of residence.
7.2 How We Protect Data. We use industry-standard administrative, technical, and physical safeguards designed to protect personal information, including:
7.3 No Guarantee. No method of transmission or electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee absolute security. If we become aware of a security incident that affects your personal information, we will notify you as required by applicable law.
We retain personal information for as long as needed to provide the Services and for legitimate business or legal purposes:
9.1 Active Accounts. For active accounts, we retain personal information for the duration of your service term plus twelve (12) months, unless you request earlier deletion or a shorter period is required by law.
9.2 Gmail OAuth Tokens. Upon disconnection of your Gmail account, Starting XI immediately revokes its authorization with Google and deletes the encrypted OAuth tokens from our database. Revocation at Google invalidates the tokens themselves, so no copy — ours or otherwise — remains usable.
9.3 Email Content. Recruiting-related email content is retained during the service term. Following account closure, you may request export within thirty (30) days. After that period, email content is deleted, except where retention is required by law.
9.4 Platform Messages. Same retention schedule as email content.
9.5 Billing Records. Retained for seven (7) years following the last transaction to comply with tax and financial recordkeeping obligations.
9.6 De-Identified Data. We may retain de-identified, aggregated data indefinitely for analytics, service improvement, and research, provided that it cannot reasonably be linked back to you.
9.7 Backups. Information may persist temporarily in encrypted backup systems following deletion and will be purged on our standard backup rotation, generally within ninety (90) days.
Subject to applicable law and verification of your identity, you have the following rights with respect to personal information we hold about you:
How to Exercise Rights. Submit requests to Getstarted@sxirecruiting.com. We will respond within ten (10) business days for routine requests and within forty-five (45) days for requests under the California Consumer Privacy Act (extendable by an additional forty-five (45) days where reasonably necessary, with notice to you). We may need to verify your identity before fulfilling certain requests.
Authorized Agents. California residents may designate an authorized agent to make requests on their behalf. We may require the agent to provide proof of authorization and may require you to verify your identity directly.
This section provides additional disclosures required under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA").
11.1 Categories of Personal Information Collected. In the preceding twelve (12) months, we have collected the following categories of personal information defined under the CCPA: identifiers (name, email, IP address); customer records (account information, billing contact); characteristics of protected classifications (age and grade level for purposes of services delivery); commercial information (transaction history); internet or other electronic network activity information (platform activity, email engagement); geolocation data (approximate, based on IP); audio, electronic, or visual information (video links you provide); professional or athletic information (recruiting profile, target schools); inferences drawn from the foregoing (program-fit scoring, recruiting-stage status); and sensitive personal information limited to account credentials and Google OAuth tokens for Gmail access (held by Starting XI, encrypted at rest).
11.2 Sources. We collect this information directly from you, from your parent or guardian where applicable, from your activity on the Services, and, in limited cases, from college coaches who reply to your outreach.
11.3 Purposes. As described in Section 5.
11.4 Sale and Sharing. We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We have not sold or shared personal information in the preceding twelve (12) months.
11.5 Sensitive Personal Information. We do not use or disclose sensitive personal information for purposes other than those permitted under California Civil Code section 1798.121.
11.6 Your CCPA Rights. California residents have the rights described in Section 10, plus the right to be free from discrimination for exercising privacy rights. We will not deny services, charge different prices, or provide a different level or quality of services because you exercised your CCPA rights.
11.7 Shine the Light. California Civil Code section 1798.83 ("Shine the Light") permits California residents to request information about disclosures of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.
The Services are operated from the United States and are intended for users located in the United States. We do not target the Services to residents of the European Union, the United Kingdom, or other jurisdictions outside the United States.
If you access the Services from outside the United States, you do so on your own initiative and at your own risk. You are responsible for compliance with applicable local laws. By using the Services, you consent to the transfer of your personal information to the United States, which may not provide the same level of data protection as your country of residence.
Residents of the European Economic Area, United Kingdom, or Switzerland. If you are a resident of the EEA, UK, or Switzerland and believe that data protection laws of your jurisdiction apply to our processing of your information, please contact us at Getstarted@sxirecruiting.com before using the Services. We will work with you in good faith to address your inquiry, including by limiting our processing or directing you to alternative services if appropriate. Nothing in this Privacy Policy is intended to waive any non-waivable right you may have under applicable data protection law.
We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable advance notice (at least fourteen (14) days) by email or through the Services before the changes take effect. The "Last Updated" date at the top of this Policy indicates when the Policy was most recently revised. Your continued use of the Services after the effective date of an updated Policy constitutes acceptance of the changes.
Questions or requests regarding this Privacy Policy may be directed to:
California residents may also contact the California Department of Consumer Affairs and the California Privacy Protection Agency: