Privacy Policy

1. Who we are

Ezhar is a football talent discovery platform for players in Egypt. We film players at assessment sessions, score their drills with an automated analysis system, and show the resulting profiles to football clubs and academies.

The controller of your personal data is:

• [إظهر: الكيان القانوني تحت التأسيس / Ezhar, legal entity to be registered]
• Commercial register: [TBD]
• Registered address: [TBD]
• Data Protection Officer: [TBD], privacy@ezhar.io
• Privacy contact: privacy@ezhar.io

We process personal data under Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations (Prime Ministerial Decree No. 816 of 2025).

2. Who this policy is for

• Players who create an Ezhar account, or who claim an account we created for them after filming them at an assessment session.
• Parents and legal guardians whose details we hold as part of a player's account, and who give consent on a player's behalf.
• Visitors to our website.

Club and academy staff who use our dashboard are covered by the agreement between Ezhar and their club, not by this policy.

3. Age, and consent given by a guardian

Ezhar is built for young footballers. Because of that, age is not a detail here: it changes who is legally able to agree to any of this.

• Under 13: you may not hold an Ezhar account.
• 13 to under 15: your parent or legal guardian must give explicit consent before we collect anything about you. The app collects your guardian's name, phone number and relationship to you, and your guardian confirms consent before the account is created. We record who consented, which version of these documents they saw, and when.
• 15 to under 18: you may consent yourself, or your guardian may consent for you, in line with the mechanisms set by the Personal Data Protection Centre. We still ask for guardian contact details so a guardian can reach us.
• 18 and over: you consent for yourself.

Egyptian law treats all data about a child as sensitive personal data. We treat it accordingly: minimum collection, restricted access, and no use for purposes you were not told about.

A guardian may withdraw consent at any time by contacting us at privacy@ezhar.io. Withdrawal stops future processing and, if you ask, results in deletion of the account.

4. What we collect

Information you or your guardian give us:

• Identity: first and last name, date of birth, gender, phone number.
• Guardian: name, phone number and relationship to the player; a second guardian if provided.
• Account: password (stored only as a cryptographic hash, never in readable form), app language.
• Football profile: playing position, preferred foot, height, weight, governorate, current club, short bio, profile photo.
• Age verification: a photograph of your birth certificate or national ID, and a selfie where we need to match the document to you.
• Payment: amount, currency and the reference of the transaction. We never see or store your card number; payment is taken on PayTabs' own secure page.
• Support: anything you write to us.

Information we create when you use Ezhar:

• Drill videos, whether you record them yourself or our assessor films you, plus technical capture details (resolution, frame rate, orientation, time of recording).
• Any highlight clips you choose to upload.
• Assessment results: scores per drill, an overall score, the attribute breakdown (speed, acceleration, agility, power, endurance, technical), your percentile within your age and gender group, a confidence flag, and short written feedback.
• Character profile, if you choose to take it: your answers, the resulting scores and archetype.
• Applications: which trials and assessment sessions you applied to, their status and outcome.
• Club activity: notes, shortlisting and decisions recorded about you by club staff.
• Your conversation with the AI coach, if you use it.
• Messages: the SMS and WhatsApp messages we send you and their delivery status, and in-app notifications.
• Your device push notification token.
• Crash and error reports, automatically stripped of phone numbers and passwords before they leave your device.

Information from other people:

• From our assessors at a session: your name, date of birth, phone number, gender, bib number, a photo of your identity document, a photo of your face wearing your bib (which becomes your profile photo until you upload your own), and the drill videos we film.
• From your academy or club, when it enrols you in a session it has arranged.
• From club staff, when they record a note or a decision about you.

5. How we use it, and why we are allowed to

• Creating and running your account (sign-up, passcodes, sign-in, support): performance of a contract with you.
• Verifying your age by human review of your identity document: your explicit consent, and our legal duty to protect children.
• Scoring your drills by automated analysis: performance of a contract with you.
• Showing your profile to clubs and academies, including the access clubs pay us for: your explicit consent, and your guardian's where you are under 15.
• Releasing your contact details to a club: your separate explicit consent, which you can withdraw, and your guardian's where you are under 18.
• Character profile, and showing it to clubs if you allow it: your separate explicit consent.
• Trials, sessions, payments and refunds: performance of a contract with you.
• Messaging you with passcodes, application updates and results: performance of a contract with you.
• Safety and security, including flagging a message that suggests a player is at risk of harm: our legitimate interest in a safe service, and protecting a person's vital interests.
• Improving the scoring system: our legitimate interest, using de-identified data only.
• Legal and accounting obligations: compliance with a legal obligation.

We do not sell your personal data to data brokers, we do not use your data for advertising, and we do not share it with advertising networks.

6. How the automated scoring works

What the system reads: our analysis software takes each drill video and extracts two things, the positions of your body joints over time and the position of the ball. It works from those coordinates. It does not perform face recognition, and it does not attempt to identify you from your appearance. The assessment-day photo is an ordinary picture shown to people; no software reads faces from it.

What we keep: the video is copied to a temporary location while it is being analysed and deleted as soon as the analysis is done. What is stored is the measurements and the scores, plus the original video in our private storage where only you, our staff, and clubs per section 7 can reach it.

Improving the models: when we measure or improve the accuracy of scoring, we use measurements and scores separated from your name and phone number. We do not need to know who you are to check whether a jump height was measured correctly.

No decision is made about you by a machine alone. A score is information put in front of a human scout. Every invitation, rejection and referral in Ezhar is made by a person at a club, not by the system. You can ask us to explain how a score was produced, and to have a low or unusual score reviewed by a human, at privacy@ezhar.io.

Scores can be wrong. Every score carries a confidence flag, and results from poor-quality footage are marked as such. A score is an opinion produced by software, not a fact about your ability.

7. Who can see your data

You, on everything in your profile, in the app.

Approved football clubs and academies. This is the point of Ezhar, and we want you to understand its actual scope before you agree to it:

Clubs pay a subscription or fee to Ezhar for this access. Paying gives a club a larger or better-organised view of the same database; it does not give any club ownership of your data, exclusivity over you, or the right to pass your details to anyone else.

What they can see: your name, age, gender, governorate, position, preferred foot, height, weight, profile photo, your scores and percentile, your drill videos and your highlights. They can record private notes about you and shortlist you.

What they cannot see: your phone number, your guardian's details, your identity document, your password, your payments, or your conversations with the AI coach. Your character profile is shown to clubs only if you turn that setting on, and you can turn it off at any time.

Releasing your contact details to a club: a club that wants to reach you directly, whether for a trial, an offer or a conversation, needs your phone number or your guardian's. We treat that as a separate decision from being listed in Discovery:

• We do not give any club your contact details as part of its paid access. Paying to browse the database and being able to phone a 14-year-old are not the same thing, and we do not let a fee buy the second one.
• We release contact details only with a specific opt-in. For a player under 18 that opt-in must come from the guardian, and the number we release is the guardian's, not the player's.
• It is per release and revocable. You can see which clubs have received your details and switch it off at any time.
• A club that receives your details may use them only to contact you about football opportunities with that club. It may not resell them, pass them to another club, or use them for marketing. This is a written condition of its contract with us, and breaking it ends the club's access.
• The alternative route stays open: a club can invite you through the app without ever holding your number, and you decide whether to accept.

The academy that filmed you receives your results, because it organised and paid for the assessment; it does not get access to the Ezhar dashboard. Ezhar staff and assessors see what they need to run sessions and support you, limited by role. Our service providers are listed in section 9. Authorities see data where Egyptian law requires it, or to protect someone's life or safety.

We never publish your profile publicly, and there is no public leaderboard, without your separate opt-in.

8. Sensitive data

Under Egyptian law the following categories of what we hold are sensitive personal data, and we handle each with explicit consent and restricted access:

• All data about a player under 18, because it is a child's data.
• Your identity document, held in private storage that is not publicly reachable, and viewable only by the small number of staff who perform verification.
• Your character profile, which is psychological self-report data. It is optional, it is never required to use Ezhar, and sharing it with clubs is a separate switch you control.
• A message flagged as suggesting risk of harm: if something you write to the AI coach suggests you may be in distress, it is flagged for a human at Ezhar to look at, so we can respond responsibly.

We do not collect health records, religious or political views, criminal history, or biometric identifiers used to identify you.

9. Who processes data for us, and transfers outside Egypt

We use the following providers. Each processes data only on our instructions.

• Supabase: database, accounts, file storage for identity documents. Location: [TBD].
• Cloudflare: storage and delivery of drill videos and highlights, and hosting of our website and club dashboard. Global network.
• PayTabs Egypt: card payments. Card details go to PayTabs, never to us. Egypt.
• SMSMisr: SMS delivery of passcodes and notices. Egypt.
• Meta (WhatsApp Business): WhatsApp delivery of claim links and notices. Outside Egypt.
• Expo, Apple and Google: push notification delivery. Outside Egypt.
• OpenRouter and the AI model provider behind it: the AI coach. Receives your first name, position, age group, scores and what you type to the coach. It does not receive your phone number, surname, guardian details or videos. Outside Egypt.
• Sentry: crash and error diagnostics, with phone numbers and passwords stripped before sending. Outside Egypt.

Transfers outside Egypt: some of these providers store or process data outside Egypt. Where we transfer personal data abroad we do so under the conditions Egyptian law allows, on the basis of your explicit consent and contractual commitments from each provider to protect the data and to process it only for us. Our licence reference for cross-border transfer is [TBD].

10. Marketing and notifications

We send you passcodes, application updates, session details and results because you need them to use the service. You can control which notifications you receive from the Notifications screen, and you can turn off push notifications in your device settings.

We will not send you marketing messages, and we will not pass your number to anyone else for marketing.

11. How long we keep it

• Account and profile: while your account is open, and for 24 months after your last sign-in, then deleted or anonymised.
• Drill videos and highlights: while your account is open. A video you replace is deleted immediately.
• Scores and assessment results: while your account is open, then kept only in de-identified form for accuracy measurement.
• Identity document: deleted within 90 days of the verification decision. We keep only the outcome and the date.
• Assessment-day photo: while your account is open; replaced as your profile picture the moment you upload your own.
• Character profile: while your account is open.
• One-time passcodes: 5 minutes, then expired and purged.
• Message delivery logs: 12 months.
• AI coach conversations: 12 months.
• Crash diagnostics: 90 days.
• Payment and accounting records: 5 years, as Egyptian commercial and tax law requires.

If you ask us to delete your account we act within 30 days, except for records we are legally required to keep.

12. How we protect it

Data is encrypted in transit. Access to the database is governed by row-level security rules, so a player account can only ever read its own data and a club can only reach what section 7 describes. Identity documents sit in private storage requiring a signed, time-limited link. Staff access is limited by role. Passwords are stored only as hashes. Sign-in is protected by one-time passcodes with attempt limits and rate limiting.

If a breach happens that puts your data at risk, we notify the Personal Data Protection Centre within 72 hours of becoming aware of it, and we tell you within 3 working days of that notification where the risk to you is significant.

13. Your rights

Under Egyptian law you have the right to:

• Be told what we hold about you and what we do with it: this document.
• Access a copy of your data.
• Correct anything inaccurate. Some fields are locked once age verification starts (your name and date of birth), so that a verified identity cannot be altered afterwards; ask us and we will correct a genuine error.
• Delete your data.
• Restrict or object to processing, including asking us to stop showing your profile to clubs while keeping your account.
• Withdraw consent at any time. Withdrawing does not undo processing that already happened lawfully.
• Receive your data in a portable form.
• Complain to the Personal Data Protection Centre, and to seek compensation through the courts for harm caused by unlawful processing.

To exercise any of these, contact privacy@ezhar.io. We respond within 30 working days. There is no charge. If you are under 15, your guardian exercises these rights for you.

14. Deleting your account

Email privacy@ezhar.io from the phone number or email on the account, or contact us from within the app, and ask for deletion. We will confirm your identity, then delete your profile, videos, highlights, character profile and coach conversations within 30 days. We keep payment records for the 5 years the law requires, and we keep assessment measurements in a form that is no longer linked to you.

Deleting removes your profile from club Discovery. It does not oblige a club to delete notes it lawfully recorded in its own systems before deletion.

15. Changes to this policy

If we change how we use your data in a way that matters, we will tell you in the app and ask for your consent again before the change applies to you. Minor corrections are published with a new version number and date. The version you agreed to is recorded on your account.

16. Contact us

• Privacy and data rights: privacy@ezhar.io
• Data Protection Officer: [TBD], privacy@ezhar.io
• Anything else: support@ezhar.io
• Address: [TBD]

You may also complain directly to Egypt's Personal Data Protection Centre.