Privacy Policy — The Athlete Spotlight

Site: theathletespotlight.com Effective date: September 1, 2026

The whole policy in one box

We collect what you type into our free brand audit and what you give us as a member: your name, sport, school or team, city, social handles, up to 3 photos, your email and, only for an adult who separately opts in to SMS tips and updates, a phone number. We use it to produce an informational brand-readiness score and report, build and maintain the managed website if you join, and email the report to the eligible contact address. We store it on Amazon Web Services in the United States. We never see or store your card number. We never sell your personal data. We block anyone under 13 before any personal information or photos are collected. We do not run a verifiable-parental-consent program. If you are 13–17, a parent or legal guardian must control the contact email and account; before any public content or marketing likeness use, the athlete must assent and the guardian must approve. A checkbox that says a parent is present is a self-attestation, not verified parental consent. To fix or delete your data, email us — details in Section 7. Google Tag Manager may receive ordinary connection metadata when its consent-controlled container loads; Google Analytics 4 stays blocked unless someone 18+ or a parent or guardian allows analytics. Advertising tracking stays off.

1. Who we are

The Athlete Spotlight provides a managed personal website so approved athlete information has one organized public home. The hosted WordPress site is operated within our managed environment, and any included standard new .com remains in Your Content Factory LLC’s registrar account until an eligible transfer under the Terms; customers control approved content but do not receive WordPress administrator or registrar-account access by default. We do not guarantee recruiting, sponsorships, NIL deals, fame, or income — and nothing in this policy changes that.

The Athlete Spotlight is operated by Your Content Factory LLC, a Nevada limited liability company, operating Athlete Spotlight (“we,” “us,” “our team”).

Mail: Your Content Factory LLC, 2605 S Decatur Blvd Ste 123 PMB 1061, Las Vegas, NV 89102

Email: operations@localservicespotlight.com or operations@blitzmetrics.com

In plain English: We're the team that builds and maintains athlete websites. This page explains what information we collect and what we do with it.

2. What we collect and why

The free instant audit

When you run our instant brand audit, we ask for:

What	Why we ask
Name	To search for how you show up online and personalize your report
Sport	To score your presence in the right context
School or team	To match you to the right rosters, results, and search terms
City	Same reason — location changes what "findable" means
Social handles	To look at your public profiles as part of your score
1–3 uploaded photos	To evaluate visual presence for the private audit. Uploading does not authorize publication. If you later join, site use requires a separate publication approval under Section 4.
Email	To send you your full report
Phone (optional)	Adults only: to send SMS audit tips and updates if the adult separately gives affirmative SMS consent. We do not use this field to imply consent to calls or general outreach, and it can be skipped.

You can see a preview of your score without giving us your email. We ask for your email only to save and send the full report. For an athlete age 13–17, a parent or legal guardian must enter and control that contact email.

We do not collect any of the information in this table from anyone under 13. Age is established first. See Section 3.

If you become a member

If you join, we also collect content approved for your managed website: bios, stats, clips, achievements, and contact preferences. For an athlete age 13–17, publication requires recorded athlete assent and parent or legal guardian approval. Membership is $30 per month, with no join fee, and renews monthly until canceled under the Terms of Service.

To protect the account, a cancellation-request receipt remains pending until we verify that the requester controls the account email and match that verified email to the account. For an account covering an athlete age 13–17, verification must use the guardian-controlled account email. The cancellation handler records the submitted account email, receipt ID, UTC timestamps, workflow status, and operations/requester email-delivery status. It uses short-lived hashed rate-limit keys and does not add the raw request IP address to the cancellation receipt. The cancellation rules are in the Terms of Service.

Payment

Payments are processed by Keap (Infusionsoft). We never see or store your card number. Keap handles the card; we receive confirmation that you paid, your name, and your email so we can start your service.

Automatic and technical data

Like most websites, our servers and providers log basic technical data (IP address, browser type, pages visited) to keep the site working and secure. If you arrive through a campaign or partner link, we may preserve non-sensitive attribution markers such as utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid, gbraid, wbraid, msclkid, fbclid, or ref through checkout so we can understand which content led to a signup — see Section 9.

The Google Tag Manager container bootstrap may load before you make an analytics choice so the site can enforce consent and load only approved tags. That request necessarily shares ordinary connection metadata such as IP address, browser or user-agent information, and referrer with Google. Google Analytics 4 tags and events remain blocked, and analytics identifiers or cookies are not set, unless someone 18+ or a parent or guardian allows analytics. Section 9 has the full details and withdrawal instructions.

In plain English: We collect what you type into the audit form, the photos you upload, and the content you approve for your site. Payment card numbers go to Keap, not us.

3. Kids, teens, and parents

Most of our users are athletes 13 and older and their parents. One age rule, used everywhere:

Under 13: We do not offer the audit or membership to children under 13. We block the form before any personal information or photos are collected — no name, school, city, social handles, photos, email, or phone. We do not collect from a child under 13 under a verifiable-parental-consent program, and we do not run one. If we learn we received personal information from a child under 13, we delete it.
13–17: A parent or legal guardian must accept the Terms, pay, hold the account, and control the contact email, cancellation, and transfer decisions. Before any public content or marketing likeness use, we require the athlete’s assent and the guardian’s approval to be recorded. If the free-audit form asks someone to confirm that a parent or guardian is present, that confirmation is a self-attestation; it is not identity or authority verification.
18+: The athlete may use the audit and, if they join, may be the account holder.

Analytics age rule: Someone under 13 may not allow analytics. For a visitor age 13–17, a parent or legal guardian must make the analytics choice. Someone 18 or older may make their own choice.

United States law (COPPA) treats names, photos, social handles, and phone numbers as children’s personal information. That is why we block under-13 use before collection, rather than collecting from a child after a parent says yes.

If you are a parent and believe we collected your child’s information in a way you did not approve, email the addresses in Section 13. We will investigate and delete it where required.

In plain English: Under 13? The form stops before we take a name or a photo — we are not running a “parent says yes, then we collect” program for kids under 13. 13–17? A parent or legal guardian accepts the Terms, holds and controls the account, and the athlete must assent before public content or marketing likeness use. 18+? You can contract for yourself. A checkbox is not a verified consent system.

4. Photos and publishing your information

Uploading photos to the audit does not give us permission to publish them. Publishing works like this:

Nothing about an athlete goes on a public website we build until the required approval is recorded. An adult athlete approves for themselves. For an athlete age 13–17, both the athlete’s assent and the parent or legal guardian’s approval are required.
Photo rights matter: only upload photos you have the right to use. If a photographer took it, you need their permission.
The athlete may withdraw assent, and an adult athlete or the parent or legal guardian controlling an account for an athlete age 13–17 may withdraw publication approval. We will take the content down from sites we control within a reasonable time. We cannot un-publish copies other people or search engines already made — that is an honest limit of the internet, not a loophole we use.
Audit scores are private by default. We do not publish a score or public ranking entry without an eligible explicit opt-in. For an athlete age 13–17, that requires both recorded athlete assent and parent or legal guardian approval.

In plain English: Uploading a photo lets us look at it for your audit. Putting anything about an adult athlete on a public site requires that athlete’s separate approval. For an athlete age 13–17, it requires both the athlete’s assent and the parent or legal guardian’s approval. You can change your mind later.

5. Where your data lives and how AI is used

Audit storage: Your audit answers and uploaded photos are stored in Amazon Web Services (AWS) in the United States (us-east-1 region) — form data in DynamoDB (a database) and uploaded photos in S3 (file storage).
Managed-site and cancellation storage: Approved site content and the cancellation-receipt fields described in Section 2 are stored in the managed WordPress environment.
AI scoring: Your audit is scored using AWS Bedrock, an AI service. Your inputs are sent to Bedrock to generate your score and report. Under AWS's terms, Bedrock does not use customer content to train its models.
Security: We use HTTPS and access controls. No online service can promise perfect security, and we won't pretend otherwise. If a breach affects your personal data, we will notify you as required by law.
International visitors: If you use the site from outside the US, your data is transferred to and processed in the United States.

In plain English: Your data sits in Amazon's US data centers. An AI (AWS Bedrock) reads your audit answers to write your score. Amazon doesn't train its AI on your data.

6. How long we keep it (retention)

Audit data (non-members): If you run an audit but never join, we keep your audit inputs, photos, and report only as long as needed to deliver the report and let you decide whether to join, then delete them, unless you ask us to delete them sooner (Section 7).
Member data: We keep your account and site content while you are a member. After the paid period ends, maintenance stops and we may freeze or take the managed site offline. Under the Terms, the customer has 90 days after the paid period to request an eligible domain transfer or content copy. A timely eligible domain-transfer request remains open while a registrar or registry lock prevents completion. We retain material needed to fulfill a timely transfer or content-copy request until it is resolved, then delete personal data we no longer need — except records we must keep for tax, accounting, fraud prevention, disputes, or other legal reasons.
Cancellation receipts: The WordPress cancellation table is configured to delete receipt records 730 days after submission. Transactional or operations email copies may follow our applicable email and legal record-keeping requirements.
Emails and payment records: Kept per Keap's and our legal record-keeping requirements.
Optional Google Analytics 4: GA4 event and user data covered by Google's retention setting is configured for 14 months. This is separate from analytics-cookie lifetime: GA4's default first-party cookies may last up to 2 years, visits may refresh them, and browser limits may shorten them. Aggregate reports may remain available longer.

In plain English: We don't keep audit data forever. You can always ask us to delete your data sooner.

7. Fixing or deleting your data

An adult athlete, or the parent or legal guardian controlling an account for an athlete age 13–17, can ask us at any time to:

See what personal data we hold about you.
Correct anything wrong — including your audit inputs or your published site content.
Delete your personal data — audit answers, photos, report, and account.

How to ask: Email operations@localservicespotlight.com or operations@blitzmetrics.com from the address we have on file, and include the athlete’s name. For an athlete age 13–17, use the guardian-controlled contact email. We may verify account authority before disclosing, changing, deleting, transferring, or exporting account material.

Deletion covers our systems and sites we control. It cannot reach copies already made by search engines or third parties, though we can help you request search-engine removals.

Depending on where you live (for example, California or the EU/UK), you may have additional legal rights. We honor correction and deletion requests from everyone regardless of location.

In plain English: Email operations@localservicespotlight.com or operations@blitzmetrics.com and ask us to show, fix, or delete your data. For an athlete age 13–17, the parent or legal guardian should write from the guardian-controlled contact email.

8. We do not sell your personal data

We do not sell your personal data. We do not rent it, trade it, or share it with data brokers. We share it only with the service providers below, who work for us under contract — and with authorities if the law genuinely requires it.

California. We do not sell personal information or share it for cross-context behavioral advertising as those terms are commonly used. We do not currently publish a separate CCPA/CPRA “Do Not Sell” portal; California residents can email operations@localservicespotlight.com for the same access, correction, and deletion rights we honor for everyone. If we ever sold or shared personal information, we would not do so for a known California consumer ages 13 to 15 without opt-in consent. A specialist review of CCPA/CPRA and California Automatic Renewal Law is still outstanding — this paragraph is not a claim that that review is finished.

In plain English: Your data is not for sale. Period.

9. Campaign attribution, referral links, and optional analytics

We preserve campaign and content-source markers through checkout so we can measure which videos, articles, or ads lead to a signup. These markers do not change the public $30/month price and are not reusable coupons.

A referral program may be offered later under separate terms. This page does not launch a referral offer or promise any referral payment. If a future referral program uses a ref marker, its separate terms will govern any credit.

Google Tag Manager before a choice

We use Google Tag Manager (GTM) to manage consent and load only approved tags. The GTM container bootstrap may load before you make an analytics choice. Like an ordinary request for a third-party script, that bootstrap necessarily discloses connection metadata such as IP address, browser or user-agent information, and referrer to Google. The bootstrap does not authorize GA4 collection: GA4 tags and events remain blocked, and analytics identifiers or cookies are not set, until the adult or parent/guardian choice below.

Optional Google Analytics 4 after a choice

Google Analytics 4 (GA4) is optional and off by default. It may run only after a visitor chooses “I’m 18+ or a parent/guardian — allow analytics.” Someone under 13 may not allow analytics. For a visitor age 13–17, a parent or legal guardian must make the choice.

When allowed, GA4 receives only these categories from this site:

The page URL limited to this site's origin plus path, without the URL query string or hash.
The referrer origin only, not the full referring URL, path, query string, or hash.
The page_view event and five interaction event names: audit_start, audit_complete, report_view, pricing_view, and checkout_click.
Device and browser information and approximate geolocation generated by Google. Google receives network information such as an IP address to generate approximate location, but GA4 does not log or store individual IP addresses.

We do not send GA4 the audit identifier (audit_id), referral value (as_ref), referral query value, audit answers or other audit content, name, email address, phone number, school or team, city, social handle, photo, audit score, report content, payment data, user-provided data, URL query string, or URL hash.

We use this information only for aggregate site, product, and audit-funnel improvement: to understand which pages and audit steps are useful and where visitors stop. We do not use it for advertising or individual eligibility decisions. Google Signals and user-provided data collection are off.

GA4 first-party browser identifiers or cookies may be set only after the allow choice. Under Google's default settings, the _ga and _ga_<container-id> cookies may last up to 2 years and visits may refresh them; browser limits may shorten that lifetime. Separately, the GA4 event and user data retention setting is configured for 14 months. Aggregate reports may remain available longer.

You can withdraw analytics consent at any time by reopening Privacy choices and choosing Continue without analytics. That persists the denial, stops new analytics collection from this browser, and removes accessible first-party GA cookies where practical. Information collected before withdrawal remains subject to Google-side retention and deletion controls and may remain in historical aggregate reports.

Google Ads and Meta tracking are not active. We do not use this analytics choice for advertising, ad personalization, cross-context behavioral advertising, or cross-site profile building; advertising consent remains denied.

This is an operational disclosure of the current configuration, not a claim that a specialist privacy-law review is complete.

In plain English: GTM may make a basic connection to Google before a choice, but optional GA4 stays blocked unless an adult or parent/guardian allows it. After that choice, we measure page views and five funnel steps without sending query strings, audit details, or contact information. Advertising tracking stays off, and you can withdraw the analytics choice anytime.

10. Service providers

These companies process data on our behalf:

Provider	What they do	What they handle
Amazon Web Services (DynamoDB, S3) — us-east-1	Store audit data and photos	Audit inputs, photos, reports
AWS Bedrock	AI scoring of your audit	Your audit inputs
Keap (Infusionsoft)	Payment processing, CRM, some email	Name, email, payment status; your card number goes to Keap, never to us
Amazon SES	Sends transactional email	Your email address and report contents
Managed WordPress environment	Runs the public site and cancellation-request workflow	Approved site content; cancellation receipt ID, account email, timestamps, workflow status, and email-delivery status
Google Tag Manager	Manage consent and load approved tags; the container bootstrap may load before a choice	Ordinary connection metadata such as IP address, browser or user-agent information, and referrer
Google Analytics 4	Optional aggregate site, product, and funnel measurement after an adult or parent/guardian allows analytics	Site origin plus path without query or hash, referrer origin, page view and five interaction event names, first-party analytics identifiers, device/browser information, and approximate geolocation generated by Google; no audit-form content or contact/profile data

Each provider is bound by its own contracts and security terms. If we add or change providers, we will update this list.

In plain English: Amazon helps with storage, AI, and email delivery; Keap helps with payments and email; Google Tag Manager manages approved tags; and Google Analytics provides optional analytics only after the adult or parent/guardian choice.

11. Marketing email

Submitting your email to receive your audit report gets you your report. Marketing email is separate. We send marketing email only if you opt in on an unchecked box. For anyone 13–17, that opt-in must be made by the parent or guardian, not by the athlete alone. Every marketing email we send includes an unsubscribe link. Unsubscribing from marketing never blocks service emails like receipts or your report.

In plain English: Your email gets you your report. Extra emails only with your separate OK, and you can always unsubscribe.

12. Changes to this policy

When we change this policy, we will update the date at the top and, for meaningful changes, notify members by email. For material changes that affect a minor’s data, we will notify the guardian on the account. We do not run a COPPA verifiable-parental-consent program for children under 13, because we do not offer the service to that age group.

In plain English: If the rules change in a way that matters, we'll tell you — not bury it.

13. Contact

Questions, corrections, deletions, or parent concerns:

Email: operations@localservicespotlight.com or operations@blitzmetrics.com
Mail: Your Content Factory LLC, 2605 S Decatur Blvd Ste 123 PMB 1061, Las Vegas, NV 89102

Effective September 1, 2026. Last updated September 1, 2026. Operated by Your Content Factory LLC, a Nevada limited liability company, operating Athlete Spotlight.