3Ball Network02 - Privacy Notice and Data Inventory
Final approved agreements - version 2026-11-10-N1. Published agreement text.
Version 2026-11-10-N1
1. Who handles your information
3Ball Basketball Shooting Training, LLC, DBA 3Ball Network operates the platform. Contact privacy@3ballnetwork.com or 507 Clear Creek Cove, Byram, MS 39272. This notice describes pilot processing; the operator must reconcile the actual deployment before publication. Acknowledging receipt of this notice is not consent to optional publication, advertising, or unrelated disclosure.
2. Information we collect and why
Account and eligibility: name, email, date of birth/age, country, role, school/team, professional affiliations and verification outcomes, to create and secure accounts and determine eligibility. Profile: region, position, measurements, completion year and optional academic or recruiting preferences, for the functions the player selects. Performance: games, minutes, duration, statistics, grades, source provenance and correction history, to review and explain performance records without revealing the private formula.
Content: submitted photos, film, stat sheets, documents and attachments, for authorized review and display. Relationships and communications: guardian links, advocate assignments, team memberships, player/recruiter grants, messages, recruiting notes and reports, to enforce scope, supervision and safety. Billing: processor references, invoices, amounts, payer/sponsorship and authorization history, for payment administration and disputes. Full card numbers and CVV are handled by Stripe, not collected in an ordinary 3Ball form.
Security: necessary authentication, session, access and audit records, and network/device or App Check signals actually used by the deployment, to prevent misuse and investigate incidents. Passkeys use public-key credentials; 3Ball does not receive the fingerprint or face image used by a device to unlock a passkey. Verification uses minimal outcome/method records; identity and family-document copies and call recordings are not routinely retained. Do not submit unnecessary identity documents through ordinary messages.
3. Who can see information
A limited recruiting directory is different from an authorized full player profile. Full recruiter access requires the particular player/recruiter/acting-affiliation permission. Date of birth, contact addresses and original verification/stat-source evidence are not recruiter-profile fields. Sponsors see their own financial records, not player records or private messages. A business logo does not create ownership or access to every user's data.
General recruiting conversations include player, linked parents and assigned advocate, with an approved coach in relevant team conversations. Recruiter-parent and recruiter-coach conversations include the advocate. Recruiter-advocate conversations can be separate. New approved links receive history from approval forward unless earlier sharing is separately authorized. Removal ends that link's scope. Marcus's purpose-limited owner review of conversations and otherwise private recruiting notes is disclosed and logged. Other participants do not have that global power.
4. Service providers and other disclosures
Information is disclosed only as necessary to authorized participants, contracted service providers, or a lawful safety/legal purpose. Planned provider categories include Google Firebase for hosting/database/identity and App Check, Stripe for payments, and Microsoft 365 for service email. Google Document AI is the selected document extraction option but is not represented as enabled; other storage/media/scanning providers are used only after review. The deployed provider list and processing locations must match the release record; this notice does not claim every candidate is active or under a signed custom data agreement.
Providers receive purpose-limited data under their applicable agreements and documented roles. We may disclose necessary information to comply with law, protect safety, address fraud or defend claims, using proportionate safeguards. A merger or asset transfer does not authorize materially incompatible processing without required notice and consent. International access or transfers require the applicable safeguards before activation; a Mississippi business address does not remove other jurisdictions' rights.
5. Sale, advertising and tracking
Pilot advertising is off. We do not sell private identities or identifying details to advertisers or data brokers, and do not authorize unrelated advertising or AI-model training through general signup. Paying recruiters purchase a scoped platform service, not ownership of personal information; any legal classification of those disclosures as sale or sharing must be resolved and required rights implemented before the affected processing begins. We will honor applicable opt-out rights and recognized legally required preference signals rather than claim a universal exemption.
Future promotions require separate owner approval and legal/deployment review. Approved product limits are contextual static image/text, separate from private workflows, without pop-ups, autoplay, full-screen interruptions or required viewing. Promotions cannot affect grades, rankings, directory order or recommendations. Advertisers receive aggregate impressions and clicks only, without identities or identifying details. This notice does not activate ads, tracking or prohibited ad categories, including guaranteed-recruitment/scholarship services.
6. Children and adult control
Use the applicable age/country route before collection. For covered children, provide direct parent notice and obtain qualifying parental consent before collection, use or disclosure unless a narrow legal exception applies. Separate service consent from optional publication/media and non-integral third-party disclosure. A verified email, payment or advocate assignment is not by itself parental authority or qualifying consent. Required parent setup, verification and read-only supervision are free.
When a player reaches adulthood, respect the adult player's lawful control. The product preference to retain a parent link until the player requests a change applies only to the extent legally permitted and under valid adult authorization; it is not indefinite authority over an adult's records. A request to end that authority is reviewed promptly. Required legal restrictions override a product default.
7. Retention and deletion
Use the category schedule in the accompanying Retention and Data Responsibility Schedule: 30-day inactive drafts/uploads; normally 90 days after confirmation for original stat/extraction sources when no review is open; active-purpose/annual review and normally no more than 12 months after purpose end for unnecessary profile/performance/media/recruiting records; conversations after relationship end only for a documented safeguarding/dispute purpose, up to 12 months; 90-day routine security logs; up to 12 months for important purpose-ended audits; a provisional seven-year financial-record default. Shorter lawful or necessary periods control. Consent evidence is retained for current processing and, after that ends, only for a documented compliance/claims need, with a three-year maximum subject to annual necessity review, earlier purpose completion and any shorter legal requirement; a specific lawful hold is handled separately. It is not automatically kept seven years.
Ordinary verified deletion processing targets 30 days, subject to shorter legal deadlines and lawful exceptions. Specific holds are reviewed at least every 90 days. Backups have a 35-day expiry target subject to actual validation, deletion propagation and restore controls; that target does not excuse a required earlier deletion. Fingerprints and pseudonyms can remain personal data. We do not promise to erase another person's lawful message record merely because one participant requests it.
8. Your requests, security and changes
Use privacy@3ballnetwork.com to request access, correction, deletion, withdrawal or applicable opt-outs/appeals. Verify proportionately; sponsors cannot act for players merely because they pay. We aim to respond within 30 days and follow shorter mandatory deadlines; use an extension only where lawful, with required notice. If declining a request, explain the applicable reason and review/appeal route unless prohibited, and provide information about the relevant regulator where required. Do not retaliate for lawful rights requests or condition unrelated free rights on buying a plan.
We use reasonable safeguards but cannot guarantee invulnerability. Notify affected people and authorities when legally required after assessing an incident. Material notice changes are communicated before the changed processing where required; updates do not replace new consent. The release record must document the deployment and legal checks; this notice does not represent that an unreleased configuration has been deployed.