Privacy Policy

Who we are and when this policy applies

NEXTXI is the developer and operator of the NEXTXI mobile application and the nextxi.football service. In this policy, "NEXTXI", "we", "our" and "us" refer to NEXTXI, operating from the United Kingdom.

For account administration, subscriptions, platform security, customer support and operation of our own website, NEXTXI normally acts as the data controller. When a club or academy enters and manages player, parent, staff or volunteer records in its workspace, that organisation is normally the controller and NEXTXI processes the information on its instructions. Questions about a club's use of your information should therefore also be directed to that club.

This policy covers the NEXTXI Android and iOS apps, our website, club portals, public club websites hosted by NEXTXI and related support communications.

Information we collect

What we collect depends on the role you hold and the features you choose to use.

We also receive information when another authorised person creates or links a record for you - for example, when a club administrator registers a player, a parent links a child, or a coach records attendance or performance.

How and why we use information

• create and secure accounts, authenticate users and apply role-based access;
• provide club management, communications, attendance, fixtures, training, awards, cards, AR, passports, fundraising and website features;
• connect players with parents, teams, clubs and authorised staff;
• process subscriptions and send essential service, billing and security communications;
• answer support requests, diagnose faults, prevent misuse and improve reliability;
• meet legal, safeguarding, accounting and regulatory responsibilities; and
• publish information only where an authorised user deliberately selects a public or sharing feature.

Depending on the context, our lawful basis under UK data-protection law is performance of a contract, our legitimate interests in operating and protecting NEXTXI, compliance with a legal obligation, consent, or protection of vital interests. Clubs and academies are responsible for identifying their own lawful basis and any additional condition required for health or other special-category information they place in NEXTXI.

Mobile device permissions

Children and young players

NEXTXI is used in grassroots and academy football and may therefore process information about children. Youth player access is designed to be created through a club or linked parent or guardian relationship. A child does not need a public email address for a club to maintain a player record.

Clubs must have an appropriate lawful basis, provide their own privacy information and obtain parental or guardian permission where required. Access to registration, emergency, medical and safeguarding information should be limited to authorised roles. We do not sell children's information, use it for behavioural advertising or knowingly make sensitive registration data public.

A parent or guardian may contact the club or NEXTXI to exercise rights for a linked child. We may ask for enough information to verify the relationship before acting.

NXI Assist and AI-supported features

When an authorised administrator uses NXI Assist, the question and relevant, permission-scoped workspace context may be sent to our AI service provider to generate a response. NXI Assist is designed as a read-only assistant: it does not change a club record merely because a user asks a question. Users should not enter unnecessary medical, safeguarding, payment or other highly sensitive details into a prompt.

AI summaries and suggestions can be incorrect and must be checked by an authorised adult before a club decision is made. NEXTXI does not use AI output to make a solely automated decision that produces a legal or similarly significant effect on a player.

When information is shared

We share information only where needed for the service or where a user asks us to:

• Authorised club users: club administrators, coaches, managers, parents, players or volunteers see only the information their role and team access permit.
• Service providers: Google Firebase for authentication, databases, storage, hosting and notifications; Stripe for payments; OpenAI for NXI Assist; Resend for transactional email; and Expo and mobile-platform services for app delivery and notifications.
• User-directed sharing: public club pages, downloadable cards, reports, social sharing or media selected by an authorised user.
• Safety and law: where reasonably necessary to protect a person, investigate abuse, enforce our terms or comply with a valid legal requirement.
• Business change: if NEXTXI is reorganised, financed, acquired or sold, subject to appropriate confidentiality and privacy protections.

Some providers may process information outside the United Kingdom. Where required, we use adequacy regulations, contractual safeguards or another recognised transfer mechanism. Provider information is available from Google, Stripe, OpenAI, Expo and Resend.

Retention, account deletion and club records

Account and workspace information is kept while the account, club relationship or subscription remains active and for only as long afterwards as needed for the purposes described in this policy. Retention depends on the record: financial and transaction records may be kept for the legally required accounting period; security evidence may be kept to prevent fraud or resolve disputes; and club football history may be retained by the club as an independent record.

A verified account-deletion request removes or irreversibly anonymises the account and personal data associated with that account from active NEXTXI systems without undue delay, normally within 30 days. Limited residual copies may remain in restricted disaster-recovery backups until their normal overwrite cycle and will not be used for ordinary business. Where law, fraud prevention, safeguarding or a live dispute requires limited retention, we will explain this where permitted.

Deleting a login does not automatically erase a fixture result, team sheet, award or other club record that exists independently under the club's control. Where appropriate, the account is disconnected and personal identifiers are removed or minimised. You can ask both NEXTXI and the relevant club about those records.

How we protect information

We use encrypted network connections, managed cloud infrastructure, authentication, role-based access, Firestore and Storage security rules, restricted administrative access and operational monitoring. We review access boundaries for sensitive club and youth records and design public sharing as a deliberate action rather than a default. No internet service can guarantee absolute security.

If you believe information or an account is at risk, contact security@nextxi.football.

Your data-protection rights

Depending on the circumstances, you may have rights to be informed; request access, correction or deletion; restrict or object to processing; receive portable information; and withdraw consent without affecting earlier lawful use. You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

We may need to verify identity or parental authority before completing a request. If a request concerns information controlled by a club, we may refer the request to that club and assist it in responding.

Contact us and policy changes

Privacy questions and rights requests: security@nextxi.football

Account and product support: support@nextxi.football

We may update this policy when the product, providers or law changes. Material changes will be highlighted in the service where appropriate, and the date at the top of this page will be updated.