Privacy Policy
This policy explains how NEXTXI handles personal information across the NEXTXI mobile app, nextxi.football, club workspaces and public club pages.
NEXTXI uses information to run football clubs, connect authorised members, build player passports, deliver cards and awards, organise fixtures and communicate. We use trusted service providers to operate the platform, do not sell personal information and do not use children's information for behavioural advertising.
Who we are and when this policy applies
NEXTXI is the developer and operator of the NEXTXI mobile application and the nextxi.football service. In this policy, "NEXTXI", "we", "our" and "us" refer to NEXTXI, operating from the United Kingdom.
For account administration, subscriptions, platform security, customer support and operation of our own website, NEXTXI normally acts as the data controller. When a club or academy enters and manages player, parent, staff or volunteer records in its workspace, that organisation is normally the controller and NEXTXI processes the information on its instructions. Questions about a club's use of your information should therefore also be directed to that club.
This policy covers the NEXTXI Android and iOS apps, our website, club portals, public club websites hosted by NEXTXI and related support communications.
Information we collect
What we collect depends on the role you hold and the features you choose to use.
Account and identity
Name, email address, authentication identifier, profile image, role, account status, invite codes and linked club, team, parent or player relationships.
Club and football records
Teams, memberships, positions, shirt numbers, fixtures, results, attendance, availability, training, performance statistics, reviews, awards, cards, trophies and passport history.
Youth registration and safeguarding
Date of birth or age group, guardian relationships, consent status, emergency contacts and medical, accessibility or safeguarding notes where a club asks for them and the user chooses to provide them.
Content and communications
Messages, announcements, replies, votes, transport responses, support requests, photos, videos, logos, card artwork and other content users upload or create.
Payments and subscriptions
Plan, billing contact, Stripe customer and transaction references, payment status and invoice information. Full payment-card and bank details are handled by Stripe rather than stored by NEXTXI.
Device and service information
IP address, device and browser type, operating system, app version, authentication sessions, push-notification token and operational, security or error logs needed to run and protect the service.
We also receive information when another authorised person creates or links a record for you - for example, when a club administrator registers a player, a parent links a child, or a coach records attendance or performance.
How and why we use information
- create and secure accounts, authenticate users and apply role-based access;
- provide club management, communications, attendance, fixtures, training, awards, cards, AR, passports, fundraising and website features;
- connect players with parents, teams, clubs and authorised staff;
- process subscriptions and send essential service, billing and security communications;
- answer support requests, diagnose faults, prevent misuse and improve reliability;
- meet legal, safeguarding, accounting and regulatory responsibilities; and
- publish information only where an authorised user deliberately selects a public or sharing feature.
Depending on the context, our lawful basis under UK data-protection law is performance of a contract, our legitimate interests in operating and protecting NEXTXI, compliance with a legal obligation, consent, or protection of vital interests. Clubs and academies are responsible for identifying their own lawful basis and any additional condition required for health or other special-category information they place in NEXTXI.
Website measurement and your choices
With your permission, NEXTXI uses Google Analytics in an isolated frame to measure visits to approved public pages. If you also allow ad measurement, the Google Ads base tag runs directly on approved public pages. Completed new club trials use the existing Analytics event imported into Google Ads; the base tag does not send a second trial conversion. That event contains no names, email addresses, club IDs or player IDs.
Measurement is excluded from sign-in and registration pages, private club and player pages, private links, club websites and mobile apps. Trial completion is measured on a separate public confirmation page. Measurement uses approved public page addresses. With ad measurement allowed, validated Google ad click identifiers from public landing URLs may be included; other query strings, URL fragments and private referring page addresses are omitted. We do not enable personalised advertising, Google Signals, form-entry collection or enhanced conversions.
Analytics and ad measurement are separate choices. The Ads tag requires both, and previous analytics consent does not grant ad measurement. You can reject optional measurement or change or withdraw your permission through Privacy choices. A page reload may be used to remove the running Ads tag. Choices last 180 days. Google Analytics loads only after analytics is allowed; the Ads tag loads only after both choices are allowed. Local trial-confirmation and duplicate-prevention records, including an account reference, stay in this browser and are cleared when ad measurement is withdrawn. If browser storage is unavailable, analytics choices apply for the current visit and trial conversions are not recorded.
Mobile device permissions
Children and young players
NEXTXI is used in grassroots and academy football and may therefore process information about children. Youth player access is designed to be created through a club or linked parent or guardian relationship. A child does not need a public email address for a club to maintain a player record.
Clubs must have an appropriate lawful basis, provide their own privacy information and obtain parental or guardian permission where required. Access to registration, emergency, medical and safeguarding information should be limited to authorised roles. We do not sell children's information, use it for behavioural advertising or knowingly make sensitive registration data public.
A parent or guardian may contact the club or NEXTXI to exercise rights for a linked child. We may ask for enough information to verify the relationship before acting.
NXI Assist and AI-supported features
When an authorised administrator or coach uses an NXI Assist feature, their question or training brief and relevant, permission-scoped context may be sent to our AI service provider to generate a response. Session planning uses existing activities and the requirements supplied by the coach; it does not automatically send named player rosters or private coaching notes. Asking for a response does not change club records. A coach must explicitly apply a session proposal to the private draft and publish it separately. Users should not enter unnecessary personal, medical, safeguarding, payment or other highly sensitive details into a prompt.
AI summaries and suggestions can be incorrect and must be checked by an authorised adult before a club decision is made. NEXTXI does not use AI output to make a solely automated decision that produces a legal or similarly significant effect on a player.
Retention, account deletion and club records
Account and workspace information is kept while the account, club relationship or subscription remains active and for only as long afterwards as needed for the purposes described in this policy. Retention depends on the record: financial and transaction records may be kept for the legally required accounting period; security evidence may be kept to prevent fraud or resolve disputes; and club football history may be retained by the club as an independent record.
A verified account-deletion request removes or irreversibly anonymises the account and personal data associated with that account from active NEXTXI systems without undue delay, normally within 30 days. Limited residual copies may remain in restricted disaster-recovery backups until their normal overwrite cycle and will not be used for ordinary business. Where law, fraud prevention, safeguarding or a live dispute requires limited retention, we will explain this where permitted.
Deleting a login does not automatically erase a fixture result, team sheet, award or other club record that exists independently under the club's control. Where appropriate, the account is disconnected and personal identifiers are removed or minimised. You can ask both NEXTXI and the relevant club about those records.
Want to delete a NEXTXI account?
Open account deletionUse our public deletion route even if you can no longer sign in to the app.
How we protect information
We use encrypted network connections, managed cloud infrastructure, authentication, role-based access, Firestore and Storage security rules, restricted administrative access and operational monitoring. We review access boundaries for sensitive club and youth records and design public sharing as a deliberate action rather than a default. No internet service can guarantee absolute security.
If you believe information or an account is at risk, contact security@nextxi.football.
Your data-protection rights
Depending on the circumstances, you may have rights to be informed; request access, correction or deletion; restrict or object to processing; receive portable information; and withdraw consent without affecting earlier lawful use. You may also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.
We may need to verify identity or parental authority before completing a request. If a request concerns information controlled by a club, we may refer the request to that club and assist it in responding.
Contact us and policy changes
Privacy questions and rights requests: security@nextxi.football
Account and product support: support@nextxi.football
We may update this policy when the product, providers or law changes. Material changes will be highlighted in the service where appropriate, and the date at the top of this page will be updated.
Connected social accounts and YouTube API Services
Club administrators can optionally authorise Facebook Pages, professional Instagram accounts, X profiles and YouTube channels for their teams. We store the selected account or channel identifier, public name and handle, team assignments, encrypted publishing credentials and publishing status. We use this information only to provide the connections and posts the administrator requests, including scheduled publishing when the administrator is offline. We do not request social passwords or use this access for advertising profiles.
When an administrator confirms a post, its approved photo or video, caption, title and relevant settings are sent to the selected platforms. A YouTube upload includes the administrator's visibility and audience choices. The administrator is responsible for permission to share the content, including consent for junior-player images and rights to music. Public website social links are optional and appear only when selected and published by the club.
YouTube connections use YouTube API Services. Their use is also subject to the YouTube Terms of Service and Google Privacy Policy. NEXTXI's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Disconnect an account in Engage → Social Media → Connections to remove NEXTXI's saved publishing credentials and stop future publishing through that connection. You can also revoke Google access in Google's third-party connections settings, or X access in X connected apps. Removing a connection does not recall content already uploaded or published; manage that content on the platform. Club-authored drafts and publishing records remain in the club workspace under the retention arrangements below. To remove public website links, deselect them and republish the club website. YouTube disconnection also removes that channel's published links automatically. Use the account-deletion controls or contact us to exercise the data rights described in this policy.
We periodically refresh saved YouTube channel information and remove it if access can no longer be verified. Cached video identifiers are removed after 25 days; the club's own content and dated publishing-action records are separate. If Google is temporarily unavailable during disconnection, an encrypted credential is retained only to retry revocation, not to publish further content.