One policy for the whole Diamond suite. This document covers Diamond Commander (lineups; diamondcommander.com and app.diamondcommander.com), Diamond Recruiter (tryout evaluation; recruiter.diamondcommander.com and recruiterapp.diamondcommander.com) and Diamond Bootcamp (drills and practice plans; bootcamp.diamondcommander.com and bootcampapp.diamondcommander.com), the Android app, and every related website. One account and one sign-in work across all of them. Where a section applies to only one app, it says so.
Last updated: September 3, 2026
This Data Processing Addendum ("DPA") forms part of the Terms of Service and the Data Processing Terms in Section 12 of the Privacy Policy. It exists for coaches, leagues, associations and other organizations that need a stand-alone document describing how Diamond Commander processes personal information on their behalf. Where this DPA and the Privacy Policy say the same thing in different words, they mean the same thing; where they differ, this DPA governs the processing it describes.
This DPA is between the person or organization using the Service ("Customer", the controller) and Diamond Commander ("Provider", the processor). Customer decides what personal information to enter into Diamond Commander and Diamond Recruiter and why; Provider processes it only to provide the Service. Diamond Bootcamp is designed not to process any personal information about players; the only personal information involved in Bootcamp is the account holder's own contact details and any adult coach contacts the account holder chooses to email a practice plan to.
"Personal Data", "Processing", "Controller", "Processor", "Data Subject", "Sub-processor" and "Personal Data Breach" have the meanings given in the EU General Data Protection Regulation (GDPR), the UK GDPR, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and equivalent applicable laws ("Data Protection Laws").
| Subject matter | Provision of the Diamond suite: lineup and team planning (Diamond Commander), tryout evaluation (Diamond Recruiter), and drill and practice planning (Diamond Bootcamp). |
|---|---|
| Duration | For as long as Customer holds an account, plus the retention periods in Section 7 of the Privacy Policy (deleted accounts are purged 30 days after the request). |
| Nature and purpose | Hosting, storing, displaying, computing (lineups, rankings, percentiles, position fit) and transmitting Customer's data to Customer and to the people Customer authorizes (team staff, evaluators, share-link recipients); authenticating accounts; sending transactional email; processing subscriptions. |
| Categories of Data Subjects | Players and athletes (who may be minors), their parents or guardians where named, coaches, team staff, evaluators, and the account holder. |
| Categories of Personal Data | Names, jersey or bib numbers, birth years, positions, skill ratings and tryout scores, attendance, tags and notes, photos and score-sheet images that Customer chooses to upload, staff and evaluator email addresses, and the account holder's name and email. No special-category data is requested; Customer should not enter health or medical information. |
Provider processes Personal Data only on Customer's documented instructions, which are the Terms of Service, the Privacy Policy, this DPA, and Customer's use of the Service's features, unless the law requires otherwise, in which case Provider will inform Customer unless legally prohibited from doing so. Provider does not sell Personal Data, does not use it for advertising, and does not use it to train models.
Customer is responsible for having a lawful basis and any consent required by Data Protection Laws, by its league or association, and by the Children's Online Privacy Protection Act (COPPA) or comparable laws before entering another person's information, in particular a minor's; for entering only what is needed (Provider recommends first names or initials for minors); for deciding whom to add as team staff or invite as an evaluator; and for responding to requests from the individuals whose data Customer entered. Provider does not verify consent and does not obtain it on Customer's behalf.
Persons authorized by Provider to process Personal Data are bound by confidentiality. Provider implements appropriate technical and organizational measures, including encryption in transit, row-level security that limits every account to the teams and events it is entitled to see, per-evaluator isolation of tryout scores, audited and time-limited support access to a customer account, least-privilege administration, and hosting on reputable infrastructure providers. No method of storage or transmission is completely secure, and Provider does not guarantee security beyond these measures.
Customer authorizes Provider to engage the following sub-processors. Provider imposes data-protection obligations on each and remains responsible for their performance.
| Sub-processor | Purpose |
|---|---|
| Supabase | Database, authentication, and file and photo storage |
| Vercel | Application and website hosting and delivery |
| Resend | Transactional email (account, security, invitations, practice plans sent to coaches) |
| Stripe | Payment processing for subscriptions purchased on the web |
| Google (Google Play Billing) | Payment processing for purchases made in the Android app |
| Apple (App Store) | Payment processing for purchases on iOS, where that platform is available |
| Google (YouTube, Google Fonts) | Video embeds on Bootcamp drill pages (privacy-enhanced mode, data sent only when a video is played) and typeface delivery |
| PostHog | Optional privacy-first product analytics, when enabled; never sent player or coach names |
Provider will update the list in the Privacy Policy when a sub-processor is added or replaced. Customer may object on reasonable data-protection grounds by writing to info@diamondcommander.com; if the objection cannot be resolved, Customer may terminate its account.
Taking into account the nature of the processing, Provider will assist Customer with reasonable measures to respond to Data Subject requests (the Service lets Customer view, correct, export and delete its data directly) and to meet Customer's obligations regarding security, breach notification, and data protection impact assessments. If Provider receives a request directly from a player, parent or evaluator, Provider will refer it to Customer or work with Customer to address it.
Provider will notify Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer's Personal Data and will provide the information reasonably necessary for Customer to meet its own notification obligations.
Customer may export its data at any time. On account deletion, Provider locks the account immediately and permanently deletes or de-identifies the account and its teams, rosters, players, tryout events, athletes, scores, games and photos 30 days after the request, except for limited backups and information Provider must retain by law. Bootcamp practice data lives only in Customer's browser and is deleted by clearing it there.
Provider will make available the information reasonably necessary to demonstrate compliance with this DPA and will allow for and contribute to audits, including inspections, conducted by Customer or an auditor mandated by Customer, on reasonable notice, no more than once a year unless required by a supervisory authority, and subject to confidentiality.
The Service is operated, and Personal Data may be processed and stored, in the United States and Canada and other locations used by the sub-processors above. Where a transfer of Personal Data out of the EEA, the UK or Switzerland is involved, the parties rely on an appropriate transfer mechanism, including the EU Standard Contractual Clauses and the UK Addendum, which are incorporated by reference where applicable.
Each party's liability under this DPA is subject to the limitations and exclusions in the Terms of Service. This DPA is governed by the laws of the Province of Ontario, Canada, as set out in Section 14 of the Terms, and remains in effect for as long as Provider processes Personal Data on behalf of Customer.
Data protection contact and Privacy Officer: info@diamondcommander.com. A league or association that needs a countersigned copy of this DPA can request one at the same address.