PRIVACY POLICY

Effective Date: November 10, 2026 Last Updated: November 10, 2026 Version: privacy-2026-11-10 · Notice to Parents (Appendix A): parent-notice-2026-11-10

Quick Summary

• We collect only what we need to run a football-training and community website: account details, a birthdate (to apply age rules), your football level and position, what you post, basic activity used for streaks, badges, and weekly plans, and your private quiz scores.
• We do not sell personal information, we do not share it for targeted advertising, and we do not show ads.
• Payments are handled by Stripe. We never receive or store full card numbers.
• Players 13 and under cannot sign up on their own. A parent with a paid membership creates and controls their profile after reading our Notice to Parents and giving consent. Players 13 and under cannot use the Community, comments, live chat, challenges, uploads, Exposure, or the Recruiting Board — and parents cannot turn these on. On the player's 14th birthday, all of these unlock automatically; we email the parent about 14 days before and on the day, and the parent can then turn features off. Parents can review and delete their child's information at any time (see Section 9).
• Only your username is shown to other members, and only to logged-in members. Your email, birthdate, and age are never shown to other members. Logged-out visitors cannot see member usernames, posts, or uploads.
• Questions? Email spark@winbehindthescenes.com.

1. Who We Are

WIN BEHIND THE SCENES ("WBTS," "we," "us," or "our") is operated by CCL Capital Holdings LLC, a New Jersey limited liability company. This Privacy Policy explains how we collect, use, share, and protect personal information when you use https://winbehindthescenes.com and related services (the "Service"). It is part of our Terms of Service.

Operator contact (including for children's privacy questions): CCL Capital Holdings LLC 17350 State Highway 249, Suite 220, Houston, TX 77064 Email: spark@winbehindthescenes.com

2. Information We Collect

2.1 Information you give us

2.2 Information collected automatically

• Session cookie. When you log in, we set one essential cookie (named wbts.sid) that keeps you signed in and protects forms against cross-site request forgery. It lasts up to 30 days or until you log out. Session records on our server expire automatically.

• Device cookie. When you sign in, we set an essential cookie (named wbts.dev) holding a random, signed device ID. It lasts up to 1 year, so we can recognize a device you have trusted and count your signed-in devices. We store only a one-way hash of the ID. It is not used for tracking or advertising.

• Age-screen cookie. If someone enters a birthdate showing they are 13 or younger while signing up, we set a cookie (named wbts_as) for 24 hours. It blocks a new self-signup attempt from that browser. It contains no personal information.

• Browser storage. Your browser stores your selected position locally (in "local storage") so the site can remember it.

• Activity records. When you are a member, we record which WBTS videos you open, weekly-plan items you complete, posts you make, and Recruiting Board updates, with the date. We use these only to power streaks, badges, weekly plans, "done" markers, and reminders inside the Service.

• Quiz results. When you are signed in and finish a "Quiz Yourself" quiz in KNOW THE SCHEME, we save the position, the quiz level (Youth, Middle/High School, or College), your score, your best streak of correct answers, and the date. We do not save your individual answers. Players 13 and under always get the Youth quiz. Scores are private: only you (and, for a Child Profile, the parent) can see them, and there are no leaderboards. Quizzes taken while signed out are not saved.

• Technical and log information. Like any website, our servers and our hosting provider receive your IP address, browser type, device information, pages requested, and the date and time of requests. We use IP addresses briefly to prevent abuse (for example, limiting repeated login or signup attempts, or very fast browsing of the Exposure directory). Our hosting provider keeps these server logs for up to 30 days.

• Sign-in security records. To enforce the 2-device limit and protect accounts from sharing or takeover, we keep:

  • Login history. For each sign-in attempt: the account, the time, your IP address shortened to its network prefix (first 3 of 4 parts for IPv4, the /24 network; first 48 bits for IPv6), the country and region (state), the browser and device type (for example, "Chrome on iPhone"), the hashed device-cookie ID, and the outcome (for example, signed in, code required, or code confirmed). Deleted after 30 days.
  • Active sessions. For each signed-in device: an internal session ID, the account, the hashed device-cookie ID, the browser and device type, the shortened IP address, the country and region, and the sign-in, last-active, and sign-out times and reason. Kept while the session lasts (30 days at most). Signed-out session records are deleted within 30 days.
  • Trusted devices. The account, the hashed device-cookie ID, the browser and device type, and when trust was created, when it ends, and when the device was last used. Deleted when trust ends (after 30 days). Deleted immediately when you sign that device out from your account page, reset your password, or when the account is banned or deleted.
  • Sign-in codes. A salted one-way hash of the code (never the code itself), the reason it was required (new device, new country, or far location), whether it was sent to a parent, the number of tries, and the times. Deleted daily once used or expired (codes expire after 10 minutes).

  How location works. The country and region come from a lookup table kept on our own servers (GeoLite2 data from MaxMind, through the geoip-lite software), applied to the shortened IP address. No outside location service is contacted. We do not store full IP addresses, full browser "user agent" strings, precise location, or sign-in codes in readable form with these records.

  This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

• Email delivery records. We keep a short log of the emails we send (date, subject, and whether delivery succeeded). Recipient addresses are masked (for example, j***@g***.com) and stored with a short one-way code, password-reset links and codes are redacted, and email text is not kept. The log rotates automatically by size, so older entries are deleted as new email is sent (see Section 8).

• No analytics or ad trackers. We do not use third-party analytics, advertising cookies, tracking pixels, or cross-site tracking. Video thumbnails and creator images are fetched by our own server and shown from our own site, so viewing our pages does not cause your browser to contact YouTube or Google.

2.3 Information from third parties

• Stripe (payments). When you subscribe, Stripe collects your payment information directly. Stripe sends us your customer ID, subscription ID, plan, subscription status, trial and renewal dates, and payment status. We do not receive your full card number.
• Public information about college coaches (Exposure). From official college athletics websites and other official public sources, we collect college coaching-staff names and titles, publicly listed work email addresses, official social media links and coaches' own public social media accounts, school recruiting-office contact details, and links to official staff pages and questionnaires. See Section 7.

2.4 Information we do not collect

We do not ask for or knowingly collect real names of players, home addresses, phone numbers, school names of players, Social Security numbers, government ID numbers, precise geolocation, biometric data, or health information. Please do not post this information. We automatically remove hidden location and device data (such as EXIF/GPS and camera details) from every photo and video uploaded to the Service before it is shown to anyone. If a video cannot be cleaned this way, we refuse the upload.

3. How We Use Information

We use personal information to:

• Provide the Service. We create and manage accounts and Child Profiles, show content matched to your level and position, and run community features, weekly plans, streaks, badges, challenges, Exposure, Camps & Events, and the Recruiting Board.
• Apply age rules and parental controls. We use birthdates to decide which features are available, block features for Youth Players, and set starting permissions for teen Child Profiles.
• Process payments. We manage trials, subscriptions, plan changes, Founding Member price locks, team plans, referral credits, renewals, cancellations, and refunds.
• Verify coaches. We use the email address you verify, and staff review where needed, to confirm coach accounts before they can post Camps & Events and Recruiting Timelines.
• Understand our business (internal analytics). We keep an internal log of subscription events: trial started, converted to paid, renewed, plan changed, or canceled. Each entry records the account or team ID, plan, seats, amount, source, and date. Only administrators (using two-factor sign-in) can see the resulting metrics, such as sign-ups, trial conversion, renewals, cancellations, and revenue. Exports contain only totals by period, not individual records. We do not share this log or the metrics with anyone outside WBTS, and we do not use them for advertising.
• Keep the community safe. We moderate posts, comments, and chat messages from new members; handle reports (including reports of child sexual abuse material, which we preserve and report to NCMEC as described in Section 8); remove content; suspend, ban, or delete accounts; enforce our Terms and Community Guidelines; verify coach accounts; prevent fraud and abuse; and protect children.
• Communicate with you. We send account, security, password-reset, billing, membership-confirmation, trial-ending and renewal reminder, cancellation, account-deletion, and policy-change emails, and parent notices (for example, a new Child Profile or a team request). We also respond to your requests. We do not send marketing messages to children.
• Maintain and improve the Service. We fix bugs, keep the Service secure, and understand overall use in a way that does not identify individuals.
• Comply with law. We meet legal obligations, respond to lawful requests, and establish or defend legal claims.

We do not sell personal information, use it for targeted or behavioral advertising, or make decisions about you that produce legal or similarly significant effects based solely on automated processing.

4. What Other People Can See

• Team Owners of a team you belong to (players 14 and older) can see whether you opened or completed the Team Playbook lessons and team quizzes assigned to you, and your team quiz answers and scores.
• Other logged-in members (14 and older) can see your username, your account-type badge (for example, Coach, Verified, Parent, or Moderator), and the posts, comments, photos, videos, upvotes, and live chat messages you share. The Players Forum is visible to members 14 and older. The Coaches Forum is visible only to coach accounts, and the Parents Forum only to parent accounts. Live chat is visible to members 14 and older who have chat turned on. An uploaded photo or video is available only to members who are allowed to see the post or chat it belongs to.
• Camps & Events and Recruiting Timelines are visible to logged-in members and to verified coaches. That includes each listing, the posting coach's username, role, and Verified Coach badge, and approved comments with the commenter's username. Youth Players can view listings but cannot comment.
• Content waiting for moderation (from members whose first post has not been approved yet) is visible only to the author and moderators until it is approved.
• The public. Logged-out visitors cannot see member usernames, post titles, posts, comments, chat, or uploads.
• Parents can see their Child Profiles' activity, including quiz progress, posts, comments, uploads, chat messages, and Recruiting Board (for teens who use those features).
• Team owners can see the usernames, levels, positions, and join dates of players on their team. A Child Profile joins a team only after the parent approves.
• Not shown to other members: your email address (including a coach's verified email), birthdate, age, coach school/program (except the program you name in a Camps & Events listing you post), Founding Member status and locked price, payment information, quiz scores (there are no leaderboards), and Recruiting Board (which is private to you and, for Child Profiles, your parent).

5. How We Share Information

We share personal information only as described here:

• Service providers that help us run the Service, are bound by contract to use the information only to provide services to us, and protect it:
  • Render (website, database, and file hosting)
  • Stripe (payment processing and the billing portal)
  • Resend (sending account, billing, and parent emails)
  • Cloudflare (domain name services, and forwarding email you send to our @winbehindthescenes.com addresses to our inbox)
• Within the community, as described in Section 4.
• YouTube / Google. When you click a video, it opens on YouTube, which collects information under Google's Privacy Policy. Thumbnail images and creator profile images are downloaded by our server and served from our own site, so Google does not receive your information when you simply view our pages.
• Legal and safety reasons. We share information if we believe in good faith it is necessary:
  • to comply with law, legal process, or a government request;
  • to protect the safety of any person, especially a child;
  • to report apparent child sexual exploitation to the National Center for Missing & Exploited Children;
  • to prevent fraud or abuse; or
  • to enforce our Terms.
• Business transfers. If WBTS is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred to the successor. The successor must honor this Privacy Policy, and children's information will remain subject to the protections in Section 9.
• With your consent or at your direction.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are defined under California and other state privacy laws). We have not done so in the past 12 months.

6. Cookies, Do Not Track, and Global Privacy Control

We use only the essential session cookie, device cookie, and age-screen cookie, and the local storage described in Section 2.2. We do not use advertising or cross-site tracking technologies, so there is nothing to opt out of. Even so, we treat browser "Do Not Track" and Global Privacy Control (GPC) signals as a valid request to opt out of any sale or sharing of personal information, and we will honor them if our practices ever change.

7. The Exposure Directory (Information About College Coaches)

Exposure lists college football coaching-staff information that schools publish. That includes names, job titles, publicly listed work email addresses, official social media links, school recruiting-office contact details, and links to official staff pages and recruiting questionnaires. Each entry links to its source.

Sources. Our sources are official college athletics websites, official program social media accounts, and coaches' own public social media accounts (X and Instagram) that identify the coach's school and role. We find coaches' accounts through official program posts that tag them, official athletics pages, and Wikidata (a public reference database). For each handle we keep an internal record of where it came from and why we matched it, which may include a short excerpt of the public profile. We do not list phone numbers or home addresses, and we do not buy contact lists or get contacts from data brokers. We list only work email addresses that schools publish; personal email addresses (such as Gmail or Yahoo) are rejected on every import and edit, and skipped addresses are logged only in masked form.

Limits on use. We use this information only to help players and families find official recruiting contacts:

• Coach email addresses are not included in our page source until a member reveals them, and then only in encoded form.
• Members reveal coach emails one at a time, up to 40 per member per day. We record which coach emails each member revealed on each day, to apply this limit, and delete those records after 12 months.
• Exposure pages state that the directory is for individual recruiting outreach only.
• There is no bulk download or export.
• We limit how quickly anyone can open school pages, to discourage scraping.
• During a free trial, members see full contact details for only 3 schools per conference.

Our Terms prohibit members from scraping the directory, sending spam, or using it commercially. Exposure is available only to members 14 and older.

Coaches. To request removal or correction of your information, use the "Are you a coach? Request removal or correction" form linked on every school page and in the site footer, or email spark@winbehindthescenes.com. We confirm the request by email at your work address and review it promptly. When we approve a removal, the information is hidden right away and added to a do-not-re-add list, so it stays hidden when we update staff lists. We keep the request record (your name, work email, the item, and our decision) for as long as the removal or correction stays in effect, so we can keep honoring it.

8. How Long We Keep Information (Data Retention)

We keep personal information only as long as reasonably necessary for the purposes described in this policy, and then delete it.

We may keep information longer if required by law (for example, preserving material reported to NCMEC as required by 18 U.S.C. § 2258A), to resolve disputes, or to enforce our agreements.

9. Children's Privacy (Notice for Parents Under COPPA)

This section explains how we handle personal information of children under 13, as required by the Children's Online Privacy Protection Act ("COPPA") and the FTC's COPPA Rule. WBTS applies the same protections to every player 13 and under ("Youth Players"), which goes beyond what COPPA requires.

9.1 Our approach

WBTS includes content for youth players, so we take special care with children.

• Youth Players cannot create their own accounts. If someone enters a birthdate showing they are 13 or younger when signing up, we do not create the account. We ask them to have a parent sign up, and we block another self-signup attempt from that browser for 24 hours.
• Only a parent or legal guardian (18 or older) can create a Youth Player's profile, from a parent account with a paid membership, after reading the Notice to Parents (Appendix A) and giving consent.
• Youth Players cannot use any feature where they could share information with other members. They are blocked from the Community Forums, threads, comments, upvotes, content reports, live chat (including chat uploads), weekly challenges, member-uploaded photos and videos, uploads, the Exposure directory, and the Recruiting Board. They may view Camps & Events and Recruiting Timeline listings (posted by verified coaches), but they cannot comment on, report, or save them. Parents cannot turn these features on. These restrictions are enforced on our servers, not just hidden in the menus.

9.2 What we collect from or about children

• From the parent, to create the Child Profile: a username (not a real name), a password, the birthdate, the level, and an optional position. We do not collect the child's email address, real name, address, phone number, or school.
• Automatically, when the child uses the Service:
  • the session cookie and technical information described in Section 2.2, used only to keep the child logged in, keep the Service secure, and otherwise support internal operations;
  • activity records (videos opened, weekly-plan items completed, streaks, badges);
  • quiz results from "Quiz Yourself" (position, the Youth quiz level, score, best streak, and date; not the individual answers), shown only to the child and the parent;
  • sign-in security records (shortened IP address, country and region, hashed device-cookie ID, browser and device type, timestamps, and outcome; see Section 2.2), used only to keep the account secure and limit it to 2 devices. Codes for signing in on a new device are sent to the parent's email. Login history is deleted after 30 days.
• Team membership: if the child asks to join a team with a join code and the parent approves, we record the team and the join date.
• Password help: if someone asks to reset a Child Profile's password, we email the parent. Child Profiles have no email of their own.

Because Youth Players cannot post, comment, chat, upload, or use Exposure or the Recruiting Board, we do not collect that kind of content from them. Some Youth Player profiles may still have Recruiting Board entries (schools, saved camps, and notes) saved before this rule applied. The Service checks the player's age from the birthdate every time, so those entries are hidden everywhere else on the Service (including counts) and the player can't add or change any. The parent can still see them on the child's activity page (My Account → Family → View activity) and can delete them one at a time, delete a saved camp, or delete them all at once. Parents can also email us at spark@winbehindthescenes.com to delete them. They are deleted with the Child Profile. Entries that are not deleted become visible to the player again when the player turns 14.

9.3 How we use and disclose children's information

We use children's information only to:

• provide the Service to the child (for example, showing level-appropriate videos, weekly plans, streaks, badges, and the child's own quiz scores and progress);
• keep the child and the community safe;
• support internal operations; and
• comply with law.

We do not use children's information for advertising, we do not sell it, and we do not send marketing to children.

We disclose children's information only:

• to the parent, who can view the child's profile and activity, including quiz progress;
• to a team owner, only if the parent approves a team request (username, level, position, and join date);
• to service providers that host and operate the Service for us (Render for hosting; Resend, which delivers emails to the parent that may include the child's username), who may use the information only to provide services to us; and
• for legal and safety reasons, as described in Section 5.

Youth Players' information is not shown to other members or to the public. We do not disclose children's personal information to third parties for any purpose that is not integral to the Service. If we ever wanted to, we would first obtain a separate verifiable consent from the parent, and a parent could refuse it and still let the child use the Service.

9.4 Parental consent

Before we collect any personal information from a child, the following steps must be completed:

1. Paid membership with a payment card. The parent must have started a paid WBTS membership through Stripe Checkout with a payment card on file. The free trial still applies.
2. Notice to Parents. The parent is shown the Notice to Parents (Appendix A) on the "Add a player profile" screen.
3. Consent. The parent checks an unchecked box confirming they are the child's parent or legal guardian, have read the Notice to Parents, and consent. The parent also separately agrees to the Terms on the child's behalf.

We record the date, time, and notice version for each Child Profile, and we email the parent a confirmation.

9.5 We do not require more information than necessary

We do not condition a child's participation in any activity on the child providing more personal information than is reasonably necessary for that activity.

9.6 Parents' rights

A parent or legal guardian may at any time:

• Review the personal information we have collected from their child, in My Account → Family → View activity, or email us for a copy of all of the child's information.
• Delete Recruiting Board entries on the child's activity page, one at a time, per saved camp, or all at once (this matters for older entries described in Section 9.2).
• Approve or decline team requests.
• Reset the child's password.
• Delete the child's information, using Delete in My Account → Family or by emailing us. Deleting a parent account also deletes every Child Profile it created.
• Refuse further collection or use and revoke consent. Deleting the Child Profile stops all further collection and use.

You can also make any of these requests by emailing spark@winbehindthescenes.com or writing to us at 17350 State Highway 249, Suite 220, Houston, TX 77064. To protect children, we will take reasonable steps to confirm that the person making a request is the child's parent or guardian.

9.7 How long we keep children's information

• We keep a child's information only as long as the Child Profile is active and as reasonably necessary to provide the Service to the child.
• When a parent deletes a Child Profile (or the parent's account is deleted), we delete the child's profile, activity records, team membership, and any related files from our live systems right away (and in any case within 30 days). Backup copies expire within 30 days (Section 8).
• If a Child Profile has no activity for 12 months, we email the parent a warning and delete the profile 30 days later unless it is used again.
• If we materially update the Notice to Parents, existing Child Profiles are paused (the child cannot use the Service) until the parent reviews the new notice and renews consent. Profiles without renewed consent within 30 days are deleted.
• We do not keep children's personal information indefinitely. We keep only a minimal archive record of the parent's consent (with a one-way hash of the parent's email and no child name or birthdate) for 3 years after the profile is deleted, to show compliance with law.

9.8 Security for children's information

We maintain a written information security program designed to protect children's information, as described in Section 11. It includes limiting access to authorized administrators who must use two-factor sign-in, and we review it at least once a year.

9.9 When a Youth Player turns 14

When a Child Profile's birthdate shows the player is 14, every feature unlocks automatically: posting, commenting, upvotes, and reports in the Community Forums; photo and video uploads; live chat; weekly challenges; comments on Camps & Events listings; and Exposure and the Recruiting Board.

From then on, the player can share information with other members (for example, posts, comments, chat messages, and uploads shown with their username), and the profile is treated as a teen Child Profile (Section 10). The unlock happens once. After that, the parent's settings control, and the parent can turn posting, uploads, live chat, or Exposure/Recruiting Board back off at any time in My Account → Family. We keep a record of the unlock (the date, how it was triggered, and the settings before and after), deleted with the Child Profile.

How we tell parents in advance. We tell parents about the automatic unlock in the Notice to Parents (Appendix A) and on the signup and consent screens. The child's activity page shows the unlock date. We also email the parent about 14 days before the 14th birthday and again on the day the features unlock.

Personal information the player shares from age 14 is handled as described in Sections 2–8 and 10. Information collected while the player was 13 or younger remains subject to the parent's rights in Section 9.6.

9.10 If we learn we collected a child's information without consent

If we learn that we collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly. If you believe a player 13 or younger has an account that a parent did not create, contact spark@winbehindthescenes.com.

10. Teens (Ages 14–19)

Players 14 and older may create their own accounts. If they are under 18, they need a parent's permission. Parents may also create Child Profiles for players ages 14 to 19.

• Starting settings. Teen Child Profiles, including Youth Player profiles that reach 14 (Section 9.9), have posting and commenting, uploads, live chat, and Exposure/Recruiting Board turned on. The parent can turn any of these off, and back on, at any time in My Account → Family.
• Teams. A Child Profile (at any age) joins a team only after the parent approves. Players 14 to 17 who created their own accounts may join a team with the team's join code without a separate parent approval through WBTS. The team owner then sees only their username, level, position, and join date.
• Protections for all minors. We apply the same protections to all minors: no ads, no sale or sharing of data, no private messaging, usernames instead of real names, removal of location data from uploads, and moderation of new members' posts, comments, and chat messages.

California minors. If you are under 18 and live in California, you may remove content you posted on the Service. You can delete your own posts, comments (including comments on Camps & Events listings), and live chat messages directly, or email spark@winbehindthescenes.com for help. Removal does not guarantee complete removal of content that others have copied or reposted.

11. How We Protect Information

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including:

• encrypted connections (HTTPS);
• passwords stored only as salted one-way hashes, and single-use, hashed, expiring password-reset codes;
• secure, HTTP-only session cookies, and protection against cross-site request forgery;
• rate limits on logins, signups, posts, uploads, and directory browsing;
• file-type checks and automatic removal of location/device metadata from uploads;
• uploaded media available only to members allowed to see it;
• two-factor sign-in required for administrators, with two-factor secrets encrypted at rest and each code usable only once;
• access to personal information limited to authorized administrators;
• a 2-device limit per account, with emailed sign-in codes for untrusted devices and unusual sign-in locations;
• encrypted backups; and
• payment card data handled by Stripe rather than WBTS.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a data breach affects your personal information, we will notify you and any required regulators as required by law.

12. Your Privacy Rights and Choices

All users. You can:

• Access and update your level, position, and account settings in My Account.
• Delete content. Delete your own posts, comments, and chat messages at any time.
• Delete your account in My Account → Delete my account, or by emailing spark@winbehindthescenes.com. This deletes your account, posts, comments, chat messages, and uploads, and cancels your individual membership. A parent's deletion also deletes their Child Profiles.
• Request a copy of your personal information, or ask us to correct it, by emailing spark@winbehindthescenes.com.
• Cancel your subscription at any time in My Account → Membership → Manage or cancel membership.

U.S. state privacy rights. Depending on where you live (including California, Colorado, Connecticut, Delaware, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia), you may have the right to:

1. know what personal information we have collected about you and how we use and disclose it;
2. access a copy of it in a portable format;
3. correct inaccurate information;
4. delete it;
5. opt out of the sale or sharing of personal information, targeted advertising, and certain profiling (we do not do these things);
6. limit use of sensitive personal information (we use it only as needed to provide the Service); and
7. not be discriminated against for using these rights.

We extend these rights to all users regardless of where they live, subject to legal exceptions.

How to make a request. Email spark@winbehindthescenes.com or write to 17350 State Highway 249, Suite 220, Houston, TX 77064. We will verify your identity (for example, by confirming the email on your account) before acting. You may use an authorized agent, who must provide proof of authority. We will respond within 45 days (or the time required by law). If we deny your request, you may appeal by replying to our decision with the subject line "Privacy Appeal." We will respond to appeals within the time required by law, and if you are not satisfied, you may contact your state Attorney General.

California Notice at Collection

The table below describes the categories of personal information we have collected in the past 12 months, as defined by the California Consumer Privacy Act.

Retention: see Section 8. Sale/sharing: none. We do not knowingly sell or share the personal information of consumers under 16.

13. Third-Party Links

The Service links to YouTube, college athletics websites, recruiting questionnaires, and other third-party sites. Their privacy practices are governed by their own policies, and we are not responsible for them.

14. Where Information Is Stored

WBTS is based in the United States, and we store and process information in the United States, in our hosting provider's U.S. data centers. The Service is intended for users in the United States.

15. Changes to This Privacy Policy

We may update this Privacy Policy. If we make material changes, we will notify you by email or a notice on the Service before the changes take effect. Each version has a version number, and our consent records show which version you agreed to. If we make a material change to how we collect, use, or disclose children's personal information, we will notify parents and obtain new verifiable parental consent where required by COPPA. The "Last Updated" date shows when this policy last changed.

16. Contact Us

CCL Capital Holdings LLC d/b/a WIN BEHIND THE SCENES 17350 State Highway 249, Suite 220, Houston, TX 77064 Email: spark@winbehindthescenes.com

Appendix A — Notice to Parents (Direct Notice Under COPPA)

Version parent-notice-2026-11-10

Dear Parent or Guardian,

You are creating a player profile for your child on WIN BEHIND THE SCENES ("WBTS"), a football training and community website operated by CCL Capital Holdings LLC (17350 State Highway 249, Suite 220, Houston, TX 77064; email spark@winbehindthescenes.com). Federal law (COPPA) requires us to tell you how we handle young children's information and to get your consent first. We apply these protections to every player 13 and under.

1. Why we are contacting you. You asked to create a profile for your child. We are using the email address from your parent account to send you this notice and a confirmation. We will not collect any of your child's information unless you give consent.

2. What we will collect. To create the profile, we collect:

• a username (no real names);
• a password;
• your child's birthdate, football level, and optional position.

We do not collect your child's email, real name, address, phone number, or school. When your child uses WBTS, we also collect:

• a session cookie and basic technical information, to keep your child logged in and the Service secure;
• records of videos opened and plan items completed, to power streaks, badges, and weekly plans;
• quiz results (position, quiz level, score, best streak, and date) when your child takes a "Quiz Yourself" quiz, so your child can track progress. Scores are private: only your child and you can see them, on your child's activity page and the Family card, and there are no leaderboards.

3. Features your child cannot use. Players 13 and under cannot use any of the following, and parents cannot turn them on:

• the Community Forums, comments, upvotes, or reports;
• live chat;
• weekly challenges;
• photo or video uploads, or viewing members' uploads;
• the Exposure college-coach directory or the Recruiting Board.

There is no private messaging on WBTS. When your child turns 14, every feature unlocks automatically: the Community Forums (posting, comments, upvotes, and reports), photo and video uploads, live chat, weekly challenges, comments on Camps & Events listings, Exposure, and the Recruiting Board. Your child can then share posts, comments, chat messages, and uploads with other members under their username. We will email you about 14 days before your child's 14th birthday and again on the day, and your child's activity page shows the unlock date. You can turn posting, uploads, live chat, or Exposure and the Recruiting Board off at any time in My Account → Family.

4. How we use and share the information. We use it only to provide WBTS to your child, keep the Service safe, and comply with law. We share it only:

• with our service providers that host and run WBTS (Render for hosting, and Resend, which delivers emails to you);
• with a team's coach/owner, and only if you approve your child's request to join that team (the coach sees username, position, level, and join date; once your child is 14, the coach can also see which assigned Team Playbook lessons and team quizzes your child opened or completed, and their team quiz answers and scores);
• as required by law or to protect safety.

Your child's information is not shown to other members or the public. We never sell your child's information, show ads, or send marketing to your child. You can consent to our collection and use of your child's information without consenting to disclosure to third parties, and we do not disclose children's information to third parties for any purpose not integral to the Service.

5. Your rights. At any time, you can:

• review your child's information (My Account → Family → View activity);
• approve or decline team requests;
• reset the password;
• delete the profile and all of its information.

You can also refuse further collection or use. Contact us at spark@winbehindthescenes.com for help.

6. How long we keep it. We keep your child's information only while the profile is active. When you delete the profile, we delete your child's information right away (and in any case within 30 days); backup copies expire within 30 days. If the profile is not used for 12 months, we email you and delete it 30 days later unless it is used again. We keep only a minimal record of your consent (no name or birthdate) for 3 years after the profile is deleted, to show that we obtained it.

7. If you do not consent. If you do not check the consent box, no profile is created and we collect no information about your child.

8. How to consent. Your WBTS membership must be started with a payment card through our payment processor, Stripe (your free trial still applies). Then check the box: "I'm this child's parent or legal guardian. I've read the Notice to Parents and consent to WIN BEHIND THE SCENES collecting and using my child's information as described." We record the date, time, and notice version, and email you a confirmation.

Read our full Privacy Policy at https://winbehindthescenes.com/privacy.

CCL Capital Holdings LLC d/b/a WIN BEHIND THE SCENES