1. Scope and roles
This Notice explains how BagTag LLC, doing business as BagTag handles personal information in BagTag. For league-directed claims, rewards, optional league highlights, and league privacy operations, the league generally determines the local program purpose and BagTag processes information to provide the service. BagTag independently determines purposes for platform security, account administration, service improvement, legal compliance, and its business operations. Sponsors, reward partners, and external sites act independently for information they collect outside BagTag. Exact legal roles depend on applicable law and the signed agreements.
2. Information collected
- Adult and player names, adult email, league, team, game, award slot, claim status, verification and reservation data.
- Reward entitlement, selected offer and location, confirmation code, staff confirmation, reversal, and timestamps.
- Optional story, public display choice, image/video, media metadata, moderation and publication status, and versioned consent records.
- Staff name, work email, organization, role, invitation, session, IP address, user agent, authorization evidence, application, and attestation data.
- Sponsor or partner organization profile, locations, offer terms, lead destination, partnership, commitment, and operational communications.
- Public-page and program events, pseudonymous session identifier, referrer, device/network context, logs, audit events, provider webhooks, and error details.
3. Sources
We receive information from the adult or staff user, their league or organization, an authorized league officer, another authorized administrator, public-page interactions, service providers, and—in limited cases—publicly available organization information. We do not buy child or family marketing lists.
4. Purposes
- Verify a real award and prevent duplicate, fraudulent, or expired claims.
- Deliver, retrieve, secure, and confirm one reward.
- Operate league, sponsor, partner, and platform workspaces and enforce permissions.
- Moderate and, only when authorized, publish optional recognition content.
- Provide aggregate measurement, reporting, service support, privacy responses, audits, incident investigation, and legal compliance.
- Maintain, debug, secure, and improve the service and communicate material operational information.
5. Disclosures
We disclose information to the league staff needed to run its program; to reward-partner staff only as needed to confirm a selected reward; to platform staff according to least-privilege support duties; to service providers under contract; and when required for safety, legal process, corporate transactions, or to protect rights. Sponsors receive aggregate reporting and approved public engagement information—not claim emails, player identities, or family histories. We do not sell family claim data for money.
6. Youth and family information
BagTag claim and media flows are directed to adult parents or legal guardians and do not create child accounts. We collect limited information about a youth athlete from the adult to verify recognition. Optional media is separate from the reward. Read the Youth Privacy and Media Notice for the complete choices and safeguards. A league must not direct children to submit information themselves.
7. Cookies and measurement
BagTag uses essential cookies for security, sessions, preferences, verification, and workflow continuity. It may use a first-party pseudonymous identifier for aggregate public-program measurement. When someone follows an approved sponsor link, BagTag sends that destination a separate destination-scoped pseudonym—not the BagTag identifier or any name, email, claim, or player data. We do not use third-party behavioral advertising cookies in the BagTag service. See the Cookie and Tracking Notice for the inventory and controls.
8. Retention
We retain information only for the period reasonably necessary for the purpose, the league's documented instructions, safety and fraud prevention, legal obligations, dispute resolution, and enforcement. Expired security tokens are removed after a short grace period; rejected media is scheduled for provider deletion after the configured review period; withdrawn media is hidden and queued for removal; sessions and invitations expire. After an eligible deletion, BagTag may retain a minimal keyed, non-readable erasure marker so an overlapping request or delayed system action cannot recreate deleted contact data. The current service retains that pseudonymous marker while the league-directed claim system could accept a later action for the same subject; the operator must document its lawful basis, review necessity at least annually, and remove or rekey it when it is no longer necessary. Claims, consent evidence, redemptions, agreements, audit records, and financial or contractual records may be pseudonymized or retained longer where accountability or law requires. Backups age out under provider schedules rather than being edited in place.
9. Security
BagTag uses encryption for sensitive family fields, keyed non-reversible email lookup values, hashed bearer tokens, role and tenant checks, audit trails, security headers, rate limits, private administrative routes, and provider access controls. No system can guarantee absolute security. Do not send secrets or unnecessary child information through support messages.
10. Choices and rights
BagTag verifies the requester's email and may require additional evidence proportionate to the request. Start at /privacy/requests. Some requests require the league and BagTag to coordinate. We may retain minimal proof of the request and response. Public takedown and access revocation occur before a deletion case is closed; final completion may wait for confirmation from an outside media provider. A message already accepted by an email provider before processing began may still arrive.
- Correct inaccurate information.
- Request access or a portable copy where applicable.
- Request deletion or pseudonymization, subject to lawful exceptions.
- Withdraw optional media/publication permission and request takedown.
- Object to or restrict certain processing where applicable.
- Opt out of any legally defined sale, sharing, targeted advertising, or profiling if introduced or applicable.
- Use an authorized agent where law permits, appeal a denied request where required, and receive equal service without unlawful discrimination.
11. International and state-specific matters
The service is presently designed for US youth-sports programs unless a signed agreement says otherwise. State privacy laws apply only when their scope and thresholds are met. Where applicable, residents receive the rights required by their law. BagTag does not knowingly use sensitive family information to infer characteristics or make automated decisions with legal or similarly significant effects.
12. Changes and contact
We will post material changes with a new date and provide additional notice or consent when law requires it.
- Privacy: support@bagtag.com
- Security: support@bagtag.com
- Mail: 123 Main St, Anytown, USA 12345