What we know about you, and what we do with it

1. What we collect

When you create an account: your email address, your name if you give it, your date of birth, which we check to confirm you are 18 or over and then discard, keeping only the year, and the public address of the account that holds your cards. Your sign-in is a passkey that lives on your device; we never see it.

When you are an athlete: the profile you write, the photos and video you upload, your sport, school or team and the results you choose to link, your social handles if you connect them, and the address you nominate for your share of sales. Identity verification for payouts is done by our payout partner; we receive a confirmation that you passed, not your documents.

When you tell your story out loud: speech is turned into text by your browser's own voice typing, not by us. On most browsers that audio goes to the browser's maker (Google for Chrome, Apple for Safari) under its own privacy policy. We never receive the recording, only the text you see on screen. If you ask us to tidy your story, that text, with your sport and school, is sent to our AI provider to write a draft; nothing is saved to your page until you choose to keep it.

When you record a video bio: the clip you record or upload, how long it is, and when you confirmed it is you and that we may show it. It is stored with our hosting provider and shown on your page and your card pages only after our team reviews it. If our team records it with you during an onboarding session, you agree to that first. You can record a new one at any time, and you can ask us to take a video down by writing to us.

When you buy, gift or sell: the order (which card, price, fee, time), the public record of the sale on the ledger, the email address of a person you gift a card to, and the confirmation from our funding partner that a payment succeeded or failed. We do not receive your card number or bank details; the funding partner does, under its own privacy policy.

When you use the site: the pages you visit, which sign-up steps you complete (so we can see where people get stuck), the device and browser you use, your approximate location from your IP address, and error reports. We use a small number of cookies: one to keep you signed in, one to remember your language, and one for the session. We do not run third-party advertising cookies.

When you write to us: what you write and how to reach you.

2. Why we collect it

To run the service: create your account, show you your cards, complete a purchase or a gift, pay the athlete, send you a receipt. To meet legal duties: confirm you are an adult, verify sellers before they are paid, keep the records the tax and anti-money-laundering rules require, and answer lawful requests. To keep Next Up safe: detect fraud, abuse, price manipulation and accounts that break the terms. To improve the product: understand which pages work and which fail. To keep in touch: send you receipts and account notices, remind athletes once a week about any unfinished part of their page (you can turn these reminders off from any of them), and, only if you opt in, news about athletes you back.

In places where the law asks for a legal basis, ours is performance of our contract with you, our legal obligations, our legitimate interest in running a safe marketplace, and, for marketing and optional cookies, your consent.

3. Who sees it

Athletes and collectors see what is public by design: an athlete's page and cards, and, for each card, the first holder's chosen display name and the year she started backing the athlete. Your email, birth year and order history are never public.

Our partners see what they need to do their job and nothing more: the funding partner sees the payment you make to fund your account; the payout partner verifies athlete identity and moves money to a bank; our hosting, database, email and storage providers process data on our instructions; our AI provider drafts an athlete's story only when she asks for one, under terms that do not let it use what we send to train its models; a verification provider may confirm age or identity where we are required to. Each is bound by contract to use your information only to provide its service to us.

The public ledger records the sale itself: the accounts involved, the card and the amounts. It does not record your name, and we do not publish the link between your name and your account.

We share information with authorities when the law requires it, with our professional advisers under confidentiality, and, if Next Up is ever sold or merged, with the buyer under the same protections as this policy. We do not sell personal information and we do not share it for anyone else's advertising.

4. How long we keep it

Your account information for as long as you have an account and for as long afterwards as the law requires us to keep transaction records, generally seven years for sales. Site logs for ninety days. Email you send us for as long as the matter is open plus a year. The record of a sale on the public ledger is permanent by design and cannot be deleted by us; it contains no name.

5. Your choices and rights

You can see and correct your account information on your account page. You can close your account by writing to us; we delete what we are not required to keep and tell you what we kept and why. You can ask us for a copy of the personal information we hold about you, ask us to correct it, object to a use of it, or ask us to restrict it, and where we rely on consent you can withdraw it. Residents of California, the European Economic Area, the United Kingdom and other places with privacy laws have these rights by statute; we extend them to everyone.

To exercise any of them, write to us at the address at the end of this policy. We answer within thirty days. We will not treat you differently for exercising a right.

You can turn off marketing email with the link in any message. Receipts and account notices are part of the service and cannot be turned off while you have an account.

6. Children

Next Up is for adults. We do not knowingly collect information from anyone under 18, and we close any account we find that belongs to a minor. If you believe a minor has an account, tell us and we will act on it.

7. Security

Your sign-in is a passkey on your device, which means there is no password of yours for anyone to steal from us. Data moves over encrypted connections and is stored with providers that meet recognised security standards. Access inside Next Up is limited to the people who need it. No system is perfect; if a breach ever affects your information we will tell you and the authorities as the law requires.

8. Where your information lives

Next Up is operated from the United States and your information is processed there and wherever our providers run. If you use Next Up from outside the United States, you understand that your information is transferred to it. Where the law requires safeguards for such transfers, we use recognised contractual protections.

9. Changes

When this policy changes, we post the new version here with a new effective date and, for changes that affect you, tell account holders by email.