ICON/METHOD← BACK TO APP

Privacy Policy

Last updated: 24 September 2026

This Privacy Policy explains how Iconic Elevation Network LLC (“Iconic”, “we”, “us”, “our”), collects, uses, shares, and protects your personal data when you use the ICON Method app, website, and related services.

We act as the data controller for the personal data processed via the Service. We comply with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the Data Protection Act 2018.

1. What data we collect

We collect the following categories of personal data about you:

1.1 Account data

  • Full name
  • Email address
  • Password (stored as a one-way hash; we never see your password)
  • Phone number and country dialling code
  • WhatsApp opt-in status
  • Date of birth
  • Country of residence
  • Football position
  • Current playing level
  • Access code or subscription tier
  • A parent or next-of-kin contact you give us: their name, relationship to you, phone number and email (a parent or legal guardian if you are under 18). Please let them know you have shared their details with us.

1.2 Activity and submission data

  • Video and photo uploads submitted via the daily vlog and journey check-in features
  • Journal entries and challenge submissions
  • Community posts, comments, and likes
  • Module completion and progress data
  • Streak, mission, and engagement metrics

1.3 Payment data

Payment card details are processed by Commas (operated by FanBasis) and are not stored on our servers. We retain transaction records (date, amount, tier purchased, invoice number, last four digits of card) for accounting and compliance.

1.4 Technical and device data

  • IP address
  • Browser and device type
  • Operating system
  • Pages and features accessed
  • Session duration and timestamps
  • Crash reports and error logs

1.5 Communications data

  • Emails, WhatsApp messages, and DMs you exchange with us
  • Calls or video sessions you book or attend (metadata only)
  • Support requests and feedback

2. How we use your data

We process your personal data for the following purposes:

  • Service delivery — to operate the app, deliver programme content, track progress, schedule trials, and provide coaching.
  • Account management — to authenticate logins, manage your subscription, send transactional notifications.
  • Customer support — to respond to questions, resolve issues, handle complaints.
  • Marketing — where you have opted in, to send you updates about the Service, new modules, success stories, and offers.
  • Analytics and improvement — to understand how the Service is used, identify bugs, and improve features.
  • Trial placement — to share your profile (player name, position, age, level, highlight content) with relevant partner clubs and scouts in the ICON Method network.
  • Testimonials and marketing content — where granted under the content licence in our Terms of Service, to use your submitted content in our marketing.
  • Your parent or next of kin — to contact them in an emergency, about an Iconic Trial or club trial you are part of, and, if you are under 18, to keep your parent or guardian informed. We never use their details for marketing.
  • Legal and compliance — to comply with applicable laws, enforce our Terms, prevent fraud, and protect our rights.

3. Legal basis for processing

Under UK GDPR and EU GDPR, we rely on the following legal bases:

  • Contract (Article 6(1)(b)) — to deliver the Service you have purchased.
  • Consent (Article 6(1)(a)) — for marketing communications, optional cookies, and the perpetual content licence.
  • Legitimate interests (Article 6(1)(f)) — for analytics, fraud prevention, network operations, and the development of new features. You can object to this at any time.
  • Legal obligation (Article 6(1)(c)) — for accounting, tax, and regulatory compliance.

Where you are under 18, we additionally rely on parental consent under Article 8 GDPR.

4. Who we share your data with

We share personal data only as necessary and with the following categories of recipients:

4.1 Service providers (data processors)

  • Supabase — database hosting and authentication (data residency: London, United Kingdom).
  • Commas (FanBasis) — payment processing and subscription management.
  • Vercel — application hosting and content delivery.
  • Bunny.net (Bunny Stream) — video storage, encoding, and streaming.
  • GoHighLevel and Klaviyo — our CRM, email and SMS platforms, used for booking, service and marketing messages.
  • OneSignal — push notifications, only if you allow notifications on your device.
  • PostHog — product analytics, session replay, and feature usage tracking. Data stored on PostHog Cloud EU (eu.i.posthog.com). Session recordings mask password fields by default. See posthog.com/privacy.

All processors are contractually bound to handle your data in line with this Privacy Policy and applicable data protection law.

We do not currently send your data to AI providers. If we switch on AI features such as voice-note transcription or the AI assistant, we will update this list before they go live.

4.2 Partner clubs and scouts

Where you are being considered for, or placed at, a trial, we share a limited portion of your profile (name, position, age, level, nationality, highlight content) with the relevant partner club, scout, or coach. We share only what is necessary for them to assess and host you.

4.3 Legal authorities

We may disclose your data to law enforcement or regulatory authorities where required by law, court order, or to protect our legal rights.

4.4 Business transfers

If ICON Method is acquired by, merges with, or sells assets to another entity, your data may be transferred as part of that transaction. We will notify you of any change in data controller.

We do not sell your personal data to third parties.

5. International transfers

Some of our processors are located outside the UK and the European Economic Area. Where we transfer your data internationally, we rely on:

  • UK and EU adequacy decisions where they exist, or
  • Standard Contractual Clauses (and the UK International Data Transfer Addendum) supplemented by appropriate safeguards.

6. Data retention

We retain your personal data for the following periods:

  • Account data — for the duration of your account, plus 24 months after termination, then deleted or anonymised.
  • Submission data (vlogs, journal, comments) — for the duration of your account; you may request deletion of specific submissions at any time.
  • Content used in marketing — retained under the perpetual content licence granted in our Terms of Service until you formally revoke the licence in writing.
  • Payment and transaction records — 7 years from the date of the transaction, in line with HMRC and accounting requirements.
  • Communications — 36 months from the last contact.
  • Technical logs — 12 months.

7. Your rights

Under UK GDPR and EU GDPR, you have the following rights:

  • Right of access — request a copy of the personal data we hold about you.
  • Right to rectification — ask us to correct inaccurate or incomplete data.
  • Right to erasure (“right to be forgotten”) — ask us to delete your data, subject to legal retention obligations.
  • Right to restrict processing — ask us to limit how we use your data while a query is resolved.
  • Right to data portability — receive your data in a machine-readable format.
  • Right to object — to processing based on legitimate interests, including direct marketing.
  • Right to withdraw consent — at any time, for any processing that relies on consent. Withdrawal does not affect the lawfulness of prior processing.
  • Right not to be subject to automated decision-making — we do not make automated decisions about you that have legal or similarly significant effects.

To exercise any of these rights, email us at team@applyiconicelevationnetwork.com. We will respond within one month.

You also have the right to complain to a data protection authority. In the EU, that is the authority in the country where you live; in Spain, it is the Agencia Española de Protección de Datos (aepd.es). In the UK, it is the Information Commissioner’s Office (ico.org.uk). We would appreciate the chance to deal with your concern first, so please contact us.

8. Children’s data

The Service is available to Players aged 16 and over. Where a Player is between 16 and 17, we require parental consent at signup and treat the parent or legal guardian as the responsible adult for the account.

We do not knowingly collect personal data from anyone under 16. If you believe we have done so, please contact us and we will delete the data.

9. Cookies and similar technologies

We use cookies and similar technologies to operate the Service. See our Cookie Policy for details on which cookies we use and how to control them.

10. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encryption at rest where provided by our infrastructure providers, role-based access controls, and regular security reviews. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and the relevant supervisory authority where required.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or in-app notice. The “Last updated” date at the top of this page reflects the most recent revision.

12. Contact

Iconic Elevation Network LLC
75 E 3rd St, Sheridan, WY 82801, United States
Email: team@applyiconicelevationnetwork.com