Privacy Policy
Version 2026-04 · Last updated: April 26, 2026 · Effective: April 26, 2026
This policy is GDPR / UK GDPR Article 13 & 14 compliant and incorporates CCPA / CPRA, COPPA, BIPA / CUBI / MHMDA, and CA Age-Appropriate Design Code disclosures. A plain-language summary for athletes under 18 is in our Privacy for Minors page.
1. Who we are (Controller)
Athlete Profile Inc.("Athlete Profile", "we", "us", "our") is the data controller for the personal data described in this policy.
Postal contact: Athlete Profile Inc., [email protected]
Privacy contact / DPO: [email protected]
EU GDPR Article 27 representative: [EU representative name and EU postal address - to be filled in before EU launch via the engaged Article 27 service].
UK GDPR representative: [UK representative name and UK postal address - to be filled in before UK launch].
Notice on EU / UK availability: Until the Article 27 representatives above are engaged and named, Athlete Profile does not knowingly offer the Service to data subjects in the EU, EEA, or UK. If you reach this page from one of those regions, please do not create an account, and email [email protected] so we can record your interest.
2. What we collect, why, lawful basis, and how long we keep it
The table below is our GDPR Art. 13/14 disclosure summary. Each row is described in plain language; the legal basis column maps to GDPR Article 6 and (for biometric data) Article 9.
| Category | Examples | Lawful basis | Retention |
|---|---|---|---|
| Account data | Name, email, password hash, role. | Contract (GDPR Art. 6(1)(b)). | Life of account + 7 years for tax/accounting where applicable. |
| Athlete profile | Date of birth, height, weight, biological sex, primary sport, training history, self-reported injury history. | Contract (Art. 6(1)(b)). | Life of account. |
| Biometric data (special category - Art. 9) | Pose keypoints derived from your test videos, biomechanical signatures, symmetry composites. | Explicit consent (Art. 9(2)(a)) plus separate state-law biometric consent in IL/TX/WA. | Until you withdraw consent or delete your account; re-confirmation prompted every 12 months. |
| Raw performance video | Smartphone clips of the 5-test battery. | Explicit consent + contract. | Deleted from primary storage within 48 hours of processing (Art. 5(1)(e)). Deletions are logged. |
| Test results & scores | Percentiles, sport-fit rankings, position-fit profiles, AI coaching notes. | Contract; profiling for sport-fit is performed on the basis of explicit consent (Art. 22(2)(c)). | Life of account. |
| Payment data | Stripe customer ID, subscription ID, billing interval. Card numbers are handled by Stripe and never stored on our servers. | Contract + legal obligation (tax/accounting). | 7 years from last transaction. |
| Parental-consent data | Parent name, parent email, consent timestamp, verification token. | Legal obligation (COPPA, GDPR-K). | Life of minor's account; archived for 3 years after deletion to evidence compliance. |
| Cookies & analytics | First-party session recordings (Clarity), aggregated GA4 events, IP address. | Consent (cookie banner). Off by default in EU/UK/EEA until you accept. | Up to 26 months in GA4; up to 13 months in Clarity. |
3. Biometric data - Article 9 special-category processing
Pose keypoints derived from your test videos, the biomechanical signatures we compute from them, and any other identifier that uniquely or quasi-uniquely identifies your body movements are biometric data within the meaning of GDPR Art. 4(14) and Art. 9, BIPA (Illinois), CUBI (Texas), and MHMDA (Washington).
3.1 We collect biometric data only with your separate, explicit consent.
Biometric consent is captured at signup as a separate, granular, unticked checkbox - never bundled into Terms of Service or general privacy acknowledgement. The exact text we show, the page URL, your IP address, and your user agent are recorded as evidence in our consent ledger. You can withdraw consent at any time from Privacy & Data; withdrawal stops further processing and triggers deletion of pose keypoints within 30 days.
3.2 Minors and BIPA states.
Athletes under 18 resident in Illinois, Texas, or Washington require a parent or legal guardian to grant biometric consent on their behalf, in addition to COPPA parental consent under 13. Consent is re-confirmed every 12 months.
3.3 We do not sell biometric data and we do not let it train third-party models.
Pose keypoints stay on our infrastructure. We do not sell, rent, lease, license, trade, or otherwise profit from biometric data. We do not share biometric identifiers with data brokers, advertisers, or any third party for the purpose of training general-purpose AI models. The features we send to xAI/Grok are anonymized aggregate scores (e.g. percentile, symmetry index), not raw keypoint coordinates.
4. Raw videos - 48-hour retention and how we prove it
Performance videos uploaded for analysis are stored only as long as needed to extract the pose keypoints. They are scheduled for deletion within 48 hours of upload and are removed by an automated job that runs every hour. Each deletion is recorded in an append-only log (VideoDeletionLog) capturing the test result ID, upload time, deletion time, file path, bytes reclaimed, and job-run identifier. The log is the audit trail for our 48-hour promise and is available to regulators on request.
5. Automated decision-making (GDPR Article 22, EU AI Act)
Some features of Athlete Profile produce decisions or recommendations using profiling. The most significant is the sport-fit ranking, which combines your test percentiles with declared age, sex, height, and weight to suggest sports where your physiology is statistically aligned with the demands of elite performance. Position-fit suggestions for team-sport athletes work similarly.
Logic involved. Each sport's weights (power, agility, symmetry, coordination, balance, endurance) are published on its sport page. The ranking is probabilistic; outputs always include a confidence band. Coaches and academies can override or contextualize any output.
Significance and consequences. Sport-fit is advisory. It is not used to deny anyone access to the platform, to set prices, or to make any decision that produces legal or similarly significant effects in the GDPR Art. 22(1) sense. Even so, we honour your Art. 22 rights:
- Right to opt out of solely-automated sport-fit ranking. When opted out, the ranking layer is suspended and your reports become coach-mediated. Toggle from Privacy & Data → Automated decisions.
- Right to human review. You can request a qualified human reviewer to re-evaluate any sport-fit or position-fit output. We respond within 14 days.
- Right to explanation. The Privacy & Data tab shows the inputs, weights, and confidence band behind any specific output you click into.
EU AI Act. We are tracking the EU AI Act's classification of profiling tools and biometric categorisation systems. Where Athlete Profile is used by educational or employment-adjacent customers (e.g. an academy making selection decisions about minors), the customer is required by our Academy Pro contract to keep a qualified human in the loop and to disclose AI involvement to the athlete. We will publish formal AI Act disclosures, the relevant conformity assessment, and EU database registration before offering the Service in any EU/EEA market.
6. Recipients and processors
We share data only with the processors listed below. Each is bound by a written data-processing agreement (DPA) that includes EU Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum.
| Processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Stripe Payments Europe Ltd. / Stripe, Inc. | Payment processing, subscription billing, invoicing. | United States / Ireland | EU Standard Contractual Clauses + UK IDTA addendum on file with Stripe. |
| Resend (Resend Inc.) | Transactional email delivery (signup verification, parental consent, receipts). | United States | EU SCCs in our Resend DPA. |
| xAI (X.AI Corp.) - Grok | AI generation of training notes, nutrition guidance, and team reports from anonymized features. | United States | EU SCCs in our xAI DPA. Inputs are pseudonymized: no name, email, raw video, or pose-keypoint coordinates are sent. Outputs are not used to train xAI's models. |
| Anthropic, PBC - Claude | Optional AI generation for selected enterprise (Academy Pro) features. | United States | EU SCCs in our Anthropic DPA. Anthropic does not train on customer inputs. |
| Microsoft Clarity | First-party session analytics on the marketing site (heatmaps, anonymized session recordings). Disabled until you accept analytics cookies in the EU/UK/EEA. | United States | EU SCCs in Microsoft's standard DPA. |
| Google Analytics 4 | Aggregate marketing-site analytics. IP anonymization enabled. Disabled until you accept analytics cookies in the EU/UK/EEA. | United States | EU SCCs in Google's standard DPA. |
| Vercel Inc. | Application hosting and edge delivery. | United States | EU SCCs in Vercel's DPA. |
| Database / object-storage host | PostgreSQL database and short-lived raw-video storage. | United States or European region (depending on plan) | EU SCCs in vendor DPA. |
We do not sell or share personal information in the CCPA / CPRA sense, and we have not done so in the preceding 12 months. We may disclose data when required by law, court order, or to protect against fraud or harm.
7. International transfers
We host primary infrastructure in the United States. Where personal data of EU/UK/EEA residents is transferred to the United States or another country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and, for UK transfers, the ICO's International Data Transfer Addendum. We assess each onward transfer with a transfer impact assessment (TIA) and supplement SCCs with technical measures (encryption in transit and at rest) where required.
8. Your rights
| Right to access | Request a copy of your data - export from the dashboard or email [email protected]. |
| Right to rectification | Correct inaccurate data in the dashboard or by email. |
| Right to erasure | Delete your account and all associated data within 30 days. Some records (payment, audit logs) may be retained where law requires. |
| Right to restriction | Pause processing while a dispute or correction is open. |
| Right to portability | Receive your data in a structured, machine-readable JSON export. |
| Right to object | Object to processing based on legitimate interests, including direct marketing - we will stop. |
| Right to withdraw consent | Withdraw any consent at any time, including biometric and AI-processing consent. Withdrawal does not affect processing already completed. |
| Article 22 - automated decisions | Opt out of solely-automated sport-fit ranking, request human review, and obtain a plain-language explanation of the logic. |
| Right to lodge a complaint | With your local supervisory authority (EU/UK/EEA) or with the U.S. FTC / your state attorney general. |
To exercise any right, log in and use the Privacy & Data tab, or email [email protected]. We respond within one month (GDPR/UK GDPR) or 45 days (CCPA/CPRA).
8.1 California / Colorado / Connecticut / Virginia / Utah / Texas / Oregon residents
You have the same access, correction, deletion, portability, and opt-out rights described above. You can also: (a) opt out of the "sale" or "sharing" of personal information (we do neither, but the link is provided as a courtesy); (b) limit the use of sensitive personal information (biometric data, precise location, etc.); and (c) appeal a denied request. Use the Privacy & Data tab or email [email protected].
9. Children and parental controls
Athletes under 13 (US - COPPA), under the applicable digital-consent age in the EU/UK (13–16 by member state under GDPR Art. 8 / UK GDPR), and under 18 resident in IL/TX/WA (BIPA / CUBI / MHMDA biometric consent) require verifiable parental consent before an account can be activated. Consent is captured by an emailed magic link sent to a parent-owned address, and our age-gate refuses signups that fail the requirement. Parents can withdraw consent, request deletion, or transfer the account to the athlete at age 18 from the parent dashboard. Full detail is on our Privacy for Minors page.
10. Cookies and tracking
The marketing site uses first-party cookies for security and language preferences (necessary, no consent required), and Google Analytics 4 plus Microsoft Clarity for analytics (consent required in the EU/UK/EEA - both are blocked until you accept on the cookie banner). We do not use cross-site advertising trackers, third-party advertising SDKs, or behavioural ad networks. Do Not Track / Global Privacy Control signals are honoured as a CCPA opt-out signal.
11. Security
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access to production systems is limited to authorised personnel under written confidentiality obligations. We log administrative actions and review access quarterly. We notify regulators within 72 hours of becoming aware of a personal-data breach (GDPR Art. 33) and notify affected users without undue delay where required.
12. Data Protection Impact Assessment (DPIA)
Because Athlete Profile processes biometric data of minors and performs profiling, we maintain a written Data Protection Impact Assessment under GDPR Art. 35. The DPIA is reviewed at least annually and on every material change to processing. A summary is available to regulators and qualifying business customers under NDA on request.
13. Changes to this policy
We update this policy when our processing changes. The version label and last-updated date at the top of this page change with every revision. Material changes are notified by email to active users at least 14 days before they take effect.
14. Contact and complaints
Privacy questions: [email protected].
EU/UK/EEA: you may also lodge a complaint with your local supervisory authority. The list is at edpb.europa.eu; UK is the ICO at ico.org.uk.
US: you may also contact the FTC or your state attorney general.