Privacy Policy

Data controller

Data processing on this website and in the App is carried out by: Evalyte UG (haftungsbeschränkt), Äppelallee 27, 65203 Wiesbaden, Germany, email: info@evalyte.me.

How do we collect your data?

Some of your data is collected because you provide it to us (e.g. by email or by uploading a video). Other data is collected automatically, or with your consent, by our IT systems when you visit the website or use the App (e.g. technical data such as browser, operating system, or the time of the page view).

Retention period

Unless a more specific retention period is stated within this Privacy Policy, your personal data will remain with us until the purpose for processing no longer applies. If you exercise a legitimate right to erasure or withdraw consent to processing, your data will be deleted, provided no statutory retention obligations apply.

Video data: Uploaded videos (original and analyzed result video with skeletal overlay) are stored on servers of Hetzner Online GmbH in Falkenstein, Germany (EU), and encrypted at rest. The storage location is completely inaccessible to the public; playback occurs exclusively via time-limited, individual access links (valid for one hour). Videos are stored for a period of 12 months from the date of recording and are then automatically deleted. Performance data derived from the videos (including PrimeScore and individual values) remain unaffected by the deletion of the video and are deleted once (a) the user account is permanently deleted, or (b) at the latest two years have passed since the account was last actively used – whichever occurs first; you will receive advance notice by email before any deletion due to inactivity. Fully anonymized personal bests may nonetheless remain on public leaderboards after account deletion, as described in Section 1.

Visibility of videos: Within the App, videos are visible exclusively to the respective athlete, or their legal guardians, and to their coach. Access via the admin dashboard, or by any other user, is not technically provided for. Technical access to video data is limited exclusively to persons EVALYTE has commissioned to operate the system, in support or troubleshooting cases; such persons are bound by confidentiality.

Deletion after analysis: You may optionally choose, in your user area, to have a video fully deleted after analysis is complete (original video and result video). This deletion is final; we therefore recommend downloading the video to your device beforehand via the download function provided in the App, should you wish to keep it.

Upon deletion of your account, your personal data (including name, address, date of birth, access code, videos and photos) will be removed or anonymized. Performances already achieved may thereafter remain in fully anonymized form (without any technical link to your identity) on public leaderboards.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL/TLS encryption, recognizable by "https://" and the padlock icon in your browser bar.

Vercel (App hosting)

We host our web application with Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel provides the technical infrastructure to ensure fast and secure access to our App. Technically necessary connection data (e.g. IP address) is processed in this context. We have configured Vercel so that server functions are preferably executed in the Frankfurt (Germany) region. Data security is safeguarded through Standard Contractual Clauses (SCCs).

Hetzner (AI video analysis and video storage)

Both the computation for AI video analysis and the storage of video data itself take place with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (server location Falkenstein, Germany). No transfer to third countries takes place.

Azure OpenAI (Microsoft)

When analyzing the 30-meter sprint (start and finish line detection), individual still images from the video are transmitted to and processed by an image service provided by Microsoft (Azure OpenAI), for the purpose of detecting the markers and for plausibility checks. The complete video is not transmitted; no other skills transmit image data to Microsoft. Processing takes place in an Azure region within the European Union.

Microsoft stores the transmitted images for up to 30 days by default for abuse-detection purposes, separate from any training of its own models and without using the images for that purpose. Any human review carried out as part of this abuse monitoring likewise takes place within the European Economic Area. Where processing outside the EU/EEA occurs in individual cases, this is safeguarded by Standard Contractual Clauses (SCCs).

Order processing

We have entered into data processing agreements with all providers named above, to ensure your data is processed only on our instructions and in compliance with the GDPR.

Cookies & local storage

Our services use so-called "cookies" and local storage technologies. These do not damage your device and contain no viruses. We use technically necessary storage for login status and the subscription process (legal basis Art. 6(1)(f) GDPR, legitimate interest in error-free service provision).

Contact inquiries

If you contact us by email, via the contact form on our website, or by telephone, your inquiry, including any personal data arising from it, will be stored and processed by us for the purpose of handling your request. Emails sent via the contact form are technically routed through the Brevo service described below. We do not pass this data on without your consent.

Transactional emails and contact form (registration confirmation, password reset, contact inquiries)

For sending automated system messages (e.g. confirmation link after registration, password-reset link) as well as emails sent via the contact form on our website, we use the email service provider Brevo (Sendinblue SAS), 7 Rue de Madrid, 75008 Paris, France. Brevo processes the email address and technically necessary message content on our behalf. As Brevo is based within the European Union, no transfer to a third country takes place; the GDPR applies directly. A data processing agreement is in place with Brevo.

Payment processing via Stripe

We process subscriptions via Stripe Payments Europe Ltd. (Ireland). Payments are processed exclusively via our website. A payment method is only stored for paid use; for free minor users, parental consent is instead obtained via a double opt-in email procedure. This processing is based on Art. 6(1)(b) GDPR as well as our legitimate interest in secure payment processing.

Google Fonts (local hosting)

This site uses locally installed Google Fonts for consistent display of typefaces. No connection to Google servers is made in this context (Art. 6(1)(f) GDPR).

AI-assisted website content (Google Gemini)

To the extent we use AI tools (Google Gemini) to help create content for our website, this concerns exclusively website content and not the movement analysis within the App. No personal data of users is processed in this context.

We currently do not use any active product or reach analytics tool. Should such a tool be activated in the future, this Privacy Policy will be updated in advance to include the required details (purpose, legal basis, any third-country transfer with Standard Contractual Clauses).

EVALYTE's core function is the analysis of athletic movements. When you upload a video, we analyze body posture and movement patterns (skeletal tracking). Posture analysis is performed using our own, already-trained model on our own computing infrastructure (see Section 2, Hetzner). When analyzing the 30-meter sprint, an image model provided by Microsoft (Azure OpenAI) is additionally used to detect start/finish markers (see Section 2). This constitutes biometric data.

• Consent: This processing takes place exclusively on the basis of your express consent, or that of your legal guardians, pursuant to Art. 9(2)(a) GDPR. The separately requested use for quality assurance and further development (see below) is independent of this and is based on its own, freely given consent.
• Automated evaluation: The calculation of your performance data and the PrimeScore is carried out automatically by already-trained, unchanging models. There is no automated, continuously self-learning processing of your videos (no automated retraining based on your data).
• Manual quality assurance and further development: For the purposes of occasional manual review of analysis results and targeted further development and improvement of detection accuracy, anonymized data from your recordings (with no link back to your identity) may be viewed and evaluated by authorized personnel or processors bound by confidentiality. This use is independent of the core analysis and is based on separate, freely given consent, which is requested at registration separately from consent to the core analysis and which may be individually withdrawn at any time without any effect on your use of the App otherwise. Any resulting adjustments to detection models are carried out through targeted human development work, not automated, and apply exclusively to future recordings; already published results (e.g. PrimeScore, rankings) are not retroactively altered as a result. If you believe an individual analysis result to be incorrect, you may request a new evaluation for that specific video regardless of this consent.
• Visibility: Within the App, your videos are visible exclusively to you (or your legal guardians) and your coach (see Section 1). In public views such as leaderboards, the video itself is never shown, only the reduced representation described in Section 7.
• Avatar technology: In public views (leaderboards) as well as by default on the PlayerCard, an abstract avatar is displayed instead of a real photo. The stored original video remains unaffected and unchanged; the avatar is purely a display feature for leaderboards and the PlayerCard, and does not alter the stored video data.
• Withdrawal: You may withdraw this consent at any time with effect for the future.

Transparency under the EU AI Act: We inform you that the movement analysis and the calculation of the PrimeScore are carried out automatically by an AI-based biometric categorization system (Art. 50(3) AI Act). The avatar shown in public views is a graphic you selected or designed yourself and is not an AI-generated representation of your person.

Scouting

EVALYTE acts as a "gatekeeper." Personal performance data (real name) is disclosed to third parties (scouts, clubs) only if (1) the user, or their guardians, have expressly consented to the matchmaking process in the individual case, or (2) the data is used in fully anonymized form for statistical purposes.

Visibility on leaderboards and the PlayerCard

Public leaderboards by default display only a nickname or ID and an avatar, never real names or photos. Real names and photos are accessible only to coaches and administrators within the team. Players, or their legal guardians, may set in their account settings that only nickname/ID and avatar are shown within the team as well.

Users may optionally display their real name and a real photo on their PlayerCard instead of avatar and ID. For minor users, a dedicated toggle is provided for this: only after express consent from the legal guardians, obtained via a separate confirmation email, is the display of real name and photo on the PlayerCard enabled. Until confirmation, the avatar and ID remain displayed. Legal guardians may revoke this authorization at any time; the display then reverts to avatar and ID without any further confirmation being required.

Use for marketing and public relations

Should we wish to feature individual athletes, on account of outstanding athletic performance, in our own public relations activities (e.g. on our website, in the App, on social media, or other channels we use for public relations purposes, such as social media posts, interviews, testimonials, photo shoots or filming on location, mentioning name, PlayerCard, honeycomb graphic, photos or videos), we will contact the individual concerned, or their legal guardians in the case of minors, separately in each individual case and actively request permission. Where such a request also involves the provision of additional material not already in our possession (e.g. a personal photo) or a personal appointment on location, this will be expressly requested as part of that individual case and forms part of the consent given. For personal appointments with minor athletes, legal guardians will either be present or will have expressly consented in advance to the specific arrangements for the appointment. Such use never takes place automatically or as a precondition for using EVALYTE, but exclusively on the basis of separately given, freely revocable consent (Art. 6(1)(a) GDPR) relating to the specifically proposed purpose and scope of use.

If you use EVALYTE from the United States, we separately draw your attention to the following: Several U.S. states (including Illinois, Texas, and Washington), as well as numerous other states with comprehensive data protection laws (including California, Colorado, and Virginia), classify movement and skeletal data as "biometric identifiers" and impose their own requirements for their processing, independent of the user's age.

• Separate consent: Processing of your biometric movement data for U.S. users is based on a standalone, express consent, obtained separately from general registration, which specifically states the nature, purpose, and retention period of the processing.
• Retention and deletion: Your biometric data (original video, result video) is stored for 12 months from the date of recording and is thereafter automatically deleted or irrevocably destroyed (see Section 1).
• No sale: EVALYTE does not sell, lease, trade, or otherwise derive a financial benefit from disclosing biometric data to third parties. Disclosure occurs only in the cases described in Section 7 (case-by-case consent, fully anonymized).
• Security: Biometric data is protected with the same or a higher security standard as comparable confidential information held by EVALYTE (see Sections 1 and 2).

You have the right, at any time and free of charge, to request information about your stored personal data, its origin and recipients, and the purpose of processing, as well as the right to rectification or erasure of this data. You may withdraw any consent given at any time; the lawfulness of processing carried out prior to withdrawal remains unaffected.

You have the right, on grounds relating to your particular situation, to object to the processing of your personal data (Art. 21 GDPR); this also applies to profiling based on these provisions. If your data is processed for direct marketing purposes, you have the right to object at any time.

You furthermore have the right to restriction of processing, the right to data portability, and the right to lodge a complaint with a supervisory authority.