Privacy Notice

Part II — Privacy Notice (GDPR Articles 13 and 14)

1. Controller. ApiX and the ApiXsports brand are operated by Marketinško svetovanje, Klemen Hosta s.p., Cerkniška ulica 5, 1000 Ljubljana, Slovenia, which is the controller. Privacy contact: info@apixsports.com. No statutory data protection officer has been appointed; the privacy contact answers every request.

2. Whose data and which data.

Athlete: identity and account data — first and last name, date of birth, sex, username, country, club and team, account e-mail (for athletes 15+ or adults), password hash; test data — results, attempts, timestamps, verification status and measurement notes (frame rate, confidence, device model), place of testing (the club’s name); derived data — APX Index, tier, ranking history; optional data — maturity data (height, weight, both parents’ heights, maturity band) if switched on; uploaded video if switched on; leaderboard visibility setting; app usage and technical data — device type, OS version, app version, the phone’s motion sensors as used by the AR framework to track position during a test, push-notification token (only after you allow notifications), error logs, IP address at sign-in.

Parent: name, relationship, e-mail, mobile number, country, order and payment reference (amount, date, Stripe transaction ID — never the card number), the ticked terms and their version and timestamp, choices made for each child, paired phones (device identifier, platform, pairing and unpairing time), pairing codes and confirmation links (stored hashed).

Coach / club user: name, e-mail, club, role, actions in the portal (audit log).

Video: recorded and processed on the phone for measurement, in the app’s private storage, excluded from phone backups, and deleted once the result is saved (at most 24 hours); not stored by ApiX unless the cloud-video choice is on. Ghost-run renders: a silhouette cut from a rival’s clip placed over the athlete’s own clip, made only from clips whose owners have switched on cloud video and ghost sharing.

3. Purposes and legal bases.

Purpose	Data	Legal basis
Provide the Service: account, tests, results, APX Index, sync, support	identity, account, test, derived, technical data	Contract (Art. 6(1)(b)) — the parent account or Testing Registration for a child profile; these Terms accepted by an athlete of consent age / adult
Athlete under the age of consent registered with a parent’s e-mail (EU only)	username, date of birth, sex, results, parent’s e-mail	Consent of the athlete with immediate notification of the parent and the parent’s right to confirm or delete (Art. 6(1)(a); Art. 8(2) reasonable efforts); profile private and minimised until the parent confirms
Profile created by a club for its player	identity, club, results; parent’s e-mail for players under the age of consent	Contract with the club and the club’s declared parental consent (Art. 6(1)(b), (f)); the parent is notified within 24 hours (Art. 14) and may take over or remove the profile
Pairing a child’s phone; parent confirmations	pairing codes, device records, confirmation links	Contract (Art. 6(1)(b)); security (Art. 6(1)(f))
Club access to its players’ results	test and derived data, club link	Contract (Art. 6(1)(b)); the club’s own processing rests on the club’s own basis
Biological-maturity estimate	maturity data	Explicit consent (Art. 9(2)(a)) — Part III switch or the box on the Testing Registration; below the age of digital consent given by the parent
Cloud video: higher-precision verification, replay, racing your own earlier run	uploaded video	Consent (Art. 6(1)(a)) — Part III switch
Ghost sharing: other athletes race against your silhouette	uploaded video, silhouette renders, username	Consent (Art. 6(1)(a)) — Part III switch; requires cloud video; for under-18s given by the parent and limited to friends and club-mates
Public leaderboard	username, country, age group, verified results, Index	Consent (Art. 6(1)(a)) — Part III switch; off by default under 18
News by e-mail	e-mail	Consent (Art. 6(1)(a)); ZEKom-2 — Part III switch; opt-out link in every e-mail
Photos/video of athletes in ApiX communications	images from sessions	Consent, given separately (web form line or in-app); withdrawable
Billing, invoices, tax records	parent identity, payment reference	Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c))
Security, abuse prevention, error fixing, audit and consent records	account, technical data, logs, consent records	Legitimate interest (Art. 6(1)(f)) in a secure service and in proving compliance; you may object
Maintain reference values and improve measurement	results and measurement notes without name, username, e-mail or video, aggregated by age and sex	Legitimate interest (Art. 6(1)(f)); no video is used for this without the cloud-video switch
Service messages (results ready, parent confirmation, plan ending, changes to terms)	e-mail; push notifications if allowed	Contract (Art. 6(1)(b)); push only after the system permission, marketing pushes only with the news switch

4. What ApiX does not do. No sale of personal data. No advertising in the Service and no sharing of data with advertisers or ad networks. No facial recognition, no biometric identification. No location tracking (place of testing is the club’s name). No automated decisions with legal or similarly significant effect: the APX Index is a benchmark shown to you and the club; ApiX makes no decision on it and clubs have committed to human review. No profiling of children for marketing.

5. Recipients. (a) The athlete’s club through the club portal, for its own registered players only. (b) Processors bound by data-processing agreements: Supabase Inc. — database, authentication and file storage, servers in the European Union (Ireland); Supabase also sends the account e-mails (sign-up confirmation, sign-in links, password reset); Vercel Inc. — hosting of the club portal and website; Stripe Payments Europe Ltd — payments; Expo, Inc. (US) — delivery of app updates and push notifications (platform, app version, push token); Google LLC — Firebase Cloud Messaging for push delivery on Android; Apple Inc. / Google LLC — store analytics limited to what the operating system reports, and app-store billing where used. News e-mails are not sent yet, and cloud video and ghost sharing are not available yet; the providers used for them will be named here before they start. Current list: apixsports.com/privacy#providers. (c) Authorities when the law requires. (d) The legal successor described in Part I, section 15.

6. Where. In the European Union. Providers with a US parent are certified under the EU–US Data Privacy Framework or bound by EU Standard Contractual Clauses; the data stay on EU servers. Copies of the safeguards from the privacy contact.

7. Club’s role. The club decides how it uses its players’ results (planning, records). For that it is an independent controller; questions about it go to the club. The Club Agreement obliges the club to use the portal only for players with a valid registration, to keep results inside the club, and to have a coach review results before use.

8. Retention. Account, identity, test and derived data: while the account exists plus 30 days; afterwards results may be kept anonymised (no name, username, e-mail or date of birth) for reference-value statistics. Maturity data: until the switch is turned off or the account is deleted. On-device video: deleted once the result is saved, at the latest 24 hours after recording; measurement notes on the phone: 30 days. Cloud video and ghost renders: 12 months from recording; a render is deleted at once when the rival withdraws ghost sharing. Consent and terms-acceptance records: 5 years after they end. Invoices and payment records: 10 years (ZDDV-1 Art. 86). Security logs: 12 months. Inactive accounts: after 24 months without sign-in we send two reminders and then delete the account. Crash reports: 90 days. Pairing codes: 7 days after expiry. Paired-phone records: until unpaired plus 30 days. Parent confirmation and club-invitation records: 5 years. Username reservations: 7 days. Deleting the account in the app removes personal data within 30 days from live systems and within 90 days from backups.

9. Your rights. Access, rectification, erasure, restriction, data portability (results and profile as a machine-readable file — Profile → Export), objection to processing based on legitimate interest, withdrawal of any consent at any time without affecting earlier processing (Part III switches, or e-mail). Exercise them in the app or at info@apixsports.com; we answer within one month; we may ask you to confirm you are the athlete’s parent. A parent may exercise all rights for an athlete under 15 and, with the athlete, for an athlete 15–17. Complaints: Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, or the authority of your country; you may also go to court.

10. Is providing the data required? Name, date of birth, sex, username and (for the parent) contact and payment details are needed for the contract; without them we cannot provide the Service. Everything in Part III is optional and can be refused without any effect on the Service.

11. Automated processing and the APX Index. The Index is calculated automatically from verified results by comparison with published reference values by age and sex; the method is in the app. ApiX uses it for no decision about you. If a club uses it, the club has committed to human review; you may ask ApiX for an explanation of any Index, have a result re-verified or corrected, and contest the Index.

12. Children. The Service is intended for athletes from 8 years upwards. Below the age of digital consent of the athlete’s country (15 in Slovenia) a child uses the Service through a parent account, through a profile created by their club with the parent notified, or — in the EU only — through their own registration with a parent’s e-mail, which stays private and minimised until the parent confirms. Parents hold the rights over a child profile; who decides each choice in Part III, and when control passes to the athlete, is set out in Part III. The “For athletes” notice, written for 12–17-year-olds, is shown on the child’s phone at first use and is available at apixsports.com/for-athletes. Public features are off by default for under-18s. In the United States the Service is not available to children under 13 until verifiable parental consent can be given (Part I, section 1, and section 15 below).

13. Security. Encrypted transport (TLS), encryption at rest at our hosting provider, role-based access with row-level security in the database, separate staging and production, two-factor authentication for administrative access, logging of administrative actions. If a breach is likely to put you at high risk we inform you without undue delay.

14. Changes. New purposes require your agreement first. Changes to this notice are announced in the app and by e-mail at least 30 days before they take effect.

15. Users in the United States. No sale or sharing. ApiX does not sell personal information and does not share it for cross-context behavioral advertising or targeted advertising, and has not done so in the 12 months before the date of this notice. We have no actual knowledge of selling or sharing personal information of consumers under 16. Because we do not sell or share, there is nothing to opt out of; if this ever changes, we will first offer a “Do Not Sell or Share My Personal Information” choice, honor Global Privacy Control signals, and ask for opt-in consent for anyone under 16. Your rights under US state privacy laws (including the California Consumer Privacy Act as amended by the CPRA): to know which personal information we collect, use and disclose — which this notice sets out; to access, correct and delete it; to limit the use of sensitive personal information, which we use only for the purposes in Part III; and not to be treated differently for exercising these rights. Categories collected, in the terms of those laws: identifiers (name, username, e-mail, device identifiers); characteristics of protected classifications (age, sex); sensitive personal information (maturity data, only with consent); internet or other electronic network activity (app usage and technical data); commercial information (orders and payments); inferences (APX Index and tier). Sources, purposes, recipients and retention are in sections 2, 3, 5 and 8. Requests: in the app or at info@apixsports.com; an authorized agent may act for you, and we may ask you to confirm your identity. Parents of children under 13 (COPPA). A parent may review the personal information held about their child, have it deleted, and refuse further collection or use, by writing to info@apixsports.com; ApiX does not make a child’s participation conditional on disclosing more information than the activity reasonably requires. Operator contact for COPPA purposes: Marketinško svetovanje, Klemen Hosta s.p., Cerkniška ulica 5, 1000 Ljubljana, Slovenia, info@apixsports.com.

Part III — Your choices in the app (separate from the Terms)

These five features are optional. Each has its own switch (Profile → Privacy) and is off until you turn it on. Turning a switch on is a consent; turning it off withdraws it. One exception to “off until you turn it on”: a parent can give the biological-maturity consent on the Testing Registration form; the switch then already shows as on in the app, and turning it off here withdraws it in the same way. None of them is required to use the Service, and refusing them changes nothing else. Who decides: for a child profile, the parent. For an athlete between the age of consent and 18, biological maturity, cloud video and news are the athlete’s own choices; public visibility and ghost sharing remain the parent’s until 18. From 18 all five are the athlete’s. Control passes automatically: from the athlete’s birthday on which they reach the relevant age, only the athlete can change the switch concerned. On the first use after that birthday the app tells the athlete which of those switches a parent turned on for them and asks the athlete to keep or switch off each one; a switch the athlete does not confirm within 30 days is turned off. A paired phone cannot change any of them.

Switch	What it does	Data	Basis · retention
Biological maturity	Shows the athlete’s maturity band (before / around / after the growth spurt) to give training context to results. Requires the athlete’s height and weight and the height of both biological parents.	height, weight, parents’ heights, maturity band	Explicit consent (Art. 9(2)(a)) — this switch, or the maturity box on the Testing Registration form; until switched off or the account is deleted
Cloud video	Uploads the test clip to ApiX’s EU servers so the measurement can be re-checked at higher precision, replayed, and raced against the athlete’s own earlier runs (ghost run against yourself). Never public.	video of the attempt	Consent; 12 months
Ghost sharing	Lets other athletes race against the athlete’s ghost — a fully tinted silhouette cut from the clip, never the face or the real name. Requires cloud video; switching it on switches cloud video on. For under-18s only friends and club-mates can race the ghost; renders that show another athlete stay in the app and cannot be saved or shared. Switching it off stops new ghosts at once and deletes existing renders that contain the athlete.	silhouette renders, username	Consent; while switched on
Leaderboard	Shows the athlete’s username, country, age group and verified results on the ApiX leaderboard, visible to other users. Never the real name.	username, country, age group, results, Index	Consent; while switched on
News from ApiX	E-mails about new tests, features and events (service messages are sent regardless).	e-mail	Consent (ZEKom-2); until switched off or unsubscribed

Record kept for each switch: type, on/off, timestamp, app version, notice version, who acted (athlete or parent).