Privacy Policy

1. Who We Are

Pixels Point Ltd is a company registered in England and Wales under company number 11129649, with its registered office at 44 Stornoway Road, Birmingham, England, B35 6NT. We operate the Peak Performance AI platform.

You can contact us about any privacy matter at: enquirepixelspoint@pixelspoint.co.uk.

2. Our Role: Data Controller and Data Processor

Because of how the Service works, Pixels Point acts in two different capacities depending on whose data is involved. This distinction matters because it determines who you should contact first with a query or request.

2.1. Where Pixels Point is the Data Controller

Pixels Point is the Data Controller in respect of the personal data of Club Administrators and Coaches who register for and use the Service — for example, their name, email address, password, and account activity. If you are a Club Administrator or Coach, you can direct questions about your own personal data to us directly using the details in Section 1.

2.2. Where Pixels Point is a Data Processor

Where a Club enters personal data about its Players and their Parents/Guardians into the Service (such as a Player's name, date of birth, team, session records, or wellness/medical notes), the Club is the Data Controller of that data, and Pixels Point acts only as a Data Processor, processing it strictly on the Club's instructions and under the terms of a Data Processing Agreement accepted by the Club at registration. If you are a Player, or a Parent/Guardian of a Player, and you have a question about how your or your child's data is used, you should contact the Club directly in the first instance, as they are responsible for that data. Pixels Point will support the Club in responding to any such request where needed.

2.3. Parents/Guardians who create a Parent Account

A Parent/Guardian can create their own Parent Account, using a one-time invite code issued by their child’s Club. For the personal data of the Parent Account itself (name, email address, password and sign-in activity), Pixels Point is the Data Controller, in the same way as for Club Administrators and Coaches, and you can contact us directly about it using the details in Section 1.

The Club remains the Data Controller of your child’s personal data and of the record of your consent. Pixels Point processes those on the Club’s instructions as Data Processor, and records your consent on the Club’s behalf so the Club can rely on it.

3. Personal Data We Collect

3.1. Account and Club Data (collected directly)

• Club Administrator and Coach details: name, email address, password (stored securely, not in plain text), role, and account activity.
• Club details: club name, sport, city/town, contact email, contact phone number.
• Billing information: once a paid Subscription Plan is selected, billing-related data is processed by our payment processor, Stripe. We do not directly store full payment card numbers.

3.2. Player and Team Data (entered by the Club)

• Player details: name, age/date of birth, team, sport, squad number, and playing position.
• Session data: training and match session logs, including notes entered manually or via voice input.
• Match preparation data: opposition details and tactical notes entered by Coaches.
• Wellness and medical information: where a Club chooses to record it, notes relating to a Player's injuries, wellness scores, or medical flags. This is Special Category Data under Article 9 UK GDPR — see Section 4 below.
• Communications: messages sent between Coaches within the Service (direct messages).
• Photos: profile photos of Players and Teams, where a Club chooses to upload them. Photos are stored in a folder that anyone who has the exact web address of a photo can open, so a Club should only upload a Player's photo if it has the permission of that Player's Parent/Guardian.

3.3. Technical and Usage Data

• Log-in and session data (via Supabase Authentication), including timestamps of account activity.
• Basic technical data such as browser type and general usage patterns, used to maintain and improve the Service.
• Language preference (the Service supports multiple languages).

3.4. Parent/Guardian Account and Consent Data (collected from Parents/Guardians)

• Parent Account details: your full name, email address, password (stored securely, not in plain text), your relationship to the child, and sign-in activity.
• Invite and link data: which child your account is linked to, and when. We store only a scrambled (hashed) version of the one-time invite code, never the code itself, and we count incorrect attempts so that a code is blocked after too many wrong tries.
• Consent records: when you give or withdraw consent, we record your name, your decision, the date and time, the method used (the Parent Area), and the version of the consent statement you were shown.
• Progress updates: short written updates about your child that a Coach or Club Administrator has chosen to publish for you, with the date, the name of the person who published it, and whether you have seen it. These are data about your child, held for the Club.

4. Special Category Data (Health and Medical Information)

Where a Club records wellness, injury, or medical information about a Player within the Service, this constitutes Special Category Data under Article 9 UK GDPR, which receives additional legal protection. The Club, as Data Controller, is responsible for ensuring an appropriate condition under Article 9 applies — most commonly, explicit consent from the Player's Parent/Guardian (or the Player themselves, where old enough to provide informed consent) — before entering such data into the Service. Pixels Point processes this data only as instructed by the Club and does not independently determine the legal basis on which it is collected.

Access to medical and wellness data within a Club's Account can be restricted by the Club Administrator to specific Coaches on a need-to-know basis, using the Service's permission controls.

Where a Parent/Guardian gives consent through the Parent Area, the Service records that consent, including the wording shown, on the Club’s behalf, so that the Club can rely on it as explicit consent. A Parent/Guardian can withdraw that consent at any time in the Parent Area, and the Service then stops using the child’s data straight away, as described in Section 5.

5. Children's Personal Data

We recognise that a significant proportion of the personal data processed through the Service relates to children and young people (Players under the age of 18). We have designed the Service, and this policy, with reference to the Information Commissioner's Office (ICO) Age Appropriate Design Code (the "Children's Code").

Key points about how we approach children's data:

• Players do not, at this time, register their own accounts or log in to the Service directly — their personal data is entered and managed on their behalf by the Club, under arrangements the Club is responsible for putting in place with Parents/Guardians (for example, through the Club's own registration or membership forms).
• Parents/Guardians can create a Parent Account using a one-time invite code from the Club together with the child’s date of birth. A Parent Account is kept separate from Club accounts. It shows a parent their own linked child’s consent status and the consent statement, lets them give or withdraw consent, and shows any progress updates a Coach or Club Administrator has chosen to publish for them. It cannot show wellness, medical or session records, any other coaching information, or anything about any other child. A Club Administrator can delete a published update. If you withdraw consent, no new updates can be published for your child, but updates already published to you remain visible to you. It does not use marketing, profiling or nudge techniques, and it collects only the information needed to run the account and record consent.
• Under the Service’s own rules, a Player under 16 is locked until a Parent/Guardian’s consent has been recorded, either by the Club Administrator or by the Parent/Guardian in the Parent Area. While a Player is locked, wellness check-ins cannot be recorded for them and their information is not used by, or sent to, the AI features. If consent is withdrawn, the Player is locked again straight away. Information already recorded stays with the Club until it is deleted, and a Parent/Guardian can ask the Club to delete it at any time.
• Where the Service is extended further in future, for example to show Parents/Guardians progress information about their child or to allow direct access by Players, we will review this policy and the design of that functionality against the Children’s Code before launch, including default privacy settings, use of nudge techniques, and profiling.
• We do not knowingly use children's personal data for marketing purposes, nor do we permit it to be used to train third-party AI models (see Section 7).
• We rely on Clubs, as Data Controllers, to ensure that appropriate parental consent is obtained before a child's personal data — particularly Special Category Data — is entered into the Service.

6. How We Use Personal Data and Our Legal Bases

We use personal data for the following purposes, relying on the UK GDPR legal bases indicated:

• To provide and operate the Service (creating accounts, storing Club/Player/session data, generating reports) — necessary for the performance of our contract with the Club, or, in respect of Player/Parent data, processed on the Club's instructions as Data Processor.
• To generate AI-assisted coaching reports and insights — performance of our contract with the Club (see Section 7 for detail on AI processing).
• To process payments for paid Subscription Plans — necessary for the performance of our contract with the Club.
• To let Coaches share progress updates with Parents/Guardians — processing on the Club’s instructions as Data Processor. Nothing is shared with a Parent/Guardian unless a Coach or Club Administrator reads it and chooses to publish it, and no email or other notification is sent automatically.
• To provide Parent Accounts and to record Parent/Guardian consent — for Parent Account data, our legitimate interest in enabling Parents/Guardians to manage their child’s consent; and, for the consent record itself, processing on the Club’s instructions as Data Processor.
• To communicate with Club Administrators about their Account, billing, or support queries — necessary for the performance of our contract, and our legitimate interest in providing customer support.
• To maintain the security and integrity of the Service, including detecting and preventing unauthorised access — our legitimate interest in protecting the Service and the personal data within it.
• To comply with our legal obligations, such as responding to lawful requests from regulators or retaining records for tax purposes.
• Where explicit consent has been given (for example, for Special Category Data entered by a Club) — consent, obtained and managed by the Club as Data Controller.

7. AI Processing (Anthropic Claude API)

Certain features of the Service — including AI-generated session reports, insights, and match preparation summaries — are powered by Anthropic's Claude AI models, accessed via Anthropic's commercial API. When a Coach uses one of these features, relevant data (which may include Player names, session notes, and in some cases wellness-related information) is transmitted securely to Anthropic for the sole purpose of generating the requested output.

The AI features send the free-text notes a Coach types exactly as they are written. We do not remove names or other details from those notes before they are sent. Coaches should keep notes to what is needed for the report, and should not include a Player's surname, contact details, address or school, or any information about other children.

Anthropic's commercial terms (which govern API use, as distinct from Anthropic's consumer Claude.ai product) contractually commit that data submitted via the API is not used to train Anthropic's underlying models. Anthropic's Data Processing Addendum is automatically incorporated into those commercial terms and includes the EU Standard Contractual Clauses (Module Two, controller-to-processor, and Module Three, processor-to-processor) together with a UK International Data Transfer Addendum, providing a recognised transfer mechanism for personal data sent to Anthropic. Anthropic publishes its current list of sub-processors and their locations, which we review periodically.

Anthropic's AI processing currently takes place on infrastructure located in the United States — Anthropic does not currently offer EU/UK data residency for this processing. This means Player and session data used to generate AI content is transferred outside the UK/EEA, safeguarded by the mechanisms described above rather than by data residency. We keep this under review and will update this policy if that changes.

A Coach can use AI to help draft a progress update for Parents/Guardians. For this feature only the Player's first name, position and age group, and the notes the Coach has typed, are sent to the AI. No wellness, session or other Player data is sent, the draft is not stored by us, and nothing reaches a Parent/Guardian until the Coach has read, edited and chosen to publish it. This feature is switched off for a Player while parental consent is missing or withdrawn.

AI-generated output should always be reviewed by a Coach before being relied upon, particularly in relation to a Player's health or wellbeing — see Section 9 of our Terms of Service.

8. Who We Share Personal Data With

We do not sell personal data. We share personal data only with the following categories of recipient, each acting under contractual obligations to protect it:

• Supabase — provides our database, authentication, and backend infrastructure. Personal data is hosted on servers located in Sweden (EU), within the European Economic Area.
• Vercel — hosts and delivers the Service's web application.
• Anthropic, PBC — processes certain data to generate AI-assisted content, as described in Section 7.
• Stripe — processes payment card data for paid Subscription Plans. Stripe is a PCI-DSS compliant payment processor; we do not directly store full card details.
• Professional advisers, regulators, or law enforcement, where required by law or necessary to establish, exercise, or defend our legal rights.

9. International Data Transfers

Our primary database is hosted within the European Economic Area (Sweden). Where personal data is transferred outside the UK or EEA — principally to Anthropic in the United States, for AI processing as described in Section 7 — we ensure an appropriate safeguard recognised under UK GDPR is in place before the transfer takes place, such as the Standard Contractual Clauses and UK International Data Transfer Addendum incorporated into Anthropic's Data Processing Addendum.

10. Data Retention

We retain personal data for as long as a Club's Account remains active, and for a limited period afterwards to allow for account recovery, to comply with legal or tax obligations, and to resolve any disputes. Our systems apply a default data retention period, which a Club may request to have adjusted within the bounds permitted by the Service. Where a Club terminates its Account, we will delete or anonymise Player, Parent/Guardian, and Club data within a reasonable period, save for data we are required to retain by law (such as financial records).

Consent records are kept with the child’s other records for the retention period the Club has set (2 years after the child leaves the Club by default). A Parent/Guardian who would like their Parent Account closed can ask us using the details in Section 1.

11. Data Security

We apply technical and organisational measures designed to protect personal data, including: encryption of data in transit; database-level access controls (Row Level Security) that restrict each Club's data to that Club's own authorised users; secure password storage; and restricting access to Special Category Data within a Club's Account to Coaches the Club Administrator has specifically authorised. No system can be guaranteed completely secure, and we continually review and improve our security measures.

12. Your Rights Under UK GDPR

Subject to certain exemptions, you have the right to:

• be informed about how your personal data is used (as set out in this policy);
• access a copy of your personal data;
• request correction of inaccurate or incomplete personal data;
• request erasure of your personal data in certain circumstances;
• request that processing of your personal data be restricted;
• object to processing based on legitimate interests;
• request a portable copy of personal data you have provided to us, in certain circumstances;
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

If you are a Club Administrator or Coach, you can exercise these rights by contacting us directly at enquirepixelspoint@pixelspoint.co.uk. If you are a Player or Parent/Guardian, please contact your Club in the first instance, as explained in Section 2.2 — we will support the Club in responding to your request.

If you have a Parent Account, you can contact us directly about your own account details (name and email address), and you can withdraw your consent for your child at any time in the Parent Area. For anything about your child’s information, please contact the Club first.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or by calling 0303 123 1113, if you believe your personal data has been mishandled.

13. Cookies and Similar Technologies

The Service uses essential cookies and similar technologies (such as local storage) required for authentication and to keep you securely signed in. We do not currently use non-essential cookies for advertising or cross-site tracking purposes. If this changes, we will update this policy and, where required, seek your consent.

14. Changes to This Policy

We may update this Privacy Policy from time to time, for example to reflect changes in the Service, the law, or our data processing practices. Where changes are material, we will notify Club Administrators by email or via an in-Service notice before the changes take effect. The "last updated" date at the top of this document indicates when it was last revised.

15. Contact Us and Complaints

Pixels Point Ltd

Company number: 11129649

Registered office: 44 Stornoway Road, Birmingham, England, B35 6NT

Email: enquirepixelspoint@pixelspoint.co.uk

Information Commissioner's Office (ICO): ico.org.uk | Telephone: 0303 123 1113