Privacy policy

1. Controller

Tommaso Tadiello (sole proprietorship, [DA COMPLETARE: nome commerciale, se presente]), VAT [DA COMPLETARE: partita IVA], [DA COMPLETARE: indirizzo della sede, CAP, città]. Email: tommaso@attimilabs.com. Certified email (PEC): [DA COMPLETARE: PEC, se presente]. For any privacy request write to tommaso@attimilabs.com.

2. What data we process

• Account data: first and last name, email, password (handled by the authentication service and stored only in encrypted form, unreadable even to us), role, plan, creation and last-access dates, version of the terms accepted.
• Usage data: number and cost of the AI analyses made, date and time of the main operations, technical access data (IP address, browser) logged by the hosting providers for security.
• Subscription data: plan chosen, subscription status and end date, Lemon Squeezy customer and subscription codes. Card or bank details never reach us: Lemon Squeezy handles them.
• Content you enter: events, photo thumbnails (at most 1024 pixels on the long side) with the file's technical data (name, size, capture time, fingerprint), captions, teams, rosters, match sheets, caption templates, actions. The original photos stay on your computer and are never uploaded.
• Shared database data: names, roles, jersey numbers, nationality, periods with a team and sometimes portrait photos of players, coaches and referees of the competitions covered, collected from public sources (official websites of leagues, federations and clubs).

We process no biometric data: the Service does not recognise faces; it identifies players by jersey number, team and context.

3. Why we process it and on what basis

• Providing the Service (account, photo analysis, captions, export, support): performance of the contract (art. 6.1.b GDPR).
• Managing the free trial, subscriptions and plan limits: performance of the contract (art. 6.1.b).
• Sending service emails (invitation, address confirmation, new password, notices about the subscription and changes to the terms): performance of the contract (art. 6.1.b).
• Security of the Service, abuse prevention, internal statistics on usage and costs: our legitimate interest (art. 6.1.f).
• Complying with legal obligations (for example tax rules or requests from authorities): legal obligation (art. 6.1.c).
• Shared database of teams and rosters: our legitimate interest and that of photographers in accurate captions in sports journalism (art. 6.1.f), on data already made public by organisers and clubs.

We do not use your data for marketing, advertising or profiling, and we take no automated decisions with legal effects on you: the captions proposed by artificial intelligence are always checked and approved by you.

4. Other people's data you enter

Thumbnails, your teams' rosters and captions contain data of other people (players, staff, referees, spectators). For this data you are the controller and we are the processor on your behalf, under the agreement in section 11 of the Terms of use. It is up to you to have a legal basis for processing it (for example journalistic activity and your accreditation to the event) and to inform the people concerned when required, with particular care for minors.

5. Who receives it

We use these providers, which process data on our behalf as processors (or sub-processors) and only for the purposes stated:

• Supabase Inc.: database, authentication and storage of thumbnails and images. Servers in the European Union (Frankfurt, Germany).
• Vercel Inc.: hosting of the application. The server functions run in the European Union (Frankfurt); the delivery network may serve pages from other countries.
• Anthropic PBC (Claude): artificial intelligence that reads photo thumbnails and match sheets. It receives the thumbnail, the team names, jersey numbers and the action vocabulary. Under Anthropic's commercial terms, data sent through the API is not used to train models and is kept for a limited period.
• Google (Gemini) and Tavily: web search of public information for the shared database (teams, rosters, venues). They receive neither your photos nor your data.
• Resend: sending service emails (invitation, confirmation, new password).
• Sentry (Functional Software Inc.), when enabled: reports of the app's technical errors, with servers in the European Union. It receives the kind of error, the page and the browser; no cookies, IP addresses, emails or photo content.
• Cloudflare (Turnstile), when enabled: anti-bot check on sign-in, sign-up and password recovery, without profiling cookies.
• Lemon Squeezy LLC: sells the subscriptions as reseller (Merchant of Record) and handles payments, invoices and taxes. For payment data it is an independent controller and applies its own privacy policy.

We may disclose data to authorities when the law requires it. We do not sell or hand over data to third parties for other purposes.

6. Transfers outside the European Union

Some providers (Anthropic, Vercel, Google, Tavily, Resend, Lemon Squeezy, Sentry, Cloudflare) are companies based in the United States. Transfers rely on the European Commission's adequacy decision for companies certified under the EU-US Data Privacy Framework or on the standard contractual clauses approved by the Commission, with the further safeguards in the respective data processing agreements. You can ask us for a copy of the safeguards at tommaso@attimilabs.com.

7. How long

• Account and content: while the account is active. If you delete the account (Settings › Profile), we immediately erase events, thumbnails, teams, actions, settings and profile; any backup copies are overwritten within 30 days.
• Accounts archived by the administrator: access is blocked and the data kept until you ask to reactivate or delete them.
• Usage data and analysis costs: for the life of the account, to manage limits and statistics. When you delete your account they remain only in anonymous form (number, type and cost of the AI calls, with no link to you, your events or the AI's answers), for the Service's accounts.
• Providers' technical logs: for the short time set by the providers, usually from a few days to a few weeks.
• Subscription and tax data: Lemon Squeezy keeps them for the periods required by tax law.
• Shared database: while the person takes part in the competitions covered and the information is useful for captions; past seasons may stay as an archive, unless you object.

8. Cookies and browser storage

We only use technical cookies, needed for the Service to work, which require no consent:

• the authentication service's session cookies (sb-…-auth-token), which keep you signed in;
• the cookie of the language chosen (cn_lang).

The browser also keeps, on your computer only, access to the photo folders you chose (IndexedDB) and the last event opened (localStorage). We use no analytics, advertising or profiling cookies, nor third-party tools that track you. Lemon Squeezy's payment page, on its own domain, uses its own cookies.

9. Security

Connections always encrypted (HTTPS), data kept separate per account and checked on every request, passwords stored only in encrypted form by the authentication service, direct database access blocked for the public, provider keys only on the server. No system is 100% secure: in case of a data breach we inform you and notify the supervisory authority when required.

10. Your rights

You can ask us at any time to access your data, correct it, erase it, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest. You can do much of this yourself in the app (editing your profile, deleting your account).

Write to tommaso@attimilabs.com: we answer within one month. If you believe the processing breaches the GDPR you can lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the authority of your country.

If you appear in the shared database (for example as a player) you can ask us to correct or remove your data by writing to the same address.

11. Minors

The Service is for adult professionals only. Data of minors (for example youth team players) may be entered only by the user, who is its controller and is responsible for it.

12. Changes

We may update this policy, for example if our providers change. Material changes are announced by email or in the app before they apply. The version in force is always on this page.