Privacy Notice

1. Who controls your data

Data controller (placeholder): Sporty EU entity (final legal name/address still to be inserted).

2. Data categories we process

• Basic profile data, including birthday/date of birth, sex, and measurements.
• Optional sports history and recommendation outputs.
• Sensitive health-related context in premium flows (for example injury context).
• Adult name and email submitted to the Child Forecast waitlist.
• Existing billing and credit metadata, plus pseudonymous billing ledger records; new checkout is disabled during the unlimited launch.
• Operational security, deletion, and incident metadata.
• Signup legal-acceptance records, including Terms/Privacy acknowledgments, birthdate, and country of residence.

3. Processing purposes

• Deliver free and premium sport recommendations.
• Operate adult user accounts and support operations.
• Send requested updates about the future Child Forecast.
• Operate signup eligibility and legal-acceptance controls, including launch country gating and server-side birthdate validation.
• Store and manage recommendation history where applicable.
• Run deletion, rights-handling, and incident response workflows.
• Maintain de-identified learning events for adult flows as implemented.

4. Legal-basis snapshot

• Strictly necessary operations (for example account operation, existing billing/accounting obligations, core service delivery, and security operations) may rely on contract and/or legal-obligation basis, as applicable.
• Sensitive premium health-context processing requires explicit consent category sensitive_health_processing.
• Joining the Child Forecast waitlist is an explicit request for updates. The form accepts the adult's own name and email only.
• basic_processing is used as a user-facing consent/control gate for identifiable persistence features.
• Legal acceptance of Terms/Privacy and birthdate capture at signup are separate controls from processing-consent categories.

5. Consent controls and withdrawal

You can manage processing-consent categories in Account settings. You can revoke categories at any time. Revocation triggers scoped purge behavior for affected data classes under current runtime behavior.

Terms/Privacy acceptance and signup attestations are recorded separately from these processing-consent toggles.

• basic_processing
• sensitive_health_processing
• child_data_processing (reserved for future use; new grants are disabled)

6. Minor processing (launch posture)

Sporty does not offer child profiles, Child Forecast processing, or direct minor onboarding during the adult-only launch. The future product will be guardian-managed. Sporty expects any first release to focus on teenagers; adding younger children would require a separate product and legal review before activation.

The waitlist must contain only an adult's own name and email. Do not submit information about a child.

7. Retention summary (launch defaults)

• Child Forecast waitlist entries: retained until the waitlist closes or the adult asks for removal.
• Previously seeded teen analysis data: remains subject to the existing 7-day deletion control.
• Adult product recommendation/history data: retained per account operation and removed by revocation/deletion/account-closure workflows.
• Anonymous Quick previews: not stored. De-identified adult learning events are created only from consented saved runs.
• Billing ledger: minimal pseudonymous records retained up to 10 years for legal/accounting reasons.
• Deletion and incident operational logs: retained up to 24 months target.

8. Child-data commercialization policy

Sporty does not sell, license, or otherwise monetize minor-derived data, including minor-derived aggregates, under current policy.

Sporty also does not use minor data for model-training or learning-event pipelines under current policy.

9. Data subject rights and requests

You can request access, deletion, portability, objection/restriction, and correction where applicable. Current request handling follows our operational DSAR workflow.

Request channel: legal@plyml.com (privacy/DSAR intake).

10. Security and incident response

Sporty uses technical and operational controls designed to reduce risk, including consent gating, scoped deletion controls, and incident-response procedures. No system can guarantee absolute security.

11. Vendors and transfers

Core vendors include Supabase, Cloudflare, Stripe, and GitHub (development/operations context). Stripe checkout is dormant during the unlimited launch. Primary data storage region is Sweden (Stockholm, EU), and runtime API traffic is handled through Cloudflare Workers. Some vendors (for example Cloudflare, Stripe, and GitHub) may still involve international processing or access depending on service operation. Vendor contract and transfer controls are tracked in internal compliance artifacts.

Sporty currently supports signups in the EU and United States at launch.

12. Contact

• Privacy contact: legal@plyml.com
• Security incident contact: legal@plyml.com
• Legal contact: legal@plyml.com