Privacy Notice | Eyerox

2.1 Account Information

• Full name and surnames
• Email address
• Profile picture (optional)
• Sports institution or affiliation (if applicable)
• User role (athlete, coach, administrator)

2.2 Biomechanical and Performance Data

• Videos and movement images you upload to the platform
• Biomechanical metrics extracted via AI analysis (cadence, joint angles, movement patterns, etc.)
• Analysis history and temporal progression
• Anthropometric data voluntarily provided (height, weight, age)
• Sport type and specialty

2.3 Payment Information

• Billing information processed by our authorized payment providers
• Transaction and subscription history
• Note: We do not store full credit card data. All payments are processed through PCI-DSS certified payment processors.

2.4 Technical and Usage Information

• IP address and approximate geolocation data
• Device type, browser, and operating system
• Pages visited, usage time, and navigation patterns
• Cookies and unique device identifiers
• Activity logs and technical errors

2.5 Communications

• Correspondence via email or through our support system
• Notification preferences and marketing communications
• Comments, ratings, and feedback provided

3.1 Service Provision

• Create and manage your user account
• Process videos and generate biomechanical analyses via AI
• Store your analysis history and provide temporal tracking
• Personalize recommendations based on your data and goals
• Facilitate collaboration between athletes, coaches, and institutions

3.2 Improvement and Development

• Train and improve our artificial intelligence models
• Develop new features and functionalities
• Conduct statistical and trend analyses (anonymized data)
• Identify and correct technical errors

3.3 Communication

• Send notifications about your account and services
• Respond to inquiries and provide technical support
• Send product updates and relevant news (with your consent)
• Conduct satisfaction surveys and collect feedback

3.4 Security and Legal

• Detect, prevent, and respond to fraud or malicious activities
• Comply with legal and regulatory obligations
• Protect our rights, privacy, safety, or property
• Enforce our Terms and Conditions

3.5 Marketing (with Consent)

• Send personalized offers and promotions
• Conduct remarketing campaigns
• You can unsubscribe from these communications at any time

5.1 Service Providers

We share data with third parties who help us operate our service:

• Amazon Web Services (AWS): Cloud storage (S3) and processing (Lambda)
• MongoDB Atlas: Database
• Payment Processors: Stripe, PayPal (as applicable)
• Email Services: Mailgun for transactional notifications
• AI Providers: OpenAI, Google AI for biomechanical analysis
• Analytics: Google Analytics, Vercel Analytics (anonymized data)

All these providers are contractually obligated to protect your data and can only use it for the specified purposes.

5.2 Coaches and Institutions (with your Authorization)

If you are associated with a coach or sports institution, your analyses and performance data will be shared with them according to the permissions you configure.

5.3 Legal Requirements

We may disclose information if:

• Required by law or legal process
• Necessary to protect the rights, property, or safety of Eyerox, our users, or others
• In case of merger, acquisition, or sale of assets (with prior notice)

5.4 Anonymized Data

We may share aggregated and anonymized data (that does not personally identify you) for research, sports trend analysis, or algorithm improvement.

6.1 Data Location

Your data is primarily stored on servers located in:

• United States: AWS S3 (us-east-2 region) for videos and images
• MongoDB Atlas: Multiple regions with replication for high availability

By using our services, you consent to the international transfer of data. We ensure that all providers comply with appropriate data protection standards.

6.2 Security Measures

We implement technical and organizational measures to protect your data:

• Encryption: Data in transit (TLS/SSL) and at rest (AES-256)
• Authentication: Magic link system and secure session management with NextAuth
• Access Control: Roles and permissions based on the principle of least privilege
• Monitoring: Logging and auditing of suspicious access
• Backups: Regular backups with redundancy
• Infrastructure Protection: Firewalls, DDoS protection

6.3 Retention Period

• Active Accounts: We retain your data while you maintain an active account
• Cancelled Accounts: Data is deleted 90 days after cancellation (unless legal retention obligation exists)
• Analyses and Videos: Retained while your account is active; you can delete them individually at any time
• Logs and Technical Data: Retained for up to 2 years for security and service improvement purposes
• Anonymized Data: May be retained indefinitely for research and statistical analysis

7.1 ARCO Rights (Access, Rectification, Cancellation, Opposition)

• Access: Obtain confirmation of what personal data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Cancellation: Request the deletion of your data (subject to legal obligations)
• Opposition: Object to the processing of your data for specific purposes

7.2 Additional Rights

• Portability: Receive your data in a structured and transferable format
• Withdraw Consent: At any time for consent-based processing (does not affect prior legitimate processing)
• Limit Processing: Restrict how we use your data in certain circumstances
• No Automated Decision Making: Request human intervention in significant decisions based solely on automated processing

7.3 How to Exercise Your Rights

To exercise any of these rights:

• <strong>Account Settings:</strong> Many settings are available directly in your profile
• Formal Request: Send an email to privacy@eyerox.com with:
  • Full name and account email
  • Specific description of your request
  • Documentation proving your identity (to prevent fraud)

We will respond to your request within 20 business days. If we need more time, we will notify you of the reason for the delay.

8.1 Types of Cookies We Use

• Essential Cookies: Necessary for the basic functioning of the platform (authentication, sessions)
• Performance Cookies: Help understand how users interact with the site
• Functionality Cookies: Remember your preferences (language, theme)
• Marketing Cookies: Track your browsing to personalize ads (require consent)

8.2 Managing Cookies

You can control cookies via:

• Your browser settings (reject all cookies or third-party cookies)
• Our cookie consent banner (when visiting the site)
• Specific opt-out tools from analytics providers

Note: Disabling essential cookies may affect site functionality.

8.3 Other Technologies

• Web Beacons: Small transparent images in emails to track opens
• Local Storage: Browser local storage for user preferences
• Session Storage: Temporary session data

13.1 Privacy Contact

For questions, requests, or concerns about this Privacy Notice:

• Email: privacy@eyerox.com
• Subject: &quot;Privacy Request - [Your Name]&quot;
• Response Time: Maximum 20 business days

13.2 Filing a Complaint

If you are not satisfied with how we handle your personal data, you have the right to file a complaint with:

• INAI (Mexico): National Institute for Transparency, Access to Information and Personal Data Protection
• Our priority is to resolve your concerns directly. Please contact us first to try to resolve the issue.