Privacy policy

1. Who is responsible

Controller: USAnalytix LLC, 1550 E Westgate Ln, Hernando, FL 34442, USA. Managing member: Ralf Mueller. Email: info@mlsp-shop.com.

Our representative in the European Union (Art. 27 GDPR): Manuel Müller, MLSP-Shop Deutschland, Berliner Straße 22, 67551 Worms, Germany. Email: info@mlsp-shop.com. You can contact the representative instead of us about anything in this policy.

We have not appointed a data protection officer because the law does not require one for us.

2. Summary

• We process only what we need to run live lessons, bookings, messages, payments and support.
• Live video and audio pass through our video provider in real time and are encrypted in transit. They are not stored on our servers. Recordings are only made on your own device when you press Record.
• We use no advertising, no tracking and no analytics cookies. See the cookie policy.
• Payments are handled by Stripe. We never see your full card details.
• Some of our service providers are in the USA. Transfers are protected as described in section 13.

3. Visiting the website

When you open a page, our hosting provider automatically processes technical data: IP address, date and time, the page requested, the referring page, and browser and device type. This is needed to deliver the site and to protect it against attacks (Art. 6(1)(f) GDPR, our legitimate interest in a secure, working website). Log data is kept by the hosting provider for a short period, usually a few days, and then deleted.

To stop abuse, we briefly count requests per IP address (for example for sign-up and login attempts). These counters are held in memory and disappear after at most one hour.

4. Your account

To create an account we need your name, email address, a password and whether you sign up as a student or a coach. We store the password only as a secure hash. We use this data to provide the service you signed up for (Art. 6(1)(b) GDPR).

During the test phase we also store the access code you used and when you accepted the test terms.

You can change your name in your account settings and delete your account at any time (section 15). When you delete it, your account and the data linked to it are deleted, except where we must keep records by law (section 14).

5. Coach profiles

Coaches can publish a profile with their name, photo, sports, levels, languages, country, experience, fees, a description, a website and their weekly availability. Profiles that are listed in the directory are public and can be found by search engines; unlisted profiles are only visible to people who have the link. Coaches decide what they publish and can edit or unlist their profile at any time (Art. 6(1)(b) GDPR).

6. Live lessons

Video and audio: during a lesson, the camera and microphone streams of the participants are transmitted in real time through our video provider (section 12). They are encrypted in transit and are not recorded or stored on our servers.

Recording: if a participant presses Record, the lesson is saved only as a file on that participant's own device. Everyone in the lesson sees a notice while someone is recording. Please only record with the knowledge of everyone in the picture.

Lesson data we store: the lesson title, participants, scheduled time, start and end times, duration, and the notes, marked moments, drill timers and snapshots (still images, possibly with drawings) that you or your coach save during or after the lesson. We need this to provide the lesson history and summary (Art. 6(1)(b) GDPR). Both participants of a lesson can see its notes and snapshots.

Connection data: to connect a lesson and keep it within its time limit, we record who joined and when (presence), and the video minutes used.

Robots and tracking mounts: a PIXEM robot is controlled by your phone over Bluetooth. If you let your coach control it, the commands are sent through the lesson connection. Robot settings you save are stored on your device (section 11).

7. Messages, bookings and calls

If you message a coach, book a lesson, add a coach or call a coach, we store the message, the booking (time, title, status) and the connection between you. We send the other person an email and, if they have turned it on, a push notification. This is needed to provide these features (Art. 6(1)(b) GDPR).

8. Payments

Student subscriptions are paid through Stripe (section 12). Stripe processes your payment details, billing address and the information required for tax and fraud prevention as an independent controller for part of this processing; see Stripe's privacy policy at stripe.com/privacy. We receive and store your Stripe customer number, your plan, the subscription status and period, and invoices. Legal basis: Art. 6(1)(b) GDPR (the contract) and Art. 6(1)(c) GDPR (tax and accounting obligations).

9. Emails and push notifications

We send emails that belong to the service: sign-up and password reset, lesson invitations and calendar files, booking confirmations, messages, call alerts, and confirmations of cancellations or withdrawals. We do not send newsletters or advertising.

Push notifications (for example when a student calls a coach) are only sent if you allow them in your browser. Your browser gives us a push address at its push service (Google, Apple or Mozilla, depending on the browser). You can turn notifications off in your browser or in your dashboard at any time (Art. 6(1)(a) GDPR, consent).

10. Test phase and feedback

During the private test phase we ask testers for feedback after lessons and about the test in general. Answering is voluntary. We store your ratings, the options you pick, your comments and technical details of your device and browser (browser type, operating system, screen size, connection type, whether you use the installed app), so that we can reproduce problems. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in improving the service; you can object at any time (section 15).

If confidential mode is on, pages show a watermark with your email address to discourage sharing screenshots during the test.

11. Cookies and storage on your device

We only use cookies and device storage that are strictly necessary to provide the service you request: keeping you logged in, remembering your language, and settings you choose (for example currency, controls layout or robot settings). No consent is needed for these (§ 25(2) no. 2 TDDDG, Art. 5(3) ePrivacy Directive). There is no tracking, analytics or advertising. Details: cookie policy.

12. Service providers

We use the following providers. They process data on our behalf under data processing agreements (Art. 28 GDPR), except where stated.

MLSP-Shop Deutschland (Manuel Müller, MLSP-Shop Deutschland, Berliner Straße 22, 67551 Worms) supports us with German-language customer support and acts as our EU representative. For support it can see the account and lesson data needed to help you, under a data processing agreement.

13. Transfers outside the EU

We are based in the USA, and several providers are too. When your data is transferred to the USA, it is protected either because the recipient is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR) or by the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) with additional safeguards such as encryption. You can ask us for a copy of these safeguards.

14. How long we keep data

• Account, profile, lessons, notes, snapshots, messages and bookings: as long as your account exists. When you delete your account, they are deleted within 30 days (backups within a further 30 days).
• Lesson video and audio: not stored (only transmitted live).
• Server logs: a few days at our hosting provider.
• Test-phase feedback: until the end of the test phase plus 12 months, then deleted or anonymised.
• Invoices and payment records: as long as tax and commercial law requires (up to 10 years).
• Cancellation and withdrawal confirmations: 3 years, to be able to prove them.

15. Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process data based on legitimate interests (Art. 6(1)(f)), you can object at any time for reasons arising from your particular situation.

To use your rights, write to info@mlsp-shop.com or to our EU representative. You can delete your account yourself in your account settings.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. The authority at the seat of our EU representative is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.

16. Children

The service is not intended for children under 13. In the EU, users under 16 may only use it with the consent of a parent or guardian, who is responsible for the account. If you believe a child has given us data without consent, please contact us and we will delete it.

17. Security

All connections are encrypted (HTTPS/TLS, and DTLS/SRTP for lesson media). Passwords are stored only as hashes. Access to data is limited to people who need it to run and support the service.

18. No automated decisions

We do not use your data for automated decision-making or profiling within the meaning of Art. 22 GDPR.

19. Changes

We update this policy when the service or the law changes. The current version is always on this page, with its date at the top.