Privacy policy

1. Who is responsible

Controller: USAnalytix LLC, 1550 E Westgate Ln, Hernando, FL 34442, USA. Managing member: Ralf Mueller. Email: info@mlsp-shop.com.

Our representative in the European Union (Art. 27 GDPR): Manuel Müller, MLSP-Shop Deutschland, Berliner Straße 22, 67551 Worms, Germany. Email: info@mlsp-shop.com. You can contact the representative instead of us about anything in this policy.

We have not appointed a data protection officer because the law does not require one for us.

2. Summary

• We process only what we need to run live lessons, bookings, messages, payments and support.
• Live video and audio pass through our video provider in real time and are encrypted in transit. They are not stored on our servers. Recordings are only made on your own device when you press Record.
• We use no advertising cookies. Google Analytics only runs if you accept it in the cookie banner (section 3). See the cookie policy.
• Payments are handled by Stripe. We never see your full card details.
• Some of our service providers are in the USA. Transfers are protected as described in section 13.

3. Visiting the website

When you open a page, our hosting provider automatically processes technical data: IP address, date and time, the page requested, the referring page, and browser and device type. This is needed to deliver the site and to protect it against attacks (Art. 6(1)(f) GDPR, our legitimate interest in a secure, working website). Log data is kept by the hosting provider for a short period, usually a few days, and then deleted.

To stop abuse, we briefly count requests per IP address (for example for sign-up and login attempts). These counters are kept briefly in our database together with the IP address (or, for the test-phase form, the email address) and expire after at most one day.

Visitor statistics without cookies (Vercel Web Analytics): to see how many people visit which pages, our hosting provider Vercel Inc. (section 12) counts page views. No cookies are set and nothing is stored on your device. Vercel receives the page (without anything after the "?"), the page you came from, browser, operating system, device type and country; to tell visits apart it uses a value derived from your request that changes daily and is not stored, so you cannot be recognised across days or websites. Lesson pages, the admin area and links containing a secret are never counted. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in knowing how our website is used, in a privacy-friendly way). The statistics are aggregated and kept for up to 12 months.

Website statistics (Google Analytics, only with your consent): if you click "Accept" in the cookie banner, we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to see which pages are used and improve the website. Google then sets cookies (see the cookie policy) and receives the pages you open (without anything after the "?" in the address), the time, your browser, device and screen, the page you came from and an approximate location; Google Analytics 4 does not store IP addresses. We turned off Google Signals and advertising features. Lesson pages, the admin area and links containing a secret (password reset, confirmations, invitations) are never measured. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw at any time under "Cookie settings" at the bottom of every page; the Analytics cookies are then deleted. Google may process the data in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (section 13). We keep the statistics for 14 months.

Our own page statistics (only with your consent): with the same "Accept" we also record, in our own database, which page you open, where you came from (the website, or an ad campaign from the link: utm parameters, Google's or Meta's click id), how far you scroll, how long the page is visible and whether it is a phone. A random number kept in your browser (mlsp.visitor) lets us count a second visit as the same visitor; we store no IP address and no name, and do not combine this with your account. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you can withdraw under "Cookie settings". We keep these statistics for 14 months.

iPhone app: the MLSP Sideline app for iPhone shows this website and adds what browsers on the iPhone cannot do: Bluetooth to the robot, saving videos to Photos, and keeping the screen on while recording. It asks for the camera, microphone, Bluetooth and adding to Photos only when a feature needs them; you can change this any time in the iPhone settings. The app processes data as this website does (this policy). It contains no Google Analytics, no advertising and no tracking. Apple processes data for downloads and updates from the App Store under its own privacy policy.

4. Your account

To create an account we need your name, email address, a password and whether you sign up as a student or a coach. We store the password only as a secure hash. We use this data to provide the service you signed up for (Art. 6(1)(b) GDPR).

During the test phase we also store the access code you used and when you accepted the test terms.

You can change your name in your account settings and delete your account at any time (section 15). When you delete it, your account and the data linked to it are deleted, except where we must keep records by law (section 14).

5. Coach profiles

Coaches can publish a profile with their name, photo, sports, levels, languages, country, experience, fees, a description, a website and their weekly availability. Profiles that are listed in the directory are public and can be found by search engines; unlisted profiles are only visible to people who have the link. Coaches decide what they publish and can edit or unlist their profile at any time (Art. 6(1)(b) GDPR).

6. Live lessons

Video and audio: during a lesson, the camera and microphone streams of the participants are transmitted in real time through our video provider (section 12). They are encrypted in transit and are not recorded or stored on our servers.

Recording: if a participant presses Record, the lesson is saved only as a file on that participant's own device. Everyone in the lesson sees a notice while someone is recording. Please only record with the knowledge of everyone in the picture.

Lesson data we store: the lesson title, participants, scheduled time, start and end times, duration, and the notes, marked moments, drill timers and snapshots (still images, possibly with drawings) that you or your coach save during or after the lesson. We need this to provide the lesson history and summary (Art. 6(1)(b) GDPR). Both participants of a lesson can see its notes and snapshots.

Connection data: to connect a lesson and keep it within its time limit, we record who joined and when (presence), and the video minutes used.

Lesson log for support: we note what happens technically in a lesson (created, call answered, joined the video, ready, video started, paused or ended and why). Our support team uses it to spot and fix problems, for example a video that keeps restarting, and may contact you about it in the support chat (Art. 6(1)(f) GDPR: our legitimate interest in a working service). It contains no video, audio or chat content and is deleted after 6 months.

Connection quality of lessons: during a lesson, both browsers measure every 10 seconds how the video connection is doing (bitrate, picture size and frame rate, lost packets, delay, whether the browser reports Wi-Fi or mobile data, whether the video goes directly or through a relay, browser and operating system) and, for the student, whether a robot is connected. Our video provider LiveKit also tells us when someone joined or left the lesson's video and why, and from which of its server regions and with which connection type someone connected. We use this to find out why a lesson ran badly and to improve the service (Art. 6(1)(f) GDPR: our legitimate interest in a working service). No picture, sound or chat content is involved; it is deleted after 90 days.

Setup check: when you run the setup check while logged in, we save its result with your account (which steps passed, camera resolution and frame rate, connection speed, browser and operating system type), so support can help faster. The camera picture and the sound stay on your device. Each new check replaces the last result.

Robots and tracking mounts: a PIXEM robot is controlled by your phone over Bluetooth. If you let your coach control it, the commands are sent through the lesson connection. Robot settings you save are stored on your device (section 11).

Robot diagnostics in lessons: while a PIXEM robot is connected to the student's phone during a lesson, the phone sends us every 10 seconds what the robot reports technically: the messages between robot and phone, the robot's state, the watches and beacons it hears and their battery, the record button of the watch, the robot's battery, firmware and device id, its distance to the watch, and failed connections, plus browser and operating system. Only our support team can see this, to find and fix problems with the robot (Art. 6(1)(b) and (f) GDPR: providing the lesson and our legitimate interest in a working service). The distance to the watch is the only location-related value; we record no position. It is deleted after 30 days.

App camera and rider feedback (iPhone app): the app's camera finds the rider in the picture on your phone (Apple Vision), to zoom, follow a fixed person and recognise hand gestures. If rider feedback is on, it also measures the seat (angles of upper body, leg, hands and head) as numbers. Pictures are not stored or sent for this. In a live lesson these numbers are summarised as a traffic light per area and shown to your coach. Written AI feedback is only created if you agree to it in the app: then only the summarised numbers of a ride (no picture, no name, no account data) are sent to Anthropic (section 12), which writes the text; Anthropic does not use them for training. You can withdraw your consent at any time in the app; without it, the app writes the feedback itself on your phone (Art. 6(1)(a) GDPR for the AI feedback, otherwise Art. 6(1)(b) GDPR)

Tracking reports (beta testers only): if we invited you to test the app's tracking and switched this on for you, the app sends us a report after each recording: what the tracker decided (kept, lost or found the rider again), the gestures, how often you were in the picture, the summarised seat numbers, the camera settings, your phone model and your optional thumbs up or down. No pictures or sound. We use it only to improve the tracking and the feedback rules (Art. 6(1)(f) GDPR: our legitimate interest in a working camera; you can object at any time and we switch it off). Deleted after 180 days

Camera and robot logs (testers we help only): if we switched this on for you to look into a problem, the app sends us its log by itself after each recording and when you close the camera or end a lesson: the messages between robot and phone, what the camera and the tracker did (e.g. "rider seen", "camera steers right"), the zoom, the website and app version and your phone model. No pictures or sound. The app shows that this is on. Only our support team sees it, to find and fix the problem (Art. 6(1)(f) GDPR: our legitimate interest in a working app; you can object at any time and we switch it off). Deleted after 30 days.

7. Messages, bookings, calls and support chat

If you message a coach, book a lesson, add a coach or call a coach, we store the message, the booking (time, title, status) and the connection between you. We send the other person an email and, if they have turned it on, a push notification. This is needed to provide these features (Art. 6(1)(b) GDPR).

Support chat: if you write to us in the chat (the button at the bottom right), we store your messages and our answers, your name and email address (from your account, or as you enter them as a guest), the language, when messages were read and, for a few seconds, whether someone is typing. We use this only to answer you; we email you our answer if you are not looking at the chat at that moment, and our team gets an email about new messages. Legal basis: Art. 6(1)(b) GDPR where your question concerns the service or a contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries). Guests get a cookie that keeps their conversation in this browser (section 11).

Team overview and notes: to look after testers and answer requests, our team keeps an internal overview of the people it deals with, put together from the data described in this policy (test-phase application, account, lessons, feedback, support chat). The team can add internal notes (for example about a call), a follow-up date and who looks after you. Legal basis: Art. 6(1)(b) GDPR where it concerns the test agreement or your contract, otherwise Art. 6(1)(f) GDPR (our legitimate interest in organised support). The notes are deleted with your account, and as soon as we no longer hold any other data about you.

8. Payments

Student subscriptions are paid through Stripe (section 12). Stripe processes your payment details, billing address and the information required for tax and fraud prevention as an independent controller for part of this processing; see Stripe's privacy policy at stripe.com/privacy. We receive and store your Stripe customer number, your plan, the subscription status and period, and invoices. Legal basis: Art. 6(1)(b) GDPR (the contract) and Art. 6(1)(c) GDPR (tax and accounting obligations).

9. Emails and push notifications

We send emails that belong to the service: sign-up and password reset, the test-phase emails (confirming your application, your invitation with access code, the welcome email with first steps, and at most one reminder each about the call, creating your account, your first lesson and the final survey), lesson invitations and calendar files, booking confirmations, messages, call alerts, and confirmations of cancellations or withdrawals. We do not send newsletters or advertising.

Push notifications (for example when a student calls a coach) are only sent if you allow them in your browser. Your browser gives us a push address at its push service (Google, Apple or Mozilla, depending on the browser). You can turn notifications off in your browser or in your dashboard at any time (Art. 6(1)(a) GDPR, consent).

10. Test phase: applications, intro calls and feedback

Applying for the test phase: on the test-phase page you can apply with your name, email address, whether you are a student or coach, your sport, country, phone type, how you film, whether you already have someone to test with, an optional message and an optional, non-binding pre-order interest. We send you an email with a confirmation link (double opt-in); only after you confirm on our page do we treat the application as yours. We use the data to select and invite testers and to organise the test, and send you your personal access code by email. Legal basis: Art. 6(1)(b) GDPR (steps you asked for before taking part) and your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by email. Unconfirmed applications are deleted after 7 days.

Pre-registration: on the pre-registration page you can leave your name, email address, whether you are a student or coach and whether you have a PIXEM, PIXIO or PIX4TEAM. We send you an email with a confirmation link (double opt-in). After you confirm, we email you once when MLSP Sideline opens for everyone. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by email or by replying to our email. Unconfirmed entries are deleted after 7 days, confirmed ones after the launch email or when you withdraw, at the latest after 12 months.

Signing up in one of the shops: if you signed up for the test in MLSP-Shop (Germany or USA), the shop passes us your name and email address so that we can send you the confirmation email. You then confirm and add your details on our page as described above. If you do not confirm, we delete your details after 7 days.

Intro call (on our own video): after your pre-onboarding you can book a free 15-minute video call on our website with the personal link from our email. We store your name, email, whether you are a student or coach, your phone type, whether you have a PIXEM, your optional note and the time, and send you a confirmation with a personal link and reminders. The call runs through our video provider (section 12) like a lesson: picture and sound are transmitted live and encrypted and are not recorded. During the call our team notes whether picture, sound, earbuds and PIXEM work and adds notes for the next steps; it may turn your PIXEM if you connect it. We use this to set up your test and to send you your access code. Legal basis: Art. 6(1)(b) GDPR (your request and the test agreement). Call details are deleted 12 months after the call at the latest, or earlier with your account.

Spam protection on our forms: the application form and the intro-call booking contain a field that people do not see and a time stamp from our server, so that forms filled in automatically by bots are ignored; this involves no personal data. In addition we use Cloudflare Turnstile by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, on these forms. When you open such a form, Turnstile checks in the background, from your IP address and technical characteristics of your browser and device, whether a person is using it; usually you do not notice anything, rarely you are asked to click a box. Turnstile does not set advertising or tracking cookies and the data is used only for this check. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in protecting our forms, our team and applicants from spam and misuse); access to your device is strictly necessary for the form you want to send (§ 25(2) no. 2 TDDDG). Cloudflare is certified under the EU-U.S. Data Privacy Framework (section 13).

During the private test phase we ask testers for feedback after lessons and at the end of their test week. Giving feedback is part of the test agreement (see the test terms), but you decide what you answer. We also store your answers from the pre-onboarding (your goal and the number of lessons you plan). We store your ratings, the options you pick, your comments and technical details of your device and browser (browser type, operating system, screen size, connection type, whether you use the installed app), so that we can reproduce problems. Legal basis: Art. 6(1)(b) GDPR (the test agreement) and Art. 6(1)(f) GDPR, our legitimate interest in improving the service; you can object at any time (section 15).

Test week: when a tester creates their account, we store when their free test week ends.

If confidential mode is on, pages show a watermark with your email address to discourage sharing screenshots during the test.

11. Cookies and storage on your device

We only use cookies and device storage that are strictly necessary to provide the service you request: keeping you logged in, remembering your language, and settings you choose (for example currency, controls layout or robot settings). No consent is needed for these (§ 25(2) no. 2 TDDDG, Art. 5(3) ePrivacy Directive). This includes the cookie that keeps a guest's support chat in their browser, which is only set when the guest writes to us. Google Analytics only runs with your consent (section 3); there is no advertising. Details: cookie policy.

12. Service providers

We use the following providers. They process data on our behalf under data processing agreements (Art. 28 GDPR), except where stated.

MLSP-Shop Deutschland (Manuel Müller, MLSP-Shop Deutschland, Berliner Straße 22, 67551 Worms) supports us with German-language customer support and acts as our EU representative. For support it can see the account and lesson data needed to help you, under a data processing agreement.

13. Transfers outside the EU

We are based in the USA, and several providers are too. When your data is transferred to the USA, it is protected either because the recipient is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR) or by the European Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) with additional safeguards such as encryption. You can ask us for a copy of these safeguards.

14. How long we keep data

• Account, profile, lessons, notes, snapshots, messages and bookings: as long as your account exists. When you delete your account, they are deleted within 30 days (backups within a further 30 days).
• Lesson video and audio: not stored (only transmitted live).
• Server logs: a few days at our hosting provider.
• Google Analytics (only with consent): statistics 14 months; the cookies up to 2 years, or until you decline in the cookie settings.
• Robot diagnostics of a lesson: 30 days. Connection quality of a lesson: 90 days. Camera and robot logs the app sends by itself (testers): 30 days.
• Lesson log (technical events of a lesson): 6 months. Your last setup check result: until you run a new check or delete your account.
• Test-phase feedback: until the end of the test phase plus 12 months, then deleted or anonymised.
• Test-phase applications: unconfirmed ones after 7 days; confirmed ones until the end of the test phase, at the latest 12 months after applying, or earlier if you ask us to.
• Support chats: 12 months after the last message, or earlier if you ask us to or delete your account.
• The team's internal notes about you: as long as we hold your account, application or support chat; deleted with your account.
• Invoices and payment records: as long as tax and commercial law requires (up to 10 years).
• Cancellation and withdrawal confirmations: 3 years, to be able to prove them.

15. Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process data based on legitimate interests (Art. 6(1)(f)), you can object at any time for reasons arising from your particular situation.

To use your rights, write to info@mlsp-shop.com or to our EU representative. You can delete your account yourself in your account settings.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. The authority at the seat of our EU representative is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz.

16. Children

The service is not intended for children under 13. In the EU, users under 16 may only use it with the consent of a parent or guardian, who is responsible for the account. If you believe a child has given us data without consent, please contact us and we will delete it.

17. Security

All connections are encrypted (HTTPS/TLS, and DTLS/SRTP for lesson media). Passwords are stored only as hashes. Access to data is limited to people who need it to run and support the service.

18. No automated decisions

We do not use your data for automated decision-making or profiling within the meaning of Art. 22 GDPR. Simple rules mark lessons where something technical seems to have gone wrong (for example many restarts), so a person from our team can take a look; this has no effect on your account or contract.

19. Changes

We update this policy when the service or the law changes. The current version is always on this page, with its date at the top.