Privacy Policy

1. Data we process

We only process the data needed to run Rividi. Specifically:

• Account data: email address, password (stored exclusively as a hash), display name, profile photo if you upload one, your acceptance of this policy and of the terms with the date and the version accepted, your confirmation that you are at least 14, your choice about marketing communications.
• Content you publish: match videos, cover images, title, date, court, match type, players involved, descriptions, comments, likes and clips.
• Data generated by the automatic analysis: rallies, highlights, statistics, heatmaps and estimated MVP, derived from the video of the match.
• Highlight ratings: if you mark a highlight as right, wrong or missing, we store the rating linked to your account and to the match, to improve how highlights are chosen.
• Where the match took place: the centre and court where it is recorded and, when you scan a court QR code, which court and when. The centre of the first court QR code you scan (or of the one that brought you to sign up) is recorded once as the centre that brought you to Rividi, with when you scanned it and whether that was before you signed up; later scans do not change it. That centre's staff see it only as an aggregate count, never with your name or contact details; a centre's own staff are never attributed to it.
• Social relations and organization: profiles you follow, invitations you send or accept, the organization (sports centre or group) you belong to and your role in it.
• Address book (only if you tap "Find friends from your contacts" and grant permission): the app reads only the email addresses of your contacts and sends the server a SHA-256 hash of each one (an irreversible version, never the address in clear) to find matches with other Rividi users. Names and other address-book data are neither used nor transmitted; the hashes are not stored.
• Notifications: the device push token, if you allow notifications, and your preferences for push and marketing communications.
• Answers to optional in-app surveys.
• Technical data: IP address, device type and operating system, service access logs, generated automatically for security and diagnostics.
• App usage data: interaction events (app opened, section changed, match or analysis opened, video played, share, recording started), recorded as an event type with its timestamp, without saying which content, and linked to your account when you are signed in. Events about a court QR code and a recording being started also name the court, the centre and the organization. Before you sign up, the app and the web page send events with a random identifier generated on the device, not derived from your IP address or any advertising identifier; when you sign up, the events sent with that identifier are linked to your account and the device generates a new one. On the getpointapp.com website we count visits anonymously and, on the clubs page, the application forms sent successfully and the ones that failed, each with the page, the language and, if the link you came from carries them, the campaign parameters (utm_source, utm_medium, utm_campaign, ref): short labels such as «poster» or «instagram», never free text.
• Data from the website form a centre uses to request the Rividi kit and apply to the Early Club Program: described in §11.

2. Purposes and legal bases

• Providing the service (account creation, video recording and playback, feed, profile, sharing, automatic analysis): performance of a contract, art. 6.1.b GDPR.
• Finding friends from your address book and receiving push notifications: consent, art. 6.1.a GDPR, which you can withdraw at any time from your device or profile settings.
• Marketing communications: optional consent, art. 6.1.a GDPR (see below).
• Filming matches on courts with the Rividi camera and publishing them in the community: legitimate interest, art. 6.1.f GDPR, with the sign on the court and the filming notice (§3). [To be confirmed with counsel: legitimate interest or consent.]
• Security, abuse prevention, diagnostics, aggregated usage statistics, counting the players each centre brought to Rividi and improving how highlights are chosen: legitimate interest, art. 6.1.f GDPR.
• Assessing a club's application to the Early Club Program and getting back to it: pre-contractual steps at the data subject's request, art. 6.1.b GDPR (§11).
• Compliance with legal obligations and requests from authorities: art. 6.1.c GDPR.

Marketing communications. With your consent we write to you about updates on the app beta and discounts on future offers. Consent is optional: the box at sign-up starts unticked and without it you use Rividi the same way. You can withdraw it at any time from Profile → Settings → «Comunicazioni commerciali»; withdrawing does not affect service messages (for example account security or changes to these documents).

3. People filmed on court

Videos of matches recorded with the Rividi camera are stored on our servers and, when the recording ends, published in the Rividi feed. The rules apply to anyone playing on a court with the Rividi camera, including people without the app; the full filming notice is at getpointapp.com/en/filming.

• Who films: the player who starts the court camera from the app or from the court QR code, or the centre staff on behalf of the players. Whoever starts the recording confirms that the players on court know about it and that the centre's sign is displayed.
• Roles: Rividi is the data controller for the service; the sports centre is an independent controller for the court signage only; the player who starts the recording is the account the video goes to. [To be confirmed with counsel: the centre's role.]
• Legal basis: the legitimate interest of Rividi and of the players in recording and watching back their matches (art. 6.1.f GDPR), balanced by the sign on the court, the filming notice and the right to object. [To be confirmed with counsel: legitimate interest or consent.]
• What is filmed: video only, no audio, between the start and the stop. The automatic analysis detects positions and movements on the court to segment rallies and estimate statistics, but it does not biometrically identify people.
• Guests without the app: they are informed by the sign on the court; we do not record a separate consent for each guest, but any guest can object to a video or ask for its removal.
• Retention: videos stay for as long as the account of whoever recorded them exists (§6).
• Rights and removal: anyone who appears in a video can object to the filming and the publication and ask for its removal from the app, with the «Sono in questo video» ("I am in this video") request on the match, or by writing to info@rividi.it.

4. Who can see your content

Published matches are visible in the Rividi community feed to registered users. Your profile (name, photo and activity) is public by default: it is visible to other users and reachable through QR codes and invitation links. Sharing a match's images, cards and videos outside Rividi is allowed by default and anyone who receives them can see them; any player added to the match can block external sharing for everyone, but blocking cannot recall copies already shared. The staff of the centre where a match was recorded see it in the centre management area, with the players' public names and never their contact details.

5. Recipients and processors

We do not sell your data. The following parties may process it on our behalf, as processors or independent providers:

• Hosting and infrastructure providers that host the API, database and media files.
• Expo, Apple and Google, for delivering push notifications and distributing the app through the stores.
• quickchart.io, which draws the QR code of your profile and for that receives the link to your profile, with your identifier.
• Unsplash, which serves the image of the app welcome screen and receives the IP address of the device that loads it.
• The email service that notifies us of each new club application (§11).
• Public authorities, where required by law.

App usage data and the website counters stay on our own systems and are not sent to third-party analytics services.

Some providers may process data outside the European Union; in that case we rely on the standard contractual clauses approved by the European Commission or on other safeguards under Chapter V of the GDPR.

6. Retention

• Account data, videos and analyses: for as long as your account exists, with no automatic expiry. The owner can delete a single match or the whole account at any time; Rividi can delete a video after a report, an accepted removal request or a breach of the terms. When you delete your account we remove profile, matches, videos, analyses and organization memberships.
• Address-book email hashes: used in memory only to look up matches, never stored.
• Push tokens: until you delete your account; if you turn notifications off we stop sending them.
• Technical logs (web server and application): 14 days, unless security needs or legal obligations require otherwise.
• Database backups: before every update that changes the database we save a copy of it and keep the 10 most recent; deleted data can remain in them until the copy is replaced.
• App usage data: linked to your account for as long as it exists; when you delete your account the events are anonymized (no account and no random identifier) and kept only as aggregated counts. Events sent before sign-up and never linked to an account lose the random identifier after 90 days and are kept only as aggregated counts. The centre that brought you to Rividi is deleted with your account.
• Club applications: until the application is closed plus 24 months, unless a contract follows (§11).

7. Your rights

At any time you can request access to your data, rectification, erasure, restriction of processing, portability, and object to processing based on legitimate interest. You can withdraw consent without affecting the lawfulness of prior processing.

To exercise your rights write to info@rividi.it. You can delete your account directly from the app (Profile → Settings → Delete account). You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with your local supervisory authority.

8. Cookies and tracking

The getpointapp.com website uses no profiling cookies or advertising trackers. Visit statistics are collected without cookies: an anonymous counter on our own systems (one visit per browser session, marked by a sessionStorage flag that does not identify you). If you arrive from a link with campaign parameters (utm_source, utm_medium, utm_campaign, ref), we keep them in sessionStorage for the browser session only, to attach them to the anonymous counters and to an application, if you send one; they hold no personal data, are not an identifier and we use no cookies. The app stores on the device only what the session needs (for example the access token), local preferences and, until you sign in, the random event identifier described in §1 (in the app's storage or the browser's localStorage, replaced at every sign-in or sign-up; on our servers, events never linked to an account lose it after 90 days, §6); the usage events described in §1 are sent exclusively to our servers.

9. Children

Rividi is not intended for children under 14. If you believe a child has provided us with personal data without the consent of a parent or guardian, write to us and we will remove it.

10. Security

Data travels encrypted (HTTPS), passwords are stored only as hashes and access to our systems is restricted to authorised staff. No system is impenetrable, though: please use a strong password and do not share it.

11. Kit requests and club applications (Early Club Program)

When a club requests the Rividi kit and applies to the Early Club Program with the «Candida il tuo club» form on getpointapp.com, we process the data its contact person enters and a few details tied to the application.

• Data processed: name of the contact person, club name, email address, number of courts, optional message, date and time of submission, date and version of the privacy policy read when submitting, origin channel (the campaign parameters of the link you came from, if any), status of the application and internal notes by Rividi staff.
• Purpose: assessing the application and getting back to the club about the Early Club Program.
• Legal basis: steps taken at the data subject's request prior to entering into a contract, art. 6.1.b GDPR. Providing the data is optional, but without name, club, email and number of courts we cannot assess the application.
• Retention: until the application is closed and for 24 months after that, unless a contract follows: in that case the data moves to the contractual relationship and is kept for its duration and for the legal obligations that come with it. You can ask for deletion at any time by writing to info@rividi.it: a Rividi administrator deletes it.
• Who reads the data: only the Rividi staff who handle applications. The hosting providers of the API and database and the email service that notifies us of each new application process it on our behalf, as processors.
• IP address: never stored with the application. To limit abuse (a maximum number of submissions per address) we keep a shortened hash of it for at most one hour, after which it is deleted automatically.

12. Changes to this policy

We may update this policy when the service or the law changes. The current version is always published at getpointapp.com/privacy with the date of the last update; for material changes we will notify you in the app or by email.

13. Contact

For any question about this policy or about how we handle your data write to info@rividi.it.