1. Who we are (data controller)
SportsRally B.V. (“SportsRally”, “we”, “us”) operates the SportsRally platform — a marketplace connecting athletes, freelance coaches, and sports-facility owners for badminton and padel in the Netherlands.
We are the data controller for personal data processed through matchbase.nl and our mobile apps. For questions about this policy or your data, contact privacy@matchbase.nl.
2. Scope
This policy applies when you:
- create or use a SportsRally account (athlete, coach, or facility owner/staff);
- book or offer coaching sessions, court time, or open games;
- pay or receive payouts through our platform;
- upload performance feedback (voice notes, text, or video clips) for AI analysis;
- register a device for push notifications or adjust notification preferences; or
- visit our website or contact support.
3. Personal data we store
SportsRally is built as separate backend services (identity, booking, payments, catalog, matchmaking, AI, notifications). The table below reflects fields persisted in our databases and object storage as implemented today:
| Category | What we store | Where |
|---|---|---|
| Account | Email, password hash, display name, locale, account status, created/deleted timestamps, assigned roles (player, coach, venue owner, venue staff, administrator) | Identity service |
| Athlete profile | Bio, sports, interests, avatar URL, home location (latitude, longitude, label), cached skill/rating snapshots | Identity service |
| Coach profile | Bio, sports, hourly rate, cancellation policy, coaching location, Stripe Connect account ID, listing status | Identity + catalog services |
| Sessions | Refresh tokens and session metadata (issued/expiry/revoked times) | Identity service |
| Bookings | Session times, sport, status, price, participants, coach/court/facility references, booking event history | Booking service |
| Session dossiers | Planned focus/drills, executed summary, athlete reflection, and coach private notes linked to a booking | Booking service |
| Facilities & listings | Venue name, address, coordinates, courts, coach public listing (display name, bio, photo, rates), facility staff memberships, reviews you write (including your display name and comment) | Catalog service |
| Matchmaking | Sport ratings (ELO-style), open-game participation, match results | Matchmaking service |
| Payments | Payment intent references, ledger entries (amounts and booking references), invoices, payout records, Stripe Connect onboarding state. Card numbers are not stored by SportsRally — Stripe handles payment methods. | Payments service + Stripe |
| Performance & AI | Feedback upload metadata (kind, MIME type, size, booking link), raw files in cloud storage, AI job status, spider-chart JSON, text summaries, improvement-plan focus areas and notes | AI service + cloud storage |
| Video review | The clip you upload, plus files we derive from it: a re-encoded copy for playback, a preview still, a strip of thumbnail images, and a JSON file of measured body movement (see §5). We also store your coach's timestamped notes, their voice recordings and transcripts of them, and the timestamped observations our analysis produced. | AI service + cloud storage |
| Notifications | Push device tokens (FCM), per-channel preferences (push / email / SMS) and quiet hours. We do not store a history of delivered messages. | Notify service |
| Technical | Access and refresh tokens in your browser, a signed-in cookie flag, server access logs via Google Cloud Logging | Client + infrastructure |
Location: if you allow browser geolocation or search for a place, coordinates may be sent to OpenStreetMap Nominatim to resolve a human-readable label before you save them to your profile. We do not continuously track your device in the background.
Phone number — optional mobile on your profile, shared only with fellow players in open games you host or join when you opt in. We do not collect marketing-consent flags through the app, and we do not run third-party analytics or advertising trackers.
4. Why we process your data (lawful bases)
| Purpose | Lawful basis |
|---|---|
| Account creation, authentication, profile management | Contract |
| Bookings, session dossiers, open games, reviews, ratings | Contract |
| Payments, holding funds until delivery, and coach/facility payouts via Stripe Connect | Contract and Legal obligation (financial records) |
| Transactional email, push, and SMS notifications | Contract |
| AI analysis of uploaded coach feedback into Performance DNA spider charts | Contract — you initiate uploads linked to a session |
| Location-based coach and facility search | Contract |
| Platform security and abuse prevention | Legitimate interest |
We do not currently send promotional or marketing email campaigns. All email today is transactional (account, booking, and payment related).
5. AI and automated processing
SportsRally turns coach feedback into structured performance insights (“Performance DNA”) using Google Vertex AI (Gemini). This is how the pipeline works in production code:
Uploads
- Supported kinds: voice (up to 30 MB), video (up to 500 MB and 7 minutes), and text (up to 20 KB), each linked to a booking.
- Files are uploaded directly to an encrypted Google Cloud Storage bucket in europe-west4 (Eemshaven, NL) via a signed URL, then committed for processing.
Analysis
- Our AI worker receives the storage location, file type, sport, and an internal account identifier — not your email or display name.
- Vertex AI (Gemini, default model family configured per environment) analyses the media and returns a spider chart: sport-specific skill axes scored 0–10 with confidence levels, plus a short summary (max 400 characters).
- Results are saved as skill assessments and may appear on session detail, coach views, and your Performance page. Coaches can also maintain an improvement plan (focus areas and notes) for athletes.
Video review: body-movement analysis
When you send a coach a clip for review, we do more with it than the analysis described above. This section says exactly what.
- We re-encode your clip. Phone cameras only allow accurate jumping every few seconds, so we make a second copy that can be paused precisely — otherwise a coach's note about a specific moment would show you the wrong one. We also generate a preview still and a strip of small thumbnails for the scrub bar. These are stored alongside your original.
- We measure how your body moves. Using Google's MediaPipe library, running on our own servers, we estimate the position of 33 body points twice per second, for up to the first two minutes. These points are used to calculate simple measurements — how bent your knee is, how wide your stance is, how far your arm extends, how fast you move across the court.
- We keep the measurements, not the body points. The 33 estimated positions exist only in memory during processing and are then discarded. Only the calculated measurements are saved. This is deliberate: the coordinates are the part that could conceivably be used to recognise a person, and the measurements are not.
- No face recognition, no identification. We do not detect, match, or store facial features, and we do not use any of this to identify anyone. It exists so a coach's advice is grounded in what your body actually did rather than an impression.
- Timestamped observations. The analysis may produce short notes tied to specific moments (“recovery step skipped” at 0:31). Your coach sees these, accepts, edits or rejects them, and only what your coach delivers reaches you. Observations your coach rejected are never shown to you.
What we do not do
- We do not use your uploads to train public AI models. Google Cloud enterprise terms prohibit using customer content for model training.
- We do not make solely automated decisions with legal or similarly significant effects (bookings are not approved or rejected based on AI scores).
- AI outputs are advisory coaching insights, not medical or professional certification.
Retention
- Raw feedback files in cloud storage are automatically deleted after 90 days (bucket lifecycle rule in our infrastructure).
- Video reviews follow their own schedule, counted from the day your coach delivers the review, not the day you upload:
- After 30 days, your coach can no longer open the review. They did the work they were paid for; they do not need indefinite access to your footage.
- After 90 days, the clip, the re-encoded copy, the previews, the movement measurements, your coach's notes and their voice recordings are all deleted.
- A review your coach has not delivered yet is not on this clock.
- Derived spider charts, summaries, and improvement-plan rows remain in our database while your account is active.
7. Data location & security
- Primary databases, file buckets, Cloud Run services, and Vertex AI are deployed in europe-west4 (Eemshaven, NL) (Netherlands / EU). Video-review clips are analysed in that same region, and the body-movement measurement described in §5 runs on our own Cloud Run service there — it is not sent to a third party at all.
- Google Cloud (our hosting and AI provider) is a US-headquartered company acting as our processor under its EU data-processing terms. Your data is stored and processed in the EU; the corporate relationship with a US provider is disclosed here for completeness.
- Booking expiry timers use Google Cloud Tasks in europe-west1 (Belgium) because Cloud Tasks is unavailable in europe-west4. Task payloads contain booking IDs only — no personal data.
- Traffic is encrypted in transit (TLS). Data at rest uses Google-managed encryption.
- We do not currently integrate a third-party error-tracking service (e.g. Sentry). Operational logs go to Google Cloud Logging with standard application fields.
8. How long we keep data
| Data type | Retention (current implementation) |
|---|---|
| Account & profile | While your account is active; see §10 for deletion |
| AI raw uploads (cloud storage) | Automatic deletion after 90 days |
| Video review — clip, re-encoded copy, previews, movement measurements | Deleted 90 days after the coach delivers the review |
| Video review — coach access | Ends 30 days after the coach delivers the review |
| Video review — coach notes, voice recordings, transcripts, timestamped observations | Deleted with the review at 90 days, or on account deletion |
| AI assessments & improvement plans | While account is active; deleted when the erasure process completes |
| Bookings, dossiers, reviews, ratings | While active; anonymised or deleted when the erasure process completes |
| Payment invoices & payouts | Anonymised when the erasure process completes; ledger rows kept without personal details |
| Refresh tokens / device tokens | Until expiry, revocation, or account deletion processing |
| Cloud Logging | Per Google Cloud retention settings for the environment |
9. Your GDPR rights
If you are in the EEA (including the Netherlands), you have the right to:
- Access — the Download my data button in Profile → Privacy & data returns a JSON export with: your account, roles, profiles and sessions, and — where you have any — your bookings, listings, open games, payments, notification settings and AI assessments.
- Rectification — update your profile in-app or contact us.
- Erasure — use Delete my account in profile settings (see §10).
- Restriction, portability, objection — contact us; we respond within one month.
- Complaint — contact the Autoriteit Persoonsgegevens.
10. Account deletion (right to erasure)
Immediately when you confirm deletion
- Your account is marked as deleted and your email is replaced with a non-contactable placeholder.
- All active sessions are revoked — you cannot sign in or refresh tokens.
- An erasure request is stored with a 30-day grace period before downstream purge runs.
- You receive an erasure reference ID in the app.
After the grace period (automated worker)
A scheduled worker processes due erasure requests (typically within 30 days, retried every ~15 minutes in production). For each request it:
- Calls each service's internal purge endpoint — booking, catalog, matchmaking, payments, notify, ai;
- Hard-deletes pure personal data (AI uploads/assessments, session dossiers, device tokens, coach listings, reviews you authored, etc.);
- Anonymises financial/booking records that must be kept (booking rows, invoices, payouts — your account identifier is replaced with an anonymous placeholder);
- Removes your roles and your player and coach profiles;
- Marks the erasure request complete only when every part has succeeded (anything that failed is retried on the next sweep).
Raw AI files in cloud storage also expire on a 90-day lifecycle rule independently of account deletion.
Questions or urgent follow-up: email privacy@matchbase.nl with your erasure reference ID.
12. Children and young people
SportsRally is not directed at children under 16. We do not knowingly collect data from anyone under 16. Contact us if you believe a child has registered and we will delete the account.
Video review is 16+. Sending a coach a clip of yourself means sharing footage of your body with another adult and having it analysed automatically. In the Netherlands, 16 is the age at which you can consent to that yourself, so we ask for your date of birth before a video review can be requested and refuse the request below that age. This is checked on our servers, before any payment is taken.
Every other part of SportsRally — finding coaches, booking sessions, joining open games — is unaffected. We are working on a version of video review a parent or guardian can approve.
13. Changes
We update this page when our implementation changes. The “Last updated” date at the top reflects the most recent review. Material changes may also be communicated by email where appropriate.
14. Contact
Data controller: SportsRally B.V., Netherlands
Privacy: privacy@matchbase.nl
Support: support@matchbase.nl