Privacy policy

Who is responsible

For the Sportfolios platform itself, the controller is the operator named in the imprint. For the photographs inside a gallery, the photographer or studio that uploaded them is the controller and Sportfolios acts as a processor under a data-processing agreement.

What we store

Grouped by purpose rather than by table:

• Account data: name, email, password hash, locale, organisation membership and role.
• Sports data: clubs, seasons, teams, players, jersey numbers, positions, birth years, guardian contacts.
• Photographs: originals, generated derivatives, EXIF metadata and capture timestamps.
• Recognition results: detected jersey numbers, player and jersey bounding boxes, confidence scores and the resulting player assignments.
• Optional player references: processed reference photographs and appearance-comparison results when an organisation activates reference-based recognition.
• Interaction data: gallery views, favourites, selections, orders and downloads.
• Access logs: share-link redemptions with salted hashes of IP address and user agent.

Optional reference-based recognition

Jersey numbers remain the primary identification signal. An organisation may optionally activate reference-based recognition and upload several photographs for a player. When no number is readable, Sportfolios may compare visible appearance, including the face when clear, together with kit colour, the event roster and capture context. A single appearance signal produces only a review suggestion. Automatic assignment requires an unambiguous multi-signal result, including agreement across at least two reference views and a clear lead over alternative players.

The organisation using Sportfolios determines whether this optional processing is enabled and is responsible for establishing and documenting the applicable legal basis for the photographed people. Sportfolios processes the reference material on its instruction and provides organisation- and player-level deletion controls.

What we do not do

We do not build a global face-search database, compare players between organisations, sell reference data, or use reference photographs to train a general model. A matching face, kit, pose or neighbouring frame on its own never publishes a player assignment automatically.

We do not sell data, and we do not use photographs to train models. Corrections made during review are stored as structured feedback and are only ever exportable when both the organisation and the individual player have consented.

Legal bases

Contract (Art. 6(1)(b) GDPR) for operating an account and delivering purchased files. Legitimate interest (Art. 6(1)(f)) for platform security, abuse prevention and access logging. Consent (Art. 6(1)(a)) for publishing photographs of identifiable people, for marketing email, and for any use of correction data beyond the immediate gallery. Where biometric identification is activated, the customer acting as controller must additionally establish an applicable exception under Art. 9 GDPR, such as explicit consent where appropriate.

Where data is stored

Firestore uses the eur3 European multi-region, photographs are stored in the EU Cloud Storage multi-region, and the application is hosted in europe-west4 (Netherlands). Payment processing is handled by Stripe; card details never reach Sportfolios. Jersey-number analysis uses Google Gemini under the applicable Google Cloud data terms. Transactional email will be sent through a provider covered by an appropriate data-processing agreement once email delivery is enabled.

How long we keep it

Galleries expire on the schedule the photographer sets, 365 days by default. Uploaded player references have no automatic expiry. They are deleted only when an authorised user removes them, disables AI assignment for the player, or disables reference-based recognition for the organisation. Derived appearance records are deleted with them. Export bundles are deleted after 14 days and ZIP imports after 7. Order and invoice records are retained for the statutory period.

Your rights

You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Requests are tracked against the statutory one-month deadline. Write to diego@rodriguez-web.de. You also have the right to complain to a supervisory authority.

Photographs of children

A player whose birth year implies an age under 18 is flagged as a minor. Public listing is forced off, a guardian consent record is required before a personal share link can be created, and the player can be excluded from automatic assignment entirely — an exclusion the matcher honours rather than merely down-weights.