Privacy Policy

1. Who we are

KORALYZE FOR ARTIFICIAL INTELLIGENCE SERVICES - L.L.C ("Koralyze", "we", "us") is a limited liability company holding Abu Dhabi Economic Licence no. CN-6679007 issued by the Abu Dhabi Department of Economic Development, based in Abu Dhabi, United Arab Emirates.

To contact us about privacy, email [email protected].

We have not appointed a data protection officer.

2. Who this policy covers

This policy covers:

• Customer users: staff and other people who use the Koralyze platform for a club, academy or other organisation, including players given access.
• Players and other people in footage: people who appear in match footage that our customers upload, and people named in rosters.
• Website visitors and contacts: people who visit koralyze.com, use our contact form, or contact us.

3. Our two roles

When we act for our customers (processor). When a customer uploads match footage, the customer decides why its footage is analysed. The customer is the controller, and we process the data on its behalf under a data processing agreement. If you appear in a customer's footage and want to know how your data is used for the customer's analysis, or want to exercise your rights, contact that club or organisation first. We will help them respond.

When we decide (controller). We are the controller for:

• accounts, billing and customer communications;
• security and service logs;
• our website and contact form;
• using customer footage and outputs to improve our models (section 5.4);
• licensing match data to third parties, where the customer has opted in (section 5.6).

4. What data we collect

We do not ask for and do not intend to collect dates of birth, health or injury information, nationality, or similar personal details.

Appearance data may be biometric data. Information about a person's physical appearance that is used to recognise them can be special category data under UK and EU data protection law. We use it only to recognise players inside a single customer's library. We keep each customer's player identities separate and never compare players across customers. Because this information may be biometric data, our customers confirm that they have the explicit consent of each player, or of a parent or guardian for players under 18, before uploading footage.

5. Why we use data and our lawful basis

5.1 Providing the platform (as processor)

We analyse footage and produce outputs for the customer. The customer is responsible for the lawful basis, including consent where needed, and for informing players and parents.

5.2 Accounts, support and billing (as controller)

• To create and manage accounts, provide support and bill customers. Basis: performance of our contract with the customer, and our legitimate interest in running our business.
• To keep accounting and tax records. Basis: legal obligation.

5.3 Security and service operation (as controller)

To protect the platform, prevent misuse and fix errors. Basis: legitimate interests.

5.4 Improving our models (as controller)

We use customer footage and outputs, including corrections and annotations, to train, test and improve our computer vision models. This includes footage of players who may be children.

Basis: legitimate interests. Our interest is to make our analysis more accurate and reliable for all customers. We limit this use as follows:

• we use the data only to develop our models and services;
• we never publish footage or share one customer's data with another customer;
• we keep training copies for no longer than 24 months from upload;
• customers can opt out, and individuals can object (section 9).

After an opt-out or objection, we stop using the data for new training and delete the raw training data. Models trained before that point may keep what they learned, because it cannot be removed from the trained model.

5.5 Website and contact (as controller)

To answer enquiries and arrange demos. Basis: legitimate interests.

To measure how our website is used, with Google Analytics. Basis: consent for visitors in the EU and the rest of Europe, except the UK; legitimate interests for other visitors, who can opt out at any time. See section 13.

5.6 Licensing match data (as controller)

Where a customer opts in, we may license data from its matches to third parties: leagues, other clubs, media, research organisations, sports data companies and betting data providers. We license only:

• statistics that are aggregated and anonymised, so no player, team or match can be identified; and
• data about individual players from matches where every player is 18 or older, such as positions, distances, speeds and match events.

We never license data about individual players under 18, video footage, or data that recognises players by their appearance.

Basis: legitimate interests, for data about adult players. Our interest is to make football data available to the wider game. Anonymised statistics are not personal data. You can object to the licensing of your data at any time by emailing [email protected], and we will stop licensing it to new recipients.

5.7 Marketing

We may send occasional emails about our services to business contacts. Basis: legitimate interests. Every marketing email includes a way to opt out, and you can also opt out at any time by emailing [email protected].

6. Who we share data with

We share data only with service providers who help us run the Services, under contracts that protect it:

We may also share data if the law requires it, to protect our rights, or with a buyer of our business.

We do not sell personal data, except by licensing data about adult players where a customer has opted in, as described in section 5.6. Recipients of licensed data use it under their own responsibility.

7. International transfers

We are based in the United Arab Emirates and process data there. The UK and the EU have not recognised the UAE as giving an adequate level of protection. Where personal data is transferred from the UK, the EU or Switzerland to a country without an adequacy decision, including the United Arab Emirates, we use the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with the UK International Data Transfer Addendum issued by the UK Information Commissioner for UK data, and the amendments required by Swiss law for Swiss data. For providers in the United States, we rely on their certification under the EU-US Data Privacy Framework and its UK Extension where available, or on the Standard Contractual Clauses. You can ask us for a copy of these safeguards by emailing [email protected].

8. How long we keep data

9. Your rights

Depending on where you live, you may have the right to:

• access your personal data;
• correct inaccurate data;
• have your data deleted;
• restrict or object to processing, including objecting to the use of your data for model improvement;
• receive your data in a portable format;
• withdraw consent where we rely on consent.

To exercise a right, email [email protected]. If your request is about a club's footage, we will pass it to the club, because the club is the controller for that analysis. We reply within one month. We acknowledge complaints within 30 days.

You can complain to a data protection regulator. In the UK, this is the Information Commission (ICO), ico.org.uk. In the EU, contact the authority in your country.

10. Children

Footage that our customers upload often shows players under 18. Our customers are responsible for informing parents and for any consent needed. Players under 13, or under the higher minimum age set by the law of their country (16 in Germany, for example), may only have a login if their club has the consent of a parent or guardian. If you are a parent and have a concern, contact the club or email us.

11. Automated analysis

Our models analyse footage automatically. We do not make decisions about players. Customers decide how to use our outputs and must apply their own judgement to any decision that significantly affects a player.

12. Security

We protect data with access controls, encryption in transit, encryption at rest for our database and file storage, separate storage for each customer, and limited staff access. Our processing machines use full-disk encryption, password protection and regular security updates.

13. Cookies and similar technologies

This section explains the cookies and similar technologies used on koralyze.com (the "Website") and app.koralyze.com (the "Platform"). Similar technologies include browser local storage and session storage.

13.1 The Platform (app.koralyze.com)

The Platform does not set cookies. It uses your browser's local and session storage only for what the Platform needs to work:

Strictly necessary items do not need consent. Preference items store choices you make yourself. You can remove all items by signing out or clearing your browser storage.

13.2 The Website (koralyze.com)

The Website uses Google Analytics cookies, described in section 13.3. It also stores your cookie choice in your browser (koralyze_cookie_consent, kept until you clear it; strictly necessary). It does not use any other cookies or browser storage.

The Website loads fonts from Google Fonts. When it does, your browser sends your IP address to Google.

13.3 Analytics

The Website uses Google Analytics 4, provided by Google, to count visits and see which pages are used. Google Analytics sets these cookies:

We use the results only to understand how the Website is used and to improve it. We do not use them for advertising and do not use Google Analytics advertising features. Google signals is off, no advertising accounts are linked, and we do not let Google use the data for its own products. Google may process this data in the United States.

How we ask depends on where you are. The Website works this out from the time zone setting of your browser. This setting stays in your browser and is not sent to us or to anyone else.

• Visitors in the EU and the rest of Europe, except the UK: we set analytics cookies only after you click "Accept" in our cookie banner. You can withdraw consent at any time with the "Cookie settings" link at the bottom of every page. If your time zone cannot be read, we treat you as an EU visitor.
• Visitors in the UK and outside Europe: analytics cookies are set when you visit, and our cookie banner tells you so. You can opt out at any time with the "Opt out" button or the "Cookie settings" link, or by blocking cookies in your browser.

14. Changes

We will post changes to this policy here and tell customers about material changes.