Privacy Policy

This Privacy Policy explains how personal data is processed when you visit or use Next Level Tennis at https://nextleveltennis.app (the “Service”).

1. Data controller

The controller responsible for your personal data is:

Next Level Tennis, Inc.
Email: support@nextleveltennis.app

We have not appointed a data protection officer. Privacy questions and requests may be sent to the email address above.

2. Personal data we process

Depending on how you use the Service, we may process:

Account and identity data

• email address;
• account identifiers;
• password authentication data in protected form;
• magic-link request, delivery, and verification records; and
• account creation, sign-in, and security timestamps.

Passwords are stored only in hashed form and are not accessible in plaintext.

Profile and Service data

• name or display name, if provided;
• tennis profile, preferences, goals, plans, notes, training records, match or performance data, uploaded match videos, training videos, images, audio, documents, and other files or information you choose to provide;
• settings and feature preferences; and
• communications and support requests.

Please avoid entering health data or other special-category personal data unless the Service expressly requests it. If a feature is later introduced that intentionally processes such data, we will provide additional information and establish an appropriate legal basis before that processing begins.

Subscription and transaction data

• subscription plan, status, renewal and cancellation dates;
• transaction identifiers, amount, currency, tax and invoice information;
• limited payment-method details supplied by Stripe, such as card brand and last four digits; and
• payment success, failure, dispute, and refund status.

Stripe processes your full payment details. We do not normally receive or store your full card number or security code.

Technical, security, and usage data

• IP address and related request information where needed for hosting, security, fraud prevention, and troubleshooting;
• device, browser, operating system, timestamps, logs, and error information;
• pages or routes viewed, referrer, approximate geographic region, and aggregated usage events; and
• cookie or similar-technology information, if any such technology is used.

Vercel Web Analytics is designed to provide aggregated, cookie-free analytics and does not provide us with a persistent profile of an identifiable visitor. We do not intentionally send email addresses, account IDs, magic-link tokens, payment details, or other sensitive values to analytics.

Data received from others

We may receive transaction and fraud-prevention information from Stripe, delivery and authentication information from service providers that send account emails, and technical information from hosting and infrastructure providers.

AI processing

Certain features use artificial intelligence to generate analyses, summaries, recommendations, or other outputs based on information you provide, including uploaded match videos, training videos, images, documents, and match data. AI-generated output may be inaccurate or incomplete and should not be treated as professional advice. We process only the information necessary to provide the AI functionality you request.

3. Why we process data and our legal bases

Where the EU General Data Protection Regulation (“GDPR”) applies, we rely on the following legal bases:

Where we rely on legitimate interests, we consider the necessity of the processing and balance those interests against your rights and reasonable expectations.

You may withdraw consent at any time where processing relies on consent. Withdrawal does not affect processing that occurred before withdrawal.

4. When data is required

Account, authentication, and payment information is required to create and maintain a paid subscription. If you do not provide it, we may be unable to open an account, authenticate you, or supply paid features.

Optional profile, training, performance, communication, and uploaded-media information is used to provide the features you choose to use. This may include processing videos, images, audio, documents, and other files to generate requested analysis, summaries, or AI-assisted output.

5. How we share personal data

We do not sell personal information or user-generated content.

We may disclose data to:

• Stripe, which processes payments, subscriptions, billing, fraud checks, disputes, and related compliance;
• Vercel, which provides website hosting, infrastructure, and privacy-focused Web Analytics;
• OpenAI, LLC, which processes relevant user content and instructions to provide requested AI-powered analysis and other AI-assisted features;
• providers that support database hosting, authentication, transactional email, error monitoring, security, customer support, or other Service operations;
• professional advisers such as accountants, lawyers, insurers, and auditors where necessary;
• public authorities, courts, regulators, or law-enforcement bodies where disclosure is legally required or necessary to protect legal rights; and
• a buyer, investor, or successor in connection with a proposed or completed merger, financing, reorganization, or sale of the business, subject to appropriate confidentiality and data-protection safeguards.

Providers may act as processors on our instructions or, for certain activities, as independent controllers. Stripe, for example, may process payment data as an independent controller where required for its regulatory, fraud-prevention, and payment-network responsibilities. Their own privacy notices apply to that processing.

6. International transfers

Some providers may process personal data outside the European Economic Area (“EEA”). Where required, we use an approved transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where appropriate.

You may contact us for more information about the safeguards relevant to your data.

7. Retention

We keep personal data only for as long as reasonably necessary for the purposes described above:

• Account and Service data: while your account is active. After account deletion, we aim to remove or anonymize active account content within 90 days, unless a longer period is needed for legal obligations, security, dispute resolution, or the establishment, exercise, or defense of legal claims.
• Backups: deleted data may remain in protected backups until those backups are overwritten in the ordinary cycle, generally within 90 additional days.
• Authentication and security logs: generally up to 12 months, unless an incident requires longer retention.
• Support communications: generally up to 3 years after the matter is closed.
• Contracts and transaction records: generally for the duration of the contract and up to 3 years afterward for ordinary legal claims; records may be kept longer when a claim, investigation, or legal duty requires it.
• Tax, accounting, and invoice records: for the period required by Czech law, which may be up to 10 years depending on the record and applicable tax rules.
• Analytics: according to Vercel’s applicable retention settings and policies; we use analytics in aggregated form and do not use it to build persistent identifiable visitor profiles.

We may retain anonymized information that can no longer reasonably identify you.

8. Cookies and analytics

Vercel Web Analytics is designed to operate without third-party cookies. It may process a page or route, referrer, browser and device information, approximate location, and timestamp to produce aggregated traffic statistics. Its visitor-identification mechanism resets and is not intended to track a person across different websites or days.

Strictly necessary technologies may be used to keep you signed in, maintain security, remember essential choices, and provide requested features. These are used because the Service cannot operate properly without them.

If we introduce non-essential cookies or tracking that requires consent, we will provide an appropriate consent choice before using them and update this Policy.

9. Security

We use reasonable technical and organizational measures designed to protect personal data, including access controls, encrypted transmission, managed infrastructure, protected authentication data, and limited access based on operational need.

No internet service is completely secure. You are responsible for protecting your password, magic links, devices, and email account and for notifying us promptly of suspected unauthorized access.

10. Your rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• request access to your personal data and a copy of it;
• correct inaccurate or incomplete data;
• request deletion of personal data;
• restrict processing;
• object to processing based on legitimate interests, including direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time where consent is the legal basis; and
• lodge a complaint with a data-protection authority.

To exercise a right, email support@nextleveltennis.app. We may need to verify your identity. We will respond without undue delay and ordinarily within one month where the GDPR applies. The period may be extended by up to two further months for complex or numerous requests, in which case we will notify you.

You may also request deletion of your Next Level Tennis account through the same email address. Account deletion does not automatically cancel an active Stripe subscription, so cancel the subscription through the billing portal or ask us to cancel it as part of your request.

You may lodge a complaint with the Czech supervisory authority:

Office for Personal Data Protection (Úřad pro ochranu osobních údajů)
Pplk. Sochora 27
170 00 Praha 7
Czech Republic
Website: https://uoou.gov.cz

Because the controller is established in the Czech Republic, these GDPR rights may apply to the processing described in this Policy even when you are located in the United States.

11. U.S. state privacy rights

Residents of certain U.S. states may have additional rights, subject to the scope, thresholds, definitions, and exceptions of applicable law. Depending on your state, these may include the right to:

• know or confirm whether we process your personal data;
• access, correct, or delete personal data;
• obtain a portable copy of certain data;
• opt out of the sale of personal data, targeted advertising, or certain profiling;
• limit certain uses or disclosures of sensitive personal information;
• receive equal service and not be discriminated against for exercising a privacy right; and
• appeal our refusal to act on a request.

We do not sell personal data for money. We do not use personal data for cross-context behavioral advertising or targeted advertising, and we do not share personal data for those purposes. We do not knowingly sell or share the personal data of consumers under 16.

To submit a request or appeal, email support@nextleveltennis.app with the subject line “U.S. Privacy Request.” State the right you wish to exercise and your state of residence. We may verify your identity and authority before acting. An authorized agent may submit a request where state law permits, subject to reasonable proof of authority and identity verification.

If our practices change so that an opt-out mechanism is legally required, we will provide the required link or signal support before beginning that activity.

12. Automated decision-making

We do not use your data to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Stripe or other fraud-prevention providers may use automated systems to assess payment or fraud risk under their own responsibilities and privacy notices.

13. Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. Paid accounts are intended for persons 18 or older. If you believe a child under 13 has provided personal data, contact us so we can review and delete it as required by the U.S. Children’s Online Privacy Protection Act and other applicable law.

14. Third-party links

The Service may contain links to third-party sites or services. Their privacy practices are governed by their own notices, and we are not responsible for those practices.

15. Changes to this Policy

We may update this Policy to reflect changes in the Service, providers, or law. We will post the revised version and update the effective date. If a change materially affects how we use personal data, we will provide additional notice where required.

16. Contact

For privacy questions or requests:

Next Level Tennis, Inc.
Email: support@nextleveltennis.app