1. Data Controller

HyzerMind is operated by William Arts (Business ID 2061379-5, Finland).

Contact: viltsu@hyzermind.app or our contact form.

2. Register Name

User Register of the HyzerMind Service.

3. Purpose of Data Processing

Personal data is processed for the following purposes:

• Creating and securely managing user accounts.
• Providing AI-powered disc golf form analysis.
• Storing and displaying throw history and analysis results.
• Managing profile information and analysis credit limits.
• Processing payments and managing credit purchases.
• Handling communication and feedback from users.
• Sending account emails and, unless you turn them off, product update emails (see section 11).
• Maintaining, securing, and developing the service.
• Analysing app usage patterns (pages visited) to understand how the service is used and to improve it. This processing is based on our legitimate interest in service development.

4. Data Collected

The service collects the following data:

• Email address: Required for account creation and login.
• Password: Stored in an encrypted (hashed) format.
• Analysis clip: A throw clip of 15 seconds or less, chosen by the user, uploaded for AI analysis and history. The sound track and embedded metadata (such as location) are removed before upload.
• Analysis results: AI-generated feedback stored and linked to the user's account.
• Stripe customer ID: Identifier used to manage transactions securely.
• Transaction records: Purchase history, credit amounts, package details, and payment status.
• Page visit data: Which pages of the app you visit and the time of the visit. For logged-in users, this data is linked to your account. Used solely for service development and improvement. You can opt out at any time in your account settings.
• Email preferences: Whether you have turned off product update emails, a random code that makes the unsubscribe link in our emails work, and a record of which update emails were sent to your account (time and status, not your email address).

5. Data Sources

All data is obtained directly from the user through account registration, video uploads, and form submissions.

6. Video Clip Data Processing

You trim your throw video to 15 seconds or less on your own device and pick it in the app. Before upload, the app removes the sound track and embedded metadata (such as location) from the copy that is analysed, or re-encodes the video in your browser if it is too large to upload as it is. That clip is uploaded for native AI analysis and stored in your account history. In Safari, when the clip had to be re-encoded, a full-frame-rate copy of the video you picked may also be stored for playback in your history. It is compressed in your browser when possible, and like the clip it has no sound or embedded metadata.

7. Cookies and Usage Tracking

HyzerMind uses cookies and similar tracking in two separate ways:

• Essential session cookies: Required for login and authentication. These cannot be declined as they are necessary for the service to function.
• Server-side usage analytics: Pages visited within the app are recorded server-side to Firebase Firestore for service improvement. This does not use cookies. Logged-in users can opt out in their account settings.
• Marketing analytics (Firebase Analytics / Google Analytics 4): With your consent, we use Google Firebase Analytics to understand how users discover and navigate the service. This uses cookies and device identifiers to collect anonymised usage data. This tracking is activated only after you accept via the cookie consent banner. You can withdraw consent at any time by clicking "No thanks" when the banner is re-shown, or by clearing your browser cookies.

8. Data Storage and Security

• User data is stored on Firebase (Google Cloud) servers. The database and the stored clips are in Google Cloud's Finland region (europe-north1).
• AI analysis runs on Google Vertex AI's global endpoint. Google may process the analysis clip and its result anywhere in the world, so this processing can take place outside the EU/EEA.
• Passwords are stored using Firebase Authentication hashing mechanisms.
• Access to user data is restricted to authorized administrators.
• Page visit analytics data is stored in Firebase Firestore and is only accessible to administrators.

9. Data Disclosure and Transfers

Analysis clips are transferred to Google Cloud's Vertex AI service for analysis. Because analysis runs on Vertex AI's global endpoint, a clip may be processed outside the EU/EEA, including in the United States.

Transfers to the United States rely on the EU–US Data Privacy Framework, under which Google LLC is certified. Transfers to other countries outside the EU/EEA rely on the European Commission's Standard Contractual Clauses, which are part of Google Cloud's data processing terms. You can request a copy of these safeguards by contacting us.

Payment data is shared with Stripe for transaction processing. Your email address and the content of the emails we send you are shared with Brevo for email delivery (see section 11). Personal data is not sold to third parties.

10. Payment Processing

Payments are processed by Stripe, Inc. Card details are collected directly by Stripe and are never stored on our servers.

More details: https://stripe.com/privacy

• We receive only customer identifiers and transaction confirmations.
• Stripe may retain payment information according to their own policy.

11. Emails

We send account emails, such as email verification and password resets. These are needed to run your account and always arrive.

We also send product update emails: news about HyzerMind, and an email when we give you free analyses. They go only to verified email addresses. The legal basis is our existing customer relationship: you have a HyzerMind account.

You can turn product update emails off at any time with the unsubscribe link in each of them, or with the "Email updates" switch in your account settings.

Emails are delivered by Brevo (Sendinblue SAS, an EU company), which processes your email address and the email content on our behalf.

12. Data Retention

Data is stored while the account remains active. Deleting an account permanently erases associated throw history, analysis clips, and feedback.

13. User Rights

• Access your data via account pages.
• Request deletion of your account and associated data.
• Withdraw analytics cookie consent at any time via the cookie banner (re-shown after 12 months for previously declined users, or by clearing your browser's localStorage).
• Opt out of server-side usage analytics in your account settings.
• Turn off product update emails with the unsubscribe link in any of them or in your account settings.
• Withdraw all consent by deleting your account.
• File a complaint with your local data protection authority.

14. Minors

The service is intended for users aged 13 and above.

15. Changes to This Policy

This policy may be updated periodically. Changes are reflected by the last updated date.