Privacy Policy
How RiseUp AI collects, processes, stores, and deletes personal data and match footage — and what rights players, clubs, and guardians have over it.
1 Data controller & roles
RiseUp AI (“the Company”) acts as the Data Processor. The football club or academy (“the Customer”) acts as the Data Controller. The Customer is responsible for obtaining all necessary consents from players and guardians before uploading footage to the platform.
Processing is conducted under Art. 6(1)(b) — performance of a contract — and Art. 6(1)(f) — the legitimate interests of the Customer in player performance analysis.
2 The Refinery Protocol — data minimisation
To protect player privacy, RiseUp operates a strict extract-and-purge policy. Raw footage is never retained beyond operational necessity.
| Data type | Retention | Action |
|---|---|---|
| Raw match video (4K/HD MP4) | 30 days | Permanent deletion |
| Processed frame cache | 7 days | Automated purge |
| Positional tracking data (JSON/CSV) | 5 years | Anonymisation — PII removed |
| Performance metadata (pseudonymised) | Long-term | Retained for scouting analytics |
| Tactical reports (PDF/JSON) | 10 years | Archive — audit and legal |
3 Smart-Lock & identity visibility
3.1 Players under 18
Identity is locked by default. Only verified professional scouts and club managers may submit a request to unlock a minor's identity. Every unlock event is logged and auditable. Positional data for under-18 players is pseudonymised at the point of ingestion.
3.2 Players 18 and over
Operated under a play-to-be-seen policy. Performance data and identity are visible to the RiseUp professional network to facilitate career opportunities. Players retain the right to request data access or erasure at any time.
4 AI processing & sub-processors
RiseUp uses AI models including Anthropic, Groq, and Qwen to generate tactical insights. No personally identifiable information is shared with these models. Only raw numerical performance data — coordinates, velocities, event flags — is processed to generate narrative reports.
Raw footage → CV pipeline → anonymised numerical metrics → AI narrative generation. PII is stripped before any model call.
5 Data residency
European operations. All PostgreSQL and vector data for European clubs resides in AWS or GCP Paris (eu-west-3) or Frankfurt (eu-central-1) regions.
On-premises privacy. Tactical reports generated by on-device models are processed in memory and stored within the client's siloed instance. No raw tactical insights are transmitted back to RiseUp central servers.
6 Right to erasure
On a valid Data Subject Access Request from a player or agent, RiseUp executes the following sequence:
- Delete the identifiable player profile from the scouting interface.
- Anonymise the historical tracking rows in PostgreSQL.
- Retain the non-identifiable vector embeddings for statistical model integrity. These do not constitute personal data under GDPR Recital 26.
7 Contact & policy review
This policy is reviewed annually, or whenever there is a major architectural change. For any data-related request — access, correction, erasure, or a complaint — write to us and we will respond within 30 days as required under GDPR Art. 12(3).
info@riseupai.coRiseUp AI · Casablanca Finance City (CFC) · Casablanca, Morocco