GDPR Policy

1. Data Controller

Above Sports Group is the data controller for the processing of your personal data. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish data protection legislation.

2. Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contract: Processing necessary to fulfill our agreement with you
• Consent: When you have explicitly given your consent
• Legitimate interest: To improve our services and ensure platform security
• Legal obligation: When processing is required by law

3. Retention Period

We store your personal data for as long as necessary for the purposes for which it was collected. Account information is retained as long as your account is active. Training data and statistics may be retained for up to 3 years after account closure for historical tracking.

4. Third-Country Transfers

We strive to keep all data processing within the EU/EEA. If transfer to a third country occurs, we ensure appropriate safeguards are in place in accordance with GDPR, such as standard contractual clauses.

5. Data Processors

We use the following categories of data processors:

• Cloud service providers for data storage
• Email service providers for communication
• Analytics services for platform improvement

All processors are bound by data processing agreements in accordance with GDPR.

6. Security Measures

We implement technical and organizational measures to protect your data, including:

• Encryption of data in transit and at rest
• Role-based access control
• Regular security audits
• Staff training in data protection

7. Your Rights Under GDPR

You have the following rights:

• Right of access – request a copy of your data
• Right to rectification – correct inaccurate data
• Right to erasure – request deletion of your data
• Right to restriction – restrict processing of your data
• Right to data portability – transfer your data to another service
• Right to object – object to certain processing
• Right to withdraw consent – withdraw given consent at any time

8. Complaints

You have the right to file a complaint with the Swedish Authority for Privacy Protection (IMY) if you believe we are processing your personal data in violation of GDPR.

9. The AI Assistant

When you use the AI assistant we store your question as text, the AI answer, and usage metadata (time, topic category, token usage, cost, and response time).

• Voice audio is never stored — only the transcript of your question.
• Questions are processed pseudonymized by our AI provider (OpenAI) acting as data processor; names and contact details are never sent.
• Retention: question and answer text is automatically anonymized after 12 months, leaving only anonymous usage statistics.
• You can view your full history at any time in "AI assistant log" and delete individual entries or the entire log.
• Coaches can never access a player’s assistant log, and vice versa.

10. Contact

Data Protection Officer: support@abovesports.group