Home

Legal

Privacy Policy

Last updated: November 5, 2026 · Version 3 (draft)

Under review. This is the version 1 draft and it is being reviewed by our legal advisers. It may change before final publication. Items in square brackets will be completed before it is published.

1. Who we are and scope

[COMPANY NAME], tax ID (NIT) [NIT], registered at [ADDRESS], Colombia (“ProEvolution Lab”), provides the ProEvolution Lab sports performance intelligence platform and the website www.proevolutionlab.com.

This policy explains which personal data we handle, why, who we share it with and how you can exercise your rights. It applies in two different situations:

  • Website: when you write to us through the contact form, ProEvolution Lab is the controller of that data.
  • Platform: each club is the controller of its users' and athletes' data, and ProEvolution Lab handles it on the club's behalf as processor, under the Data Processing Agreement.

2. What data we handle

On the website

  • What you give us in the contact form: name, club or institution, e-mail address and message.
  • Your theme (light or dark) and language preferences, stored only in your browser.
  • The website uses no tracking or advertising cookies and no third-party analytics tools.

In the platform

  • Club users (administrators, coaching and support staff): name, e-mail address, role, optional profile photo, preferred language and theme, and technical security records (sign-ins, session activity and two-step verification).
  • Athletes: name, date of birth, positions, jersey number, team and season, physical measurements (height and weight), sports background, call-ups and achievements, post-match evaluations, match participation, training attendance and coaching notes (stored encrypted).
  • Athlete photo and video: only if the club records the corresponding authorization (from the legal guardian for a minor, or from the athlete themselves if of age).
  • AI assistant (optional): each user's questions and answers, stored encrypted and visible only to their author.
We do not collect identity document numbers, athletes' contact details or medical information. When an athlete does not play, the club may record the reason (for example “injured” or “ill”) as availability only, without diagnoses or health details.

3. What we use the data for

  • Providing the service: recording matches, evaluations and attendance, and showing the club's dashboards and reports.
  • Managing accounts, permissions and the security of the platform.
  • Providing support and answering requests.
  • Sending the service e-mails that are needed (invitations, password resets and important notices).
  • Meeting legal obligations.

We do not sell personal data, use it for advertising or use it to train artificial intelligence models.

5. Athletes who are minors (children and adolescents)

The platform handles data of underage athletes. That is why we apply stricter rules:

  • Processing serves and respects the best interests of children and adolescents and safeguards their fundamental rights (article 7 of Law 1581 of 2012).
  • The club obtains the legal guardian's authorization before recording a minor's data; for photos and videos, the platform requires it to be recorded (who confirmed it and when).
  • We collect only the data needed to support athletic development.
  • Evaluations are observations of one match: never a judgement of an athlete's worth or potential, nor a diagnosis.
  • The website does not collect data about minors.

Adult athletes, according to the age set by the club, give their own authorization.

6. Who we share data with

  • Service providers that help us run the platform (hosting, database and e-mail delivery), under contract and only for that purpose. The list is in Service Providers.
  • OpenAI, L.L.C., the platform's artificial intelligence provider, to answer the questions asked to the AI assistant included in your plan. It only receives the question and the statistics the user can already see, with athletes' and teams' names replaced by codes. If the club connects its own AI account, the data goes to that account's provider (see section 12).
  • Authorities, when a rule or an order requires it.

Each club sees only its own information: access rules are enforced in the database, not just on screen.

7. International transfers

Platform data is stored on servers located in São Paulo, Brazil. Some providers process data in other countries: the e-mail provider and OpenAI, L.L.C., the platform's artificial intelligence provider, which processes the AI assistant's questions and the statistics that come with them in the United States, with athletes' and teams' names replaced by codes; this is an international data transfer. If the club connects its own AI account, that provider may process the data in other countries under the club's contract. In those cases we require adequate protection safeguards under Colombian rules. [To be confirmed with the legal adviser: applicable declarations or authorizations.] [PENDING LEGAL REVIEW: safeguards for the transfer to OpenAI in the United States.]

8. Security

  • Encryption of information in transit and at rest, plus additional encryption of notes and free text.
  • Isolation of each club's data in the database.
  • Access based on each person's role, optional or club-wide two-step verification, and sign-out after inactivity.
  • An audit log of sensitive actions.
  • Passwords nobody can see: they are not stored as text.

No system is completely infallible; if an incident affects your data, we will act under the Data Processing Agreement and the law.

9. How long we keep data

  • Platform data: while the club's service is active. If the club closes its account, it can export its data; after a waiting period of 30 days it is deleted.
  • Change history (audit): 2 years.
  • Session activity: 30 days.
  • Undeliverable e-mails (bounces and spam complaints reported by the e-mail provider): 180 days, or until the user's account is deleted.
  • AI assistant conversations: deleted automatically after 30, 90 or 180 days without activity, as set by the club.
  • Traffic sent to OpenAI: OpenAI keeps it for up to 30 days, only for abuse monitoring. [PENDING LEGAL REVIEW]
  • AI assistant usage record (without the text of conversations): 2 years.
  • AI assistant security record: when the assistant blocks a misuse attempt, the question that caused it is kept, encrypted, visible only to the club Administrator and impossible to delete or change, as evidence: 2 years.
  • Backups: expire according to the provider's schedule ([X] days).
  • Contact form messages: [period to be defined].

10. Your rights

As a data subject you can access, update, correct and delete your data, request proof of the authorization, be informed about its use, revoke the authorization when there is no legal or contractual duty to keep it, and file complaints with the Superintendence of Industry and Commerce (SIC).

If your data (or that of an athlete you represent) is in a club's platform, you can contact that club's Administrator or write to us; we will coordinate with the club. We answer queries within ten (10) business days and claims within fifteen (15) business days. The procedure is in Data Deletion.

11. Cookies and local storage

We use cookies and similar technologies, such as the browser's local storage, to make the website and the platform work and to remember your preferences. The first time you visit the website we show you a notice so you can choose what you accept; you can change your choice at any time with the cookie button at the bottom left of the screen.

Necessary (always on)

They make the website and the platform work: your platform session, your cookie choice, light or dark mode, the interface language and your progress in the guides. They are stored in your browser and are not used to follow you on other sites.

Analytics (only with your permission)

They would help us count visits and understand which pages are useful, without identifying you. We don't use any analytics tool today; if we add one, it will only run if you accept it and we will list it under Service providers.

Advertising (only with your permission)

They would let us show ProEvolution Lab ads on other sites and measure campaigns. We don't use advertising cookies today; we would only use them if you accept them.

We don't sell your information or use it for third-party advertising. You can also delete cookies and local storage in your browser settings; if you delete the necessary ones, the platform will ask you to sign in again and the website will show you the notice again.

12. Use of artificial intelligence and data processing

The artificial intelligence assistant is an optional feature included in the plans, with monthly credits depending on the plan. This section explains how it handles data; the terms of use are in the Terms and conditions.

What it is used for

  • Answering questions from the club's authorised users about how their teams and athletes are performing.
  • Explaining how to use the platform.
  • Summarising trends and preparing supporting information for the coaching staff. It never makes decisions about an athlete.

What leaves our servers

  • The user's question and only the statistics that user can already see in the platform.
  • Athletes and teams replaced by codes (for example, J-3F2A91); names the user types in their question are also rewritten before it is sent.
  • Names are put back only on our server, when the answer is shown.
  • Never contact details, ID numbers or medical data: the platform does not store them.

The provider of the assistant included in your plan

The assistant included in your plan runs on the API of OpenAI, L.L.C. (not ChatGPT), which processes the data in the United States. OpenAI keeps its API traffic for up to 30 days, only for abuse monitoring. [PENDING LEGAL REVIEW]

No model training

ProEvolution Lab does not use your club’s information to train artificial-intelligence models. The assistant included in your plan runs on the OpenAI API, which does not use data sent through its API to train its models, and before a question is sent we replace athletes’ and teams’ names with codes. In addition, every option to share data with OpenAI is turned off in the platform's OpenAI account.

If your club connects its own AI account

The club can connect its own key from an AI provider instead of using the plan's credits. In that case the terms of the club's own account apply, which ProEvolution Lab does not control:

  • OpenAI: data sent through its API is not used to train its models, unless the club itself has turned on data sharing in its account.
  • Google Gemini with a paid account (a Google Cloud project with billing): Google does not use prompts or responses to improve its products.
  • Google Gemini on the free tier: Google may use the content to improve its products and AI, and people may review it; in the European Economic Area, Switzerland and the United Kingdom the paid-account rules also apply to the free tier. That is why we recommend a paid account.

Your rights

The rights in section 10 also apply to the data the assistant processes: you can request access, correction or erasure by writing to privacy@proevolutionlab.com.

Security

Questions and answers travel encrypted. Attempts to use the assistant for purposes that are not allowed are blocked and logged.

13. Changes to this policy

If we update this policy, we will publish the new version on this page with its date and, if the change is significant, we will notify club administrators.

14. Contact

For any personal data matter, write to privacy@proevolutionlab.com.

Cookie preferences

Necessary

Always on

They make the site work and remember your preferences, such as light or dark mode and your progress in the guides. They are stored only in your browser.

They would help us count visits and see which pages are useful, without identifying you. We don't use any analytics tool today: we would only turn one on with your permission.

They would let us show ProEvolution Lab ads on other sites and measure campaigns. We don't use advertising cookies today: we would only turn them on with your permission.