Effective date: 2026-05-25 · Version 1.0
Mímir Lens ("we", "us") is the data controller for the personal data described here. For any privacy request, contact us at privacy@mimirlens.com.
| Category | Examples |
|---|---|
| Account | Email address, name, password (stored only as a bcrypt hash) |
| Profile | Sport, skill level, playing hand, goals, role (player/coach) |
| Uploaded video | Short shot/rally clips you upload. These can show identifiable people and are treated as sensitive. We do not retain raw video after analysis — only a content hash and the resulting scores/feedback. |
| Analysis results | Mímir ratings, per-dimension scores, coaching feedback, rally timelines, gear recommendations |
| Payments | Subscription/credit records and Stripe customer identifiers (card details are handled by Stripe, not stored by us) |
| Optional location | Approximate location for "find nearby players", only if you opt in; you can disable and delete it at any time |
| Technical | Push-notification endpoints, limited security logs (e.g. salted hashes of IP addresses for admin-access auditing) |
| Purpose | Legal basis (Art. 6 / Art. 9) |
|---|---|
| Providing the analysis service and your account | Performance of a contract (Art. 6(1)(b)) |
| Processing your uploaded video (including by our AI provider) to generate feedback | Your explicit consent, given at sign-up (Art. 6(1)(a) and Art. 9(2)(a) where the footage reveals sensitive data). You may withdraw consent at any time by deleting your account. |
| Payments and fraud prevention | Contract and legal obligation (Art. 6(1)(b)/(c)) |
| Service-related notifications | Legitimate interests / contract |
| Marketing and lifecycle emails (welcome, monthly recap, coach onboarding) | Legitimate interests, with a one-click opt-out in every such email (Art. 6(1)(f)) |
| Security logging | Legitimate interests (Art. 6(1)(f)) |
We use a small number of trusted service providers who process data on our behalf under data processing agreements:
| Processor | Purpose | Location |
|---|---|---|
| Anthropic | AI analysis of uploaded video frames | United States |
| Stripe | Payment processing | United States |
| Resend | Transactional and lifecycle email delivery | United States |
| Railway | Application hosting and database | Cloud infrastructure |
We do not sell your personal data.
Some processors above are located in the United States. Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) together with the providers' supplementary measures. In particular, frames extracted from your uploaded video are transmitted to Anthropic in the United States solely to generate your analysis.
Under the GDPR you have the right to access, rectify, erase, restrict, and object to processing of your data, and the right to data portability. Specifically:
/api/player/export./api/player/delete-account. This cascades to your analyses, payments, and related records.Mímir Lens is not directed at children under 13 (or the applicable age of digital consent in your jurisdiction). Users under 18 must have a parent or guardian agree to our Terms on their behalf. You should only upload footage of other identifiable people — including minors — with their (or their guardian's) consent.
We use HTTPS/HSTS in transit, hashed passwords (bcrypt), signed session tokens, and least-data security logging. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to the risk.
We may update this policy from time to time. The effective date at the top reflects the current version; for material changes affecting your rights we will notify you by email or in-app.
Privacy questions or requests: privacy@mimirlens.com.