Effective Date: June 25, 2026
Introduction
BallMoney.ai is operated by Magic in Motion. This Privacy Policy explains how we collect, use, store, share, and protect your personal information. It complies with GDPR, CCPA/CPRA, Apple App Store requirements, and Stripe data handling requirements.
Section 1 — Data We Collect
- Identity Data: full name, sport, position, school, division level, profile photo.
- Contact Data: email address, phone number.
- Account Data: username, password (hashed), subscription tier.
- Financial Data: payment method via Stripe (we never store full card numbers), income and expense entries, deal values.
- Contract Documents: PDFs and documents uploaded for AI analysis.
- Usage Data: pages visited, features used, session duration, click patterns.
- Device Data: browser type, OS, IP address.
Section 2 — How We Use Your Data
- Providing Platform services.
- Processing payments and collecting fees.
- Sending SMS alerts and email notifications.
- Improving AI models using anonymized data only.
- Detecting fraud and ensuring platform security.
- Complying with legal obligations.
- Sending marketing communications (opt-in only).
We do not sell your personal data to third parties. We do not share individual contract documents with other users or organizations. We do not use your data to identify you in AI training.
Section 3 — AI Processing of Your Data
When you upload a contract, the text is sent to OpenAI and Google Gemini via encrypted HTTPS API calls. These providers process text to generate analysis and do not store your data beyond immediate processing per their enterprise API terms. All stored contract files are encrypted AES-256 at rest in Supabase Storage.
Section 4 — Our Subprocessors
- Supabase — database, auth, file storage (USA)
- OpenAI — contract analysis AI (USA)
- Google Gemini — AI processing fallback (USA)
- Stripe — payment processing (USA)
- Twilio — SMS alerts (USA)
- Resend — transactional email (USA)
- Vercel — web hosting (USA)
Section 5 — Data Retention
- Account data: duration of account plus 90 days.
- Contract documents: duration of account plus 90 days.
- Payment records: 7 years (legal requirement).
- Log data: 12 months.
- Anonymized aggregated data: indefinitely.
Section 6 — Your Rights
All Users
- Access your data.
- Correct inaccurate data.
- Delete your account.
- Data portability.
California Residents (CCPA)
- Right to know what data we collect.
- Right to delete.
- Right to opt out of data sharing (we do not sell data).
- Right to non-discrimination.
EU / UK Residents (GDPR)
Access, rectification, erasure, restriction, portability, objection, and the right to complain to a supervisory authority. Response within 30 days.
Section 7 — Data Security
AES-256 encryption at rest. TLS 1.3 in transit. Row-level security on all database tables ensuring each user sees only their own data. Breach notification within 72 hours per GDPR requirements.
Section 8 — Children
Platform not directed at users under 13. Users aged 13 to 17 require parental consent.
Section 9 — International Transfers
Data processed in the United States. EEA/UK transfers comply with GDPR via Standard Contractual Clauses.
Section 10 — Contact
privacy@ballmoney.ai | ballmoney.ai/privacy
- For GDPR requests use subject line: GDPR Request
- For CCPA requests use subject line: CCPA Request