🧭 Data Protection Impact Assessment
GDPR Art. 35 / UK DPA 2018 Schedule 1 — formal assessment of the AI analysis pipeline (pose detection, ball tracking, shot classification).
1. Controller
- Entity: AceSense Technologies
- Primary contact:
dpo@acesense.io - Supervisory authorities of record: to be confirmed once the EU + UK representatives are designated.
2. Processing described
| Aspect | Detail |
|---|---|
| Purpose | Automated coaching feedback on a user's own tennis video |
| Lawful basis | Consent (GDPR Art. 6(1)(a)) for the AI analysis itself; contract (Art. 6(1)(b)) for account + delivery |
| Categories of data | Raw video (personal data — face, body visible); derived pose keypoints, ball trajectory, racket contact; shot-type labels; AI whole-video read (timestamped shot events, per-player skill ratings and coaching notes, players referenced by court position only — never by name or identity); session metadata |
| Categories of data subjects | Account holders (≥16); incidental persons captured in the background of the video |
| Volume | Per user: 0–20 videos/month. Per video: up to 2 h, ~2 GB, ~216 000 frames |
| Data sources | User-uploaded video, user-entered profile |
| Recipients / sub-processors | Firebase (EU), RunPod (EU/US GPU), Google Cloud Vertex AI (Gemini video analysis — global endpoint: inference may run outside the EU, incl. US; video is read in place from the EU storage bucket via gs:// URI), Resend (US — transactional email), Apple and Google Play (native subscription events), Stripe (hosted test billing and subscription events) |
| Retention | Raw video: 30 days on Firebase Storage. Analysis JSON + pose coordinates: until account deletion |
| Cross-border transfers | Vendor-hosted processing may involve EU→US transfers. Applicable DPA, SCC/UK Addendum, Data Privacy Framework status, account region, and onward processors must be verified and recorded per vendor before production use. |
3. Necessity + proportionality
- Is each data category necessary? Pose keypoints are the minimum required to reason about technique. We do not store or transmit face embeddings. We do not retain audio. We down-sample video to 30 fps before inference.
- Alternative considered: in-device inference. Rejected because the models (TrackNet, MediaPipe Pose, CatBoost shot classifier) need ~6 GB GPU RAM and would drain phone batteries within 3–4 minutes of footage. Server-side processing is the least-intrusive option that still delivers the feature.
- Data minimisation: background individuals in the frame are treated as incidental; no pose is extracted for non-player detected figures unless they are on-court.
- Retention minimisation: raw video auto-deletes at 30 days; the derived JSON is orders of magnitude smaller and retains no biometric identifier.
4. Risks to rights and freedoms
| # | Risk | Likelihood | Severity | Inherent risk |
|---|---|---|---|---|
| R1 | Video intercepted in transit | Low | High | Medium |
| R2 | Unauthorized access to Storage objects | Very low | High | Medium |
| R3 | Sub-processor personnel view content | Low | Medium | Low-Medium |
| R4 | Re-identification of incidental bystanders | Medium | Medium | Medium |
| R5 | Pose coordinates reused for biometric identification | Very low | High | Medium |
| R6 | Retention overrun — videos not deleted at 30 days | Medium | Low-Medium | Medium |
| R7 | Minor (under 16) evades age gate | Medium | Medium | Medium |
| R8 | AI produces wrong / harmful coaching advice | Medium | Low | Low-Medium |
| R9 | Cross-border transfer invalidated (e.g. DPF annulled) | Low | High | Medium |
| R10 | Breach notification exceeds 72-hour window | Low | High | Medium |
5. Mitigations in place
| Risk | Mitigation |
|---|---|
| R1 | TLS 1.3 for all uploads. Firebase enforces HTTPS. |
| R2 | Storage security rules enforce request.auth.uid == userId for reads and writes. 2 GB size cap. Admin SDK bypass only from Cloud Functions. |
| R3 | Vendor access controls and audit logs reduce exposure. Firebase acceptance evidence and the applicable RunPod, Resend, Apple, Google Play, and Stripe terms remain tracked actions; do not claim all are executed. |
| R4 | Bystander faces are not extracted; only body-pose keypoints of the player are used for coaching. We do not publish a feature that identifies bystanders. |
| R5 | Pose data is stored per-frame as joint coordinates, not as embeddings. We do not build any model that maps pose → identity. Internal policy prohibits such use; periodic code review confirms. |
| R6 | processVideoOnUpload schedules Storage objects for deletion after 30 days via an object-lifecycle rule. Scheduled function verifies weekly. |
| R7 | Sign-up stores an age attestation, not date of birth. Users attest to 16+, or 18+ in India; this is not independent age verification. |
| R8 | In-app disclaimer ("AI-generated — use alongside human judgement"). No medical claims. |
| R9 | Verify and execute each vendor's applicable DPA and transfer mechanism before production use; retain account-specific evidence and reassess if a transfer mechanism changes or is invalidated. |
| R10 | Breach runbook (see compliance/breach-response.md) drills this quarterly. |
6. Residual risk + decision
The technical controls support a preliminary low–medium residual-risk assessment, but this draft has not been approved by a DPO or counsel. Production use of a vendor with an open DPA/transfer action, including Stripe live mode, must wait for that action and the relevant privacy notice to be completed. The approver must decide whether any residual risk remains high enough to require consultation under Art. 36(1).
7. Review cadence
- Annually, or sooner if:
- A new category of data is introduced (e.g. audio).
- A new sub-processor is added.
- Retention periods change.
- A breach occurs.
- A new jurisdiction comes online (e.g. opening to India DPDP Act rule-finalisation).
8. Consultation of data subjects
Not performed formally. The product records affirmative acceptance of the AI consent dialog before upload, but this repository contains no validated decline-rate or complaint-volume evidence. Those metrics must not be claimed until they are obtained from an approved source.
9. Sign-off
| Role | Name | Date |
|---|---|---|
| Data Protection Officer | (to assign) | — |
| Engineering Lead | (to assign) | — |
| Product Lead | (to assign) | — |
Was this page helpful?