For safeguarding leads and data protection officers
Data and privacy note
Built works today · Next built before our first paying school · Later built when schools ask for it
The short version
- Live video of students passes through our server for the school's region, Germany today, in the school's own place, which other schools on that server cannot see into. A dedicated server in a region the school chooses, or the school's own machine, is available on request.
- Live video is not written to disk. With recording turned on, the server keeps only the last 10 to 15 minutes of each camera to cut replays from, and overwrites the rest. Recording is off unless the school turns it on Built.
- Viewers have no accounts and are not identified by name. There is no tracking, no advertising and no analytics vendor on the viewer page, and none on this website. Like any web server, the video server logs the IP address and time of each session. This website is served by Cloudflare, which sees visitors' IP addresses and never any video; the demo form goes to our server in Germany.
- Everyone who films was invited by name by the school's organizers. Students cannot start or end a broadcast.
- We do not list or publish streams anywhere, do not sell or share data, and do not use video to train anything.
- The school decides what is filmed and who watches; it is the controller of video and event data. Under the data processing agreement, which we are finalising before our first paying school Next, we act as its processor. On a school-hosted installation we neither host nor access video.
During the demo broadcast
- The demo runs on our demo server in Germany, one school at a time, under this note. Only your school's crew is on it while your demo runs.
- Recording is on for the demo, so it can show replays of goals and marked moments, as a paying school gets. What is written to disk: the last 10 to 15 minutes of each camera, overwritten as it goes and deleted within 15 minutes of the end, and 30-second replays around each moment, deleted automatically 48 hours after it. Nothing else of the video is kept. If you want no video on disk at all, tell us and we run the demo without replays.
- Each camera chooses at Go live between Stream and record, Stream only (nothing saved on the phone) and Record only Built. If your policy does not allow footage of students on a phone, choose Stream only. We recommend school-managed phones for the demo; a member of staff's phone is the next best choice.
- Cameras can be iPhones or Android phones. Until the store listings the camera app comes through TestFlight on iPhone, Apple's channel for apps before their App Store listing, which needs an Apple ID signed in, and as a test build we send on Android. Viewers install nothing.
- After the debrief we remove your crew from the demo server, and on request we delete your broadcast's title, team names and score log.
- If your safeguarding lead needs paperwork before anyone films, tick the box in the demo form. We answer their questions in writing before the demo is scheduled.
What is processed
| Data | Whose | Kept |
|---|---|---|
| Live video and sound from each camera | Students, staff, spectators in frame | Seconds, in memory, while live. Not written to disk unless recording is on Built |
| The last 10 to 15 minutes of each camera, with recording on | The same | Overwritten as it goes, to cut replays from Built |
| Replays of moments: 30 seconds from every live camera around a goal, a set or a moment the crew marked | The same | 48 hours, or the time the school sets, after which they are no longer offered and the storage deletes the files within a day; at once when an organizer or the admin removes one Built |
| Recording of each whole camera on the server | The same | For the life of the licence, or shorter if the school sets it; can be off Next |
| One small still per camera for the camera picker | The same | Replaced every few seconds while live; unreachable once the broadcast ends Built |
| Broadcast title, sport, team names, colours, logos, score log | None directly | Until the school deletes the broadcast or asks us to Built |
| Crew: each person's name as the organizer typed it, their role, who invited them; who filmed with which camera | Organizers and crew | For the life of the licence; a removed person stops working at once. Seen only by the school's admin and organizers Built |
| Viewer identity | Parents, viewers | None. No accounts, no names, no tracking cookies Built |
| Demo request from this website: name, role, work email, school, preferred date, phones, the paperwork box | The person who sent it | Used only to reply about the demo. Deleted at once on request; automatic deletion 12 months after the last contact Next |
| Server logs: IP address and session time | Viewers, camera operators | Today kept until the server is next updated, which can be weeks; automatic deletion after 14 days Next |
Student names are not entered anywhere: the system knows teams, not players. A moment is a time and a score, never a name. No face recognition, no player tracking, no biometric processing of any kind.
Where it is processed
- Gradiera Cloud. A server per region shared by its schools, or a dedicated server, in the region the school picks: Europe now; the Gulf and Asia-Pacific are set up for the first school there, with notice, before any of its data is processed there. Until then a school is served from Germany.
- School-hosted. The same server on the school's own machine. We never log in to it.
- The filming phone. With Stream and record, the phone keeps a full-quality copy in the app's own storage, which moves to the phone's Photos (Movies on Android) when the camera stops. It stays on the phone unless the operator shares it. The school should film on school-managed devices, or cover staff phones in its device policy, and delete recordings on a schedule it sets.
Who can watch
- Anyone with the viewer link, which the crew shares or the school prints as a QR. The link is a long random code, not guessable, and never listed.
- The link works like a key: anyone it is forwarded to can watch while the broadcast is live, so a QR in a newsletter makes the stream as public as the newsletter. If a link spreads, the school issues a new one, which stops the old one at once.
- New viewers are refused the live picture the moment the broadcast ends. After the end the same link opens only the game's replays, for 48 hours from each moment.
- A passcode printed on the viewer sheet Next; school logins for viewers Later.
- A viewer can screen-record, as with any video; the school's usual photography policy applies.
Safeguarding
- No stream is listed or searchable. There is no directory and no sharing to social networks from inside the product.
- Only people an organizer invited by name can film. Invites work once and expire in a week, and the admin or an organizer removes anyone at once Built.
- The admin sees every camera's latest picture and who is filming with it, and removes a camera with one click Built.
- Students who must not be filmed: no camera can promise to miss one child in a moving game, so the control is the school's decision not to stream a match such a student plays in. Before every broadcast the organizer confirms the school's no-film list was checked, and the broadcast's log keeps who confirmed it and when Next. Gradiera never holds the list, and does not use face recognition to blur a student. Until then the school records its procedure in its impact assessment.
- Cameras send the sound their phones hear; viewers start muted and tap for sound. A switch to send no sound is not built yet.
- Viewers are expected to be adults; the product offers no service to children directly.
Security, in plain terms
- Browser traffic, stills and control messages are encrypted in transit. Camera video is authenticated with a per-camera key; encryption of that leg is switched on before our first paying school Next.
- The two founders, Vitalii Kikot and Dmytro Hryb, hold key-based access to the servers. We do not open a school's live stream, except at the school's request to debug, and we record any such access.
- If we become aware of a breach affecting a school's data, we notify the school within 48 hours.
- An independent security review is planned before our tenth paying school Later.
Sub-processors
| Who | What for | Where |
|---|---|---|
| Hetzner Online GmbH (to be confirmed in the agreement) | Server hosting, Europe region | Germany |
| Cloudflare, Inc. | Hosting this website and the domain's DNS; sees website visitors' IP addresses, never video, broadcasts or demo requests | Worldwide |
| Our email provider, named in the agreement | Support, invoices, security notices | EU |
| Apple | App Store and TestFlight distribution of the camera app; processes operators' Apple IDs and crash reports, nothing about broadcasts, viewers or video | Worldwide |
| GitHub | Source code; no school data | US |
What the school signs
- A data processing agreement with this note as the record of processing; a 30-day sub-processor notice with a right to object; breach notice within 48 hours; return and deletion of all data within 30 days of termination Next.
- The technical half of a data protection impact assessment, pre-filled by us, with a parent notice template and an opt-out procedure Next.
- For a school-hosted installation, we sign the school's own data processing agreement template if its policy requires one.
Questions
Write to hello@gradiera.com. The two founders, Vitalii Kikot and Dmytro Hryb, answer within one working day.