Privacy Policy

This Privacy Policy explains how NIL Plus d.o.o. ("we", "us", "our", the "Service Provider", or the "Operator"), the company behind the Perfect TRAINING mobile and web application (the "App"), collects, uses, stores, and shares information when you use the App and our website perfecttrainingapp.com (see Section 14). By creating an account or using the App, you agree to the practices described below. If you do not agree with this Policy, please do not use the App.

The Perfect TRAINING App is a personalised sports training application designed primarily for youth and amateur football/soccer players. It delivers structured weekly training plans, exercise videos, progress tracking, personalised weekly nutrition plans, support from a personal coach (Coach Guardian), and tools to help users measure their resting heart rate and calculate personalised heart-rate training zones. The App is operated by: NIL Plus d.o.o. Cesta talcev 67 4000 Kranj Slovenia If you have any questions about this Policy or about your personal data, you can reach us at: • General support: support@perfecttrainingapp.com • Parental consent and parent accounts: parents@perfecttrainingapp.com

We only collect information that we need to operate the App and provide its features. 2.1 Account information (via Sign in with Google or Sign in with Apple) When you create an account, we receive from your identity provider: • A unique user ID • Your email address (if you use Apple's "Hide My Email", we receive only the private relay address) • Your display name (if available) • Your profile picture (if available) • Whether your email is verified • The sign-in method you used (Google or Apple) 2.2 Profile information you provide during onboarding • First name and last name • Nickname and an avatar you pick from our set (emoji or jersey number; we never ask for a photo of you) • Gender • Date of birth • Height and weight (only with your explicit consent, see Section 2.11) • Body fat percentage (optional, only if you choose to enter it, and only with your explicit consent) • Preferred unit system (metric or imperial) • Years of experience in the Perfect TRAINING program • Playing position and skill level (where applicable) 2.3 Training and performance data • Current season and current training week • Daily club obligations (Training / Match / Free) • Completion status for daily activities and individual exercises • Weekly streaks and progress scores • Weekly "feeling" check-ins (great / okay / tired) • Off-season program selections • Results of physical tests you record in the App (for example the Cooper test or push-ups) • Which Library topics you have opened or completed • The total number of trainings you have completed • Whether you already have KineticBANDS or are not interested in them (your answer during sign-up or on the KineticBANDS card) 2.4 Nutrition data If you use the nutrition feature, we calculate your daily energy and macronutrient targets from your gender, age, height, weight, body fat percentage (if you entered it), current season and your club obligations for the week. Because this uses your health data, a nutrition plan is only built after you have given your explicit consent (and, if you are 16 or younger, after your parent or guardian has given theirs; see Sections 2.11 and 11). We store: • Your weekly meal plans (meals, recipes and quantities) and the matching shopping lists, including which items you have ticked off • Your feedback on portion size ("more", "less", "just right") and the personal adjustment we apply as a result • Your consent to the nutrition acknowledgement, and whether you have chosen to share your meal plan with a parent Recipes show the common allergens they contain, together with a note on how to swap an ingredient. We do not ask you about allergies, intolerances or medical conditions, and we do not store any such information about you. 2.5 Heart-rate measurement data (Target Heart Rate / THR feature) The App includes a feature that allows you to measure your resting heart rate (RHR) using your phone's rear camera. We store the resulting numeric measurements: • Up to three resting heart-rate (BPM) measurements • The timestamp of each measurement • The calculated average resting heart rate • The calculated maximum heart rate (estimated as 220 minus age) • The six personalised training zones derived from your RHR using the Karvonen formula See Section 4 below for details on how the camera is used and what is — and is not — collected. Your resting heart rate is health data: the App asks for your explicit consent before your first measurement (see Section 2.11). 2.6 Parental consent and parent account information If you indicate that you are 16 years old or younger, the App collects: • Your parent's or legal guardian's email address • The status and timestamps of the parental approval workflow • The parent's or guardian's approval record: the name they sign with, the date, and which versions of our documents they accepted • Whether the parent agreed to communication between you and a Coach Guardian If a parent or guardian creates their own parent account (see Section 11), we also store their sign-in details (as in Section 2.1), the list of children linked to their account, and when each link was made. If a parent buys access for their child, we store the purchase code and which account redeemed it. 2.7 Notification preferences • Whether weekly reminders are enabled • The time of day you have selected for reminders • Your device time zone (used to schedule reminders correctly) • A push notification token for your device, so we can send you the notifications described in Section 5 2.8 Subscriptions, purchases and codes When you buy a subscription, the payment itself is handled by Apple (App Store), Google (Google Play) or, on the web, by Stripe. We never see or store your card details. We receive and store: • Which product you bought, where you bought it (App Store, Google Play or the web), its status (trial, active, cancelled, expired) and its renewal or expiry date • The store's transaction identifiers, which our subscription provider RevenueCat links to your user ID • Any registration key, coach code, offer code or club code you redeem or try to redeem, and when. If a code does not work, we also store the message the App showed you, so we can help. On iPhone, Apple does not tell us which code you entered: we only know that you opened the App Store code page and whether your access arrived • If your club pays for your access: the club's name and the status and dates of your club access 2.9 Messages, feedback and support requests If you submit feedback through the App, we store the contents of your message together with your user ID so we can improve the App and respond if needed. We also store: • Messages you exchange with your Coach Guardian, and messages you exchange with our nutritionist • Messages you send through the Contact Us form, together with any files you choose to attach (up to 25 MB) • Requests for a manual training plan • The email address you enter if you choose to share your progress with someone (for example your club coach) 2.10 Technical and diagnostic data The App uses Firebase services that may collect standard technical data such as: • Your device's IP address • Device type and manufacturer • Operating system and version • App version and language • An internal Firebase installation identifier • Basic crash diagnostics and performance metrics (Firebase Crashlytics) • Approximate time zone derived from your device • Which screens you open and which main actions you take in the App (Firebase Analytics, linked to your user ID) This information is processed by Google as our infrastructure provider (see Section 7). 2.11 Health data and your explicit consent Your height, your weight, your body fat percentage (if you add it) and the resting heart rate you measure with your phone camera are health data. We process them only with your explicit consent, which is separate from your acceptance of this Policy and our Terms of Use. • What we use them for: only to build your nutrition plan and to calculate your heart-rate training zones. We never sell them and never use them for advertising or marketing. • It is optional. You are asked when you enter these values during sign-up, and again if you later want to use a feature that needs them. If you say no, nothing you typed is saved, and your training works as normal; you just do not get a nutrition plan or heart-rate zones. • You can change your mind at any time in Profile → Personal Data → Health Data Consent. If you withdraw it, we immediately delete your height, weight, body fat percentage and heart-rate measurements, and the nutrition plan and heart-rate zones stop until you consent again. • Proof: we record whether you consented, when, and which version of the consent text you saw. • If you are 16 or younger, your parent or guardian must also give this consent; see Section 11.

To be clear, the App does not collect any of the following: • Your precise or coarse location (no GPS, Wi-Fi, or cell-tower location) • Your contacts, calendar, SMS, or call logs • Your microphone or audio recordings • Your photos or media library (the App only receives a file if you yourself choose to attach it to a Contact Us message) • Your browsing history outside the App • Advertising identifiers for ad targeting • Health data from Apple Health, Google Fit, or any other health platform • Your payment card details • Information about allergies, intolerances or medical conditions

The App requests access to your rear camera and flashlight for one purpose only: to let you measure your resting heart rate using a technique called photoplethysmography (PPG). When you start a heart-rate measurement: • You place your fingertip over the rear camera lens. • The App turns on the flashlight to illuminate your fingertip. • The camera streams low-resolution video frames only inside your device. • The App analyses brightness changes in the red channel of those frames in real time to detect the rhythm of your pulse. • After roughly 60 seconds, the App calculates a single beats-per-minute (BPM) value. Important: • No photos, videos, or raw camera frames are ever saved to your device's storage. • No photos, videos, or raw camera frames are ever uploaded, transmitted, or shared with our servers, with Google, with Apple, or with any third party. • The only thing that leaves the camera pipeline is the final BPM number, which is stored against your account so you can see your training zones. • The flashlight is used solely to improve the accuracy of the pulse signal. • You can deny or revoke camera permission at any time in your device settings. If camera permission is denied, you will not be able to use the THR feature, but the rest of the App will continue to work.

We use the information described above to: • Create and maintain your account and authenticate you on each launch • Generate and personalise your weekly training plan • Generate your weekly nutrition plan and shopping list, and adjust portions based on your feedback • Track your training progress, streaks, and completion history • Calculate and display your personalised heart-rate training zones • Show your nickname, avatar and score on the leaderboards • Let your Coach Guardian follow your progress and support you, and let our nutritionist answer your questions • Manage your subscription, trial, codes and club access, unlock the features you are entitled to, and help you when a code or a purchase did not work • Send you the notifications you have enabled (e.g. weekly plan reminder, RHR measurement reminders, a reminder before your trial ends, a new app version, messages from your Coach Guardian, and — after your subscription has ended — a small number of offers to come back) • Contact your parent or legal guardian, where applicable, to obtain parental consent if you are 16 or younger, to invite them to a parent account, and to let them know when a Coach Guardian has been assigned to you (and ask for their agreement to Coach Guardian communication) or when you share your nutrition plan with them • Send you service emails: for example a copy of your data when you request it, and one email offering help if you created an account but did not finish signing up • Show you information about KineticBANDS, our own training equipment used in the App's exercises, and stop showing it once you tell us you already have them or are not interested. Players under 18 see information about the product and its price, but never an offer or a link to buy it; offers and the order link are shown only to parents and to players aged 18 or older (we use your date of birth to tell which) • Respond to support requests and feedback you send us • Update your age automatically on your birthday, so your plan matches your age group • Understand how the App is used and fix crashes, so we can improve it • Detect, investigate, and prevent abuse, fraud, security incidents, and Terms-of-Use violations • Comply with applicable laws and lawful requests from public authorities We do not sell your personal information, and we do not use it for behavioural advertising.

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR / UK GDPR: • Performance of a contract — to provide the App's core features after you create an account, including training and nutrition plans, Coach Guardian support, and the subscription you bought. • Explicit consent (Article 9(2)(a) GDPR) — for your health data: height, weight, body fat percentage and resting heart rate (see Section 2.11). For users aged 16 or younger, this consent is given by a parent or guardian. • Consent — for camera access (THR feature), push and local notifications, and, where applicable, parental consent for minors, the parent's consent to Coach Guardian support, and your choice to share your nutrition plan with a parent. You can withdraw your consent at any time. • Legitimate interests — to keep the App secure, prevent abuse, and improve functionality, to send you a reminder before your trial ends, one help email if you did not finish signing up, and a small number of offers after your subscription has ended, and to show information about our own product, KineticBANDS, inside the App, in a manner that is balanced against your rights. You can object to these at any time (see Section 10). • Legal obligation — to comply with applicable laws and legitimate requests from authorities, including keeping records of purchases as required by tax and accounting law.

We use Google Firebase (provided by Google LLC / Google Ireland Limited) as our backend infrastructure, including: • Firebase Authentication — to manage sign-in with Google and Apple • Cloud Firestore — to store your profile, training, nutrition and heart-rate data • Cloud Functions (EU region, Belgium) — to generate plans, send emails and notifications, and process subscriptions • Firebase Hosting — to host this Privacy Policy and the App's web build • Firebase Storage — for limited media storage where applicable (for example files attached to Contact Us messages) • Firebase Analytics — basic usage and diagnostic information • Firebase Crashlytics — crash reports • Firebase Cloud Messaging — to deliver push notifications We also use: • RevenueCat (RevenueCat, Inc., USA) — to manage subscriptions and verify purchases; it receives your user ID and the store's purchase records, not your name or email • Apple App Store and Google Play — to process in-app purchases, under their own terms and privacy policies • Stripe (Stripe Payments Europe Ltd. / Stripe, Inc.) — to process payments made on the web • Resend (Resend, Inc., USA) — to deliver the emails the App sends (for example to parents, or your data export) • Vercel (Vercel Inc., USA) — to host our website • Supabase (Supabase, Inc.) — to store orders and club requests made on our website, in the EU (Ireland) • Sanity (Sanity AS, Norway) — to manage the content of our website; it holds no user data Your App data (your account, profile, training, nutrition and heart-rate data, and files you attach to Contact Us messages) is stored in Google Cloud data centres in the European Union, and our Cloud Functions run in Belgium. Some of our service providers may process data in countries outside your country of residence, including the United States. Where required, transfers of personal data outside the EEA / UK are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework. The same applies to the other providers listed above. We may also receive limited information from: • Google Sign-In (Google LLC) — for authentication • Apple Sign in with Apple (Apple Inc.) — for authentication • Google Fonts (Google LLC) — for typography • YouTube (Google LLC) — for embedded training videos These providers process the technical data needed to deliver their services in line with their own privacy policies. We do not share your personal data with advertisers, data brokers, or any other third party for marketing purposes.

Your data is visible to you. Beyond that, only the following people can see parts of it, and only for the reason given: • Your Coach Guardian (if one is assigned to you) — a coach we have authorised to support you. They can see your name, nickname and date of birth, where you are in your programme (season and week), your training streaks, when you last trained and last opened the App, whether your access is active, and the messages you exchange with them. They do not see your test results, heart-rate data, body measurements, nutrition plan, email address or phone number. For users aged 16 or younger, we ask a parent or guardian to agree to communication between the Coach Guardian and their child; if the parent agrees, the Coach Guardian can also see the parent's name, email address and phone number, so they can reach the parent if needed. • Our nutritionist — sees the questions you send in the nutrition chat and answers them, together with authorised members of our team. Your parent cannot see this chat. • Your parent or guardian (if they have a parent account linked to you) — sees your first name, nickname and avatar, your weekly nutrition plan and shopping list, and their own Parent Library. They never see your training progress, daily training, weekly plan, test results, heart-rate data, or your chats with your coach or nutritionist. Details are in Section 11. • Your club (if your club pays for your access) — the club's contact person sees your name, whether your access is set up, waiting for a parent or active, and the date it was activated. Your club never sees your email address or your training data. • Other users — the leaderboards show your nickname, avatar, score and streak statistics. They do not show your real name or email. • People you choose to share with — if you use "Share progress" and enter someone's email address, we send them a summary of your progress. Nothing is sent unless you do this yourself. • Our team — a small number of authorised Perfect TRAINING staff can access accounts when needed to provide support, investigate problems or fulfil legal obligations. For new accounts, our team also keeps a short internal follow-up record (a status, for example whether we have contacted you, and a note) so we can help you get started. It is included when you request a copy of your data and is deleted together with your account.

We keep your personal data for as long as your account is active. If you ask us to delete your account, we will delete your personal profile, training history, nutrition plans, messages and heart-rate measurements within a reasonable period, except where we are required to retain certain information to comply with legal obligations, resolve disputes, or enforce our agreements. You can delete your account yourself at any time in the App (Profile → Privacy & Legal → Delete Account). This permanently removes your account, your profile and everything linked to it, including your leaderboard entries and links to a parent account. You can also ask us to do it by writing to support@perfecttrainingapp.com from the email address associated with your account. In addition: • If you create an account but do not finish onboarding, and you have no subscription or code, the account is deleted automatically after 30 days. • When an account is deleted, we keep a pseudonymised record (a one-way hash of the email address, never the address itself) of any consent or parental approval that was given, for 24 months, so we can prove that consent was obtained. It is then deleted automatically. • If you withdraw your health-data consent, your height, weight, body fat percentage and heart-rate measurements are deleted straight away, even if you keep your account. • Records of purchases and payments are kept for as long as tax and accounting law requires. • Subscription records held by Apple, Google, Stripe and RevenueCat are kept according to their own retention policies.

Depending on where you live, you may have some or all of the following rights regarding your personal data: • Access — get a copy of the personal data we hold about you. • Rectification — correct inaccurate or incomplete information. • Erasure ("right to be forgotten") — ask us to delete your personal data. • Restriction — ask us to limit how we use your data. • Portability — receive your data in a structured, commonly used format. • Objection — object to processing based on legitimate interests, including information about our own products. For KineticBANDS, simply tap "Not interested" on the card, or write to us. • Withdrawal of consent — where processing is based on consent. • Complaint — lodge a complaint with your local data protection authority. In Slovenia, this is the Information Commissioner of the Republic of Slovenia (IP RS, www.ip-rs.si). Two of these you can do yourself in the App, under Profile → Privacy & Legal: "Request My Data" emails you a copy of your data, and "Delete Account" deletes your account. You can turn notifications off at any time in your device settings. To exercise any other of these rights, contact us at support@perfecttrainingapp.com. We will respond within the time limits required by applicable law.

The App is intended primarily for youth athletes. We treat users aged 16 or younger as minors who require parental or guardian consent before they can fully use the App. When a user indicates an age of 16 or younger during onboarding: • The App asks the user to provide a parent or guardian's email address. • We use that email address to communicate with the parent or guardian about their child's use of the App: to obtain their approval, to invite them to a parent account, and to tell them when a Coach Guardian has been assigned and ask for their agreement to Coach Guardian communication, to tell them when their child shares a nutrition plan with them, to remind them on the third and tenth day if they have not yet answered our approval request, and to let them know two days before their child's free access ends. We do not use it for advertising. If you agree to Coach Guardian communication, your child's Coach Guardian can see your name, email address and phone number, so they can reach you if needed. • Until parental consent is recorded, access to the App's features may be limited. Parent accounts. A parent or guardian can create their own account in the App using the parent access code we send them by email. A child can be linked to up to two parent accounts. A parent account shows: • the child's first name, nickname and avatar; • the child's weekly nutrition plan and shopping list (so the parent can shop and cook); • the Parent Library, with articles for parents; • information about KineticBANDS, with the price and the order link, and whether the child has said they already have them. A parent can also mark that the child has them, and the child will no longer see the card. A parent account never shows the child's training progress, daily training, weekly plan, test results, heart-rate data, or the child's chats with a coach or nutritionist. We may switch off the nutrition or Library view for a parent; we cannot switch on anything from the "never" list. When an athlete aged 17 or older shares their nutrition plan with a parent, the same rules apply. Health data of children. For a user aged 16 or younger, a parent or guardian must give explicit consent before we use the child's height, weight, body fat percentage and resting heart rate (see Section 2.11). The parent can give it on the approval page, where it is a separate, optional checkbox, or later through a one-click link the child can send them from the App ("Ask my parent"). Until the parent consents, no nutrition plan is built for the child; training works as normal. When the parent consents, the plan for the current week is built straight away. A parent can withdraw this consent at any time by writing to parents@perfecttrainingapp.com, and we will delete these measurements. If you are 16 or younger and we change this Policy in a way that affects how we use your data, we will ask your parent or guardian to approve the new version again. If you are a parent or legal guardian and you believe that your child has provided personal information to us without your consent, please contact parents@perfecttrainingapp.com and we will promptly delete the relevant information.

We use industry-standard measures to protect your personal information, including TLS encryption in transit, encryption at rest on Google's infrastructure, and Firebase Security Rules that restrict who can read or write specific records. Despite these measures, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. When we do, we will update the version number and effective date at the top of this page and, where the changes are material, notify you in the App or by email. When a change is material, the App will show you the new version and ask you to accept it before you continue. If you are 16 or younger, we will also ask your parent or guardian to approve it. If you do not accept, you can delete your account at any time.

This Policy also covers our website, perfecttrainingapp.com. The website collects data only when you use one of the following: • Shop (KineticBANDS): your name, email address, phone number and delivery address, so we can deliver your order. Payment is handled by Stripe; we never see your card details. Orders are stored with Supabase in the EU (Ireland). • Club orders and the club portal: the club's name, country and VAT number, and the name and email address of the club's contact person. In the club portal, the contact person can also have us email each player their personal club code: the club gives us the player's email address (often a parent's) and, if it wishes, a first name. We use them only to send that one email, which is delivered by Resend and whose replies go straight to the club. We do not keep the address or the name once the email has been sent; we only record that the code was sent, and when. • Forms: the Founding Club and Player Ambassador applications (for a player aged 16 or younger, with a parent's or guardian's consent) and the contact form store what you enter in them, so we can reply. • Parent pages: the parent approval page and the parent health-data consent page record the parent's choices, as described in Section 11. • Club players joining online: if your club gives you a join link, you sign in on the website with Google or Apple, and we store the same account data as in Section 2.1. Cookies. Our website does not use analytics or advertising cookies. The only cookie it sets is a sign-in cookie for our own staff area. If we ever add analytics or advertising cookies, we will ask for your consent first. Our hosting provider (Vercel) processes standard technical data, such as your IP address and browser type, to deliver the website and keep it secure.

If you have any questions or concerns about this Privacy Policy or your personal data, please contact us at: • Support: support@perfecttrainingapp.com • Parental consent: parents@perfecttrainingapp.com