Banot app privacy policy

Last updated: 2 September 2026

This is a translation of the Spanish policy, which prevails if the two ever differ.

This policy covers the Banot apps — iPhone, iPad, Apple Watch, Apple TV, Android, Android TV and the web app — and the Drimiun Banot sensor. The mailing list on this website has its own policy, a shorter one, because it only handles an email address.

Who processes your data, and in what role

Drimiun Wireless Systems SL, tax ID B38950770, registered at Calle Quintíon Benito, 31 — La Laguna — Tenerife, Spain ("drimiun"). You can write to us at drimiun@drimiun.com.

There are two different relationships here, and telling them apart matters because it decides who you complain to:

• Your account is ours to answer for. Your identifier, your email, your settings and any crash reports you send us we process on our own account, to provide the service to you.
• The athletes' data belongs to the club. Who gets measured, what for and for how long is decided by the club or the coach using Banot, not by us. For that data drimiun acts as a processor (GDPR art. 28): we store and process it on the club's documented instructions and never for our own purposes. If you are an athlete measured with Banot, your club is who to approach first.

If you are a club and need a signed data processing agreement for your own records, email us and we will send you one.

What the apps collect

Nearly all of this lives on your device. It only leaves if you sign in and turn on sync, and the video only if you also upload it.

• Account identifier. The identifier Firebase Authentication creates when you sign in with Apple or Google, and which provider you chose. We also use an anonymous session, with no name and no email, to download the sensor's firmware updates.
• Names. The name of every athlete you add, of the club, and of the protocols, comparisons and equipment you create. The athlete's name also appears on the scoreboard and in the PDF reports you export.
• Email addresses. Your account's; the athlete's, if you fill it in, so reports can be sent and so they can be invited to the club; and the legal guardian's when their consent is recorded (see "Under-16s").
• The athlete's phone number. Optional, and only to send them their results by messaging. The app works entirely without it.
• Sports measurements. The heart of the product: distances, times, speeds, accelerations, splits, reaction time, step cadence, the force-velocity model and the distance series the LiDAR measures. Plus what is needed to compute them: body mass, leg length, and the load — sled, vest, hill — the run was done under.
• Video. The video of the run, which films an identifiable person. It stays on the device unless you upload it. If you turn on the copy to the camera roll, it is also saved to the system photo library, which is yours and not ours.
• Audio and other content. The video's audio track — which is where the starting gun is detected — the sound envelope kept so it can be detected again, the club logo if you upload one for your reports, and any notes and descriptions you write.
• Crash reports. If the app quits unexpectedly: where in the code it happened, the device model, the OS version and an installation identifier. They carry neither your data nor your athletes'. You can turn them off in Settings › Privacy.
• Usage statistics. Which screens are opened and which features are used. They ship switched off and are collected only if you turn them on yourself in Settings › Privacy.

We do no advertising tracking. The apps carry no advertising identifiers, do not combine your data with other companies', and neither sell nor share it for commercial purposes.

The permissions the app asks for, and why

Each is asked for at the moment it is needed, and refusing one disables that feature without breaking the rest.

• Camera. Records the run's video in sync with the LiDAR data. You can still measure without it: what you lose is the video.
• Microphone. Records the video's audio, which is where the starting gun is detected.
• Add to photo library. Only to save a copy of the video you have just recorded. The app does not read or enumerate your library.
• Bluetooth. The only way the app talks to the Drimiun Banot sensor: discovering it, pairing, receiving measurements and updating its firmware. We do not use it to locate you or to detect third-party beacons.
• Local network. The "Nearby" scoreboard sends results straight from the capturing device to the displaying one, without going through the internet. The data does not leave your network.

Why we process it, and on what legal basis

• Providing the service — measuring, analysing, syncing between your devices, running your club: performance of the contract you accept by using the apps (GDPR art. 6(1)(b)).
• Athlete data: the legal basis is the club's to determine, as controller. We process it on their instructions (art. 28).
• Crash reports: our legitimate interest in the app not quitting in the middle of a session (art. 6(1)(f)). It is the only processing that is on without asking you, which is why it is one switch away from off.
• Usage statistics: your consent (art. 6(1)(a)), given by turning the switch on and withdrawn by turning it off. It ships off.
• A minor's guardian consent: GDPR art. 8.
• Billing and tax obligations, if you take a paid plan: the contract and compliance with a legal obligation (art. 6(1)(c)).

Health data: we do not collect it

The apps do not read Apple Health or Google Fit, ask for no health data access, and record no heart rate. An earlier version of the watch app did read it; it was withdrawn before launch, and no released version collects it.

That claim is checked automatically: our continuous integration rejects any change that reintroduces health data access into the apps. It does not depend on anybody remembering.

Sports measurements — times, speeds, power — are not health data in the sense of GDPR art. 9: they describe a performance, not a state of health. We treat them with the same care anyway, because they identify a specific person.

Under-16s

Youth athletics measures children, so this is the ordinary case here rather than a rare one.

Each athlete's record accepts a date of birth. If they are under 16, the app asks for and stores the legal guardian's consent: who gave it, at which email address, and when. We use 16 — rather than the 14 Spanish law allows — because it is the strictest threshold in the European Union, so there is one rule for every country instead of a table.

What the app does and does not do. The app provides the mechanism to ask for that consent and leave it on record; obtaining it is the club's responsibility, as the party that knows the family and answers as controller. The app does not technically prevent measuring a minor without that record, in the same way a camera does not prevent filming: the decision, and the responsibility, belong to whoever is holding the equipment.

If you are a parent or guardian and want to know what is stored about your child, or have it deleted, write to drimiun@drimiun.com and we will handle it with the club.

Where the data sits, and what leaves the European Union

All of Banot's cloud is Google Cloud / Firebase. It is not all in Europe, and we would rather say so with the region names than with a reassuring sentence:

• Main database (Cloud Firestore) — region eur3, European Union. Athletes, takes, clubs, protocols and comparisons live here: everything except the video.
• Processing servers (Cloud Functions) — europe-west1, Belgium.
• Video store (Cloud Storage) — us-east1, United States. This is where any video you upload is kept, along with its converted renditions and the sensor's firmware.
• Internet scoreboard (Realtime Database) — us-central1, United States. While a scoreboard is published, the names and times it shows pass through there. The node is deleted when the session ends.
• Authentication (Firebase Authentication) — Google's global infrastructure.

Those two transfers to the United States rely on Google LLC's certification under the EU-US Data Privacy Framework and, in the alternative, on the European Commission's standard contractual clauses, which form part of our contract with Google (GDPR art. 46).

If you would rather nothing left the European Union, there is a way to arrange that today: do not upload video, and use the "Nearby" scoreboard, which runs over your local network. Everything else then stays in eur3.

Who else processes it

• Google Ireland Limited / Google LLC — all the cloud infrastructure described above, plus crash reports (Crashlytics) and, if you switch them on, usage statistics (Analytics).
• Apple Inc. and Google LLC, as app stores — if you buy a paid plan inside the app, the store processes the payment, not us. They act as independent controllers of the payment data, which never reaches drimiun: we only receive confirmation that the subscription is active.
• UAB MailerLite (Lithuania) — this website's mailing list only. The apps send it nothing.

If we change providers or add one, we will update this list and give advance notice to clubs holding a signed processing agreement.

How long we keep it

• As long as you want it. Takes, athletes and clubs are kept until you delete them or delete your account. They do not expire on their own.
• When you delete your account, from Settings › Account, your documents and your video are removed from our servers and the user is deleted. Backups rotate and are gone within 90 days at the latest.
• Internet scoreboard: the node is deleted when the scoreboard session ends, and the code stops meaning anything.
• Crash reports and statistics: Crashlytics' and Analytics' own retention periods, currently 90 days and 14 months respectively.
• Billing: invoices are kept for as long as Spanish tax law requires.

If a paid plan ever carries its own retention rule for video, it will be written into that plan's terms and we will tell you before it applies. There is none today.

Your rights

You can ask us for access to your data, its rectification or erasure, restriction of or objection to its processing, and its portability, by writing to drimiun@drimiun.com. We answer within one month.

Two of these you can do yourself without writing to us: delete your account from Settings › Account, and export any take as PDF or CSV from the app itself.

If you are an athlete whose data was entered by a club, approach them first: they are the ones who decide about it. We will help them answer you, and if that fails, write to us anyway.

If you think we have not handled your request properly, you can complain to the Spanish Data Protection Agency, or to the supervisory authority of the EU country where you live.

Security

• Everything travels encrypted over TLS, and is stored encrypted at rest on Google's servers.
• Access to each piece of data is decided by a rule on the server, not by the app: even a modified app could not read the data of a club it does not belong to.
• The sensor's firmware is cryptographically signed, and the device itself refuses any update that is not.
• How to report a security problem to us is published in our disclosure policy.

Changes to this policy

If something that affects you changes — a new purpose, a new provider, a new destination — we will publish it here with its date and tell you inside the app before it takes effect. The Spanish version governs.

This covers the apps. The terms of use are separate.