Privacy Policy

Last updated: 12 September 2026

1. About this Privacy Policy

This Privacy Policy explains how MX Tech AI collects, uses, stores and shares personal data when you use the MX Tech AI mobile application, our website, support pages and related services (together, the “Service”).
The Service uses artificial intelligence to analyse motocross photographs and provide technique-related feedback. Please read this Privacy Policy before using the Service.

2. Who is responsible for your data?

The controller responsible for your personal data is:
Levi Lupo, trading as MX Tech AI
Enterprise number: 1040.807.723
VAT number: BE 1040.807.723
Email: support@mxtechai.com
Website: https://www.mxtechai.com
In this Privacy Policy, “MX Tech AI,” “we,” “us” and “our” refer to this controller.

3. Personal data we collect

3.1 Account, profile and progress data

Depending on how you create or access your account, we may process:

• your name and email address;

• a Firebase user identifier and account status;

• your chosen sign-in method;

• information supplied by Google Sign-In, such as your name, email address and profile image, within the permissions shown to you;

• information supplied by Sign in with Apple, such as your name and email address or Apple private relay email address;

• authentication, fraud-prevention and security data, such as sign-in timestamps, IP address, device or browser information and authentication logs; and

• app profile and progress information, such as onboarding-completion status, analysis counts and completion dates or day keys, streak status, achievement status and similar feature-progress information.

We do not receive your Google or Apple password. If you use email-and-password sign-in, Firebase Authentication processes your password for authentication. MX Tech AI does not have access to or store your password in readable form. 

3.2 Photographs and AI analysis data

When you request an analysis, we process:

• the motocross photograph you upload and any metadata technically included with it;

• the analysis options you select, such as the relevant riding view, technique or language;

• the AI-generated analysis, including scores, strengths, improvement opportunities, next steps and tips;

• computer-vision information derived from the photograph, such as pose landmarks, approximate body or joint positions, angles, visibility or confidence values, and hotspot or overlay coordinates used to generate the analysis;

• tips you choose to save;

• timestamps, processing status and internal identifiers; and

• limited technical logs needed to deliver, secure and troubleshoot the analysis.

We do not use facial recognition, do not attempt to identify the rider in a photograph and do not create biometric identity profiles. The Service is not intended to infer health information or other special-category data.
The current Service analyses still photographs. If we introduce video analysis or materially different data processing, we will update this Privacy Policy before that feature becomes available.

3.3 Onboarding quiz data

Your individual onboarding quiz answers are processed temporarily within the app to tailor the next onboarding page to you. They are not saved to your MX Tech AI account or backend database and are not sent to OpenAI for analysis.
If you consent to optional usage analytics, we may record that an onboarding screen or step was viewed or completed. We do not include your individual quiz selections, free-text content, photographs or AI analysis content in Analytics event names, event parameters or user properties.

3.4 Optional app-usage analytics

Firebase Analytics is included in MX Tech AI but optional Analytics collection is disabled until you give your consent. If you enable usage analytics, Google Analytics for Firebase may process automatically collected events and the limited custom events that we configure, including:

• pseudonymous app-instance, installation, Analytics, device or vendor identifiers, including an app-instance identifier and Apple’s Identifier for Vendor (IDFV), where available;

• app lifecycle and engagement information, such as first open, session start, app update, app engagement and screen or page views;

• interactions with app features, such as completing an onboarding step, opening a paywall, starting or completing an analysis flow, using a feature, changing a reminder preference or interacting with a notification;

• event timestamps and limited event parameters needed to understand the interaction;

• general device and app information, including device category or model, operating-system version, app version, platform and language, as well as approximate geographic information such as country, region and city-level location; and 

• notification delivery or opening events where these are made available by Firebase and Analytics collection is enabled.

Analytics data may be associated with a pseudonymous app or installation identifier. We do not deliberately send your name, email address, uploaded photographs, AI analysis content, saved tips, support messages or individual onboarding answers to Firebase Analytics as event parameters or user properties.
We do not use Firebase Analytics for third-party advertising, do not sell Analytics data and do not use it to track you across apps or websites owned by other companies. Advertising-related consent signals are configured as denied. We do not use Firebase Analytics for advertising or cross-app tracking.
Necessary technical, authentication, security and server information may still be processed even if optional Analytics is disabled. This may include technical request information, timestamps, device or browser information, app-version information, IP address and operational logs generated by our infrastructure or service providers.

3.5 Push notifications and training reminders

Firebase Cloud Messaging is integrated into the app and may generate or process certain app-installation, messaging and technical data when the app is installed or used. MX Tech AI may associate a push token with your account when notification functionality is initialised, when you sign in while notification permission is available, when you interact with notification settings or when you enable training reminders. Reminder preferences and schedules are created and used in accordance with your choices. 

Depending on how you use these features, we and our providers may process: 

• your Apple Push Notification service (APNs) token, Firebase Cloud Messaging (FCM) registration token and related app-installation identifier;

• the Firebase user identifier to which a token is associated in our database;

• token creation or refresh timestamps and device platform or type;

• device model, language, time zone, operating-system version, app identifier and app version where processed by Firebase for messaging;

• your reminder choice and status, such as enabled, disabled, denied or postponed;

• the date and time of your choice, preferred notification language and UTC offset;

• scheduling information, such as the next planned reminder, next weekend-related reminder, last reminder, reminder step and notification schema version;

• limited progress information needed to decide whether to suppress or reschedule a reminder, such as whether and when an analysis was completed; and

• notification title, message, target account reference, dispatch timestamp, platform, delivery-processing status and number of messages accepted for sending.

We use this information to schedule and deliver optional training reminders at an appropriate local time, avoid reminders when the relevant conditions are not met, prevent inappropriate repeated sends and troubleshoot delivery. The content of your photograph and AI analysis is not included in these reminders or in the scheduling decision.

Notifications are delivered through Firebase Cloud Messaging and Apple Push Notification service. A push token identifies an installed app instance for delivery purposes; it is not your telephone number or Apple Account password. We do not use push tokens for third-party advertising.

3.6 Subscription and purchase data

Subscriptions are purchased through the Apple App Store. Apple processes your payment details. We do not receive or store your full payment-card details.
We use RevenueCat to manage subscription access. RevenueCat and our systems may process:

• an anonymous or account-linked app-user identifier;

• product and entitlement identifiers;

• subscription status, trial status, renewal and expiry dates;

• store, receipt and transaction identifiers;

• purchase, cancellation, renewal and billing-status events; and

• general subscription-customer metadata, such as country or region and first-seen or last-seen timestamps, where made available by RevenueCat or the App Store.

3.7 Support and communications

If you contact us, we process your name, email address, message, attachments and any other information you choose to provide, together with information needed to investigate and answer your request.

4. How we obtain your data

We receive personal data:

• directly from you when you register, upload a photograph, save a tip, choose settings, give or withdraw consent, enable reminders or contact us;

• automatically from the app, website, device and servers when you use the Service;

• from sign-in providers such as Apple and Google;

• from another user who uploads a photograph in which you are identifiable, where permitted; 

• from Firebase, Google Cloud, Firebase Analytics, Firebase Cloud Messaging and Apple Push Notification service in connection with app operation, analytics and notification delivery; and

• from Apple and RevenueCat in connection with subscriptions and entitlements.

5. Why we use your data and our legal bases

We use personal data for the following purposes and legal bases:

Create and secure your account and provide sign-in
Main data: Account and authentication data
Legal basis: Performance of our contract with you

Track your progress, streaks and achievements
Main data: Profile, analysis-progress, streak and achievement data
Legal basis: Performance of our contract with you

Process a photograph uploaded by a user that depicts another person

Main data: Photograph and derived analysis data

Legal basis: The legitimate interests pursued by us and the uploading user in providing the requested analysis, provided that those interests are not overridden by the rights and freedoms of the person depicted and that the uploading user is authorised to submit the photograph.

Process uploaded photographs and deliver AI feedback
Main data: Photograph, selected analysis options, generated analysis and technical data
Legal basis: Performance of our contract with you

Store your analysis history and saved tips
Main data: Account, analysis and saved-tip data
Legal basis: Performance of our contract with you

Manage subscriptions and feature access
Main data: Account, entitlement and transaction data
Legal basis: Performance of our contract with you

Personalise the next onboarding page temporarily
Main data: Temporary onboarding choices
Legal basis: Performance of our contract, or steps taken at your request before entering into a contract

Measure and improve use of the app when you enable optional Analytics
Main data: App-instance identifiers, app and device information, screen views, feature interactions, event timestamps and notification interactions
Legal basis: Your consent

Schedule and deliver training reminders when you enable them
Main data: Account reference, push tokens, device and app information, reminder settings, local-time information, analysis-completion timing, schedule and delivery records
Legal basis: Your consent

Maintain notification functionality and token associations

Main data: App-installation identifier, push token, account reference and limited device and messaging data

Legal basis: Our legitimate interests in maintaining reliable notification infrastructure, keeping device-token associations accurate, preventing notification misdelivery and troubleshooting delivery. We do not schedule or send MX Tech AI training reminders unless you enable them.

Record and respect your privacy and notification choices
Main data: Consent or preference status and relevant timestamps
Legal basis: Compliance with our legal obligations and our legitimate interests in demonstrating and respecting your choices

Protect accounts, prevent fraud and abuse, maintain reliability and troubleshoot errors
Main data: Authentication, device, security and server-log data
Legal basis: Our legitimate interests in providing a secure and reliable Service

Respond to support requests
Main data: Contact and support data
Legal basis: Performance of our contract, or our legitimate interests in assisting users

Keep required financial, tax and legal records and respond to lawful requests
Main data: Relevant account and transaction records
Legal basis: Compliance with legal obligations

Establish, exercise or defend legal claims
Main data: Relevant records
Legal basis: Our legitimate interests and applicable law

Where we rely on consent, you may withdraw it at any time without affecting processing that took place before withdrawal. Where we rely on legitimate interests, we balance those interests against your rights and reasonable expectations.

5.1 Data required to provide the Service

Except where stated otherwise, you are not legally required to provide personal data to MX Tech AI. However, certain personal data is contractually necessary to provide features you request. Relevant account and authentication data is necessary to create and secure an account; a photograph and the required analysis inputs are necessary to perform a photo analysis; and subscription and entitlement information is necessary to determine access to paid features. If you do not provide the data required for a particular feature, we may be unable to provide that feature.
Optional usage analytics and training reminders are not required to use the paid features of the Service. Information you voluntarily include in support messages is also optional.

6. Artificial-intelligence processing

To generate an analysis, the selected photograph and necessary analysis instructions are transmitted securely to our backend and to OpenAI’s API. The AI returns technique-related feedback, which is then made available in the app and may be stored in your account history.
According to OpenAI’s API data practices, data submitted through the OpenAI API is not used to train or improve OpenAI models unless the API customer explicitly opts in to such data sharing. MX Tech AI does not opt in to sharing API inputs or outputs for model training. MX Tech AI configures optional API response storage as disabled where supported. OpenAI may nevertheless retain certain customer content and related metadata in abuse-monitoring logs for up to 30 days by default, unless longer retention is required by law or reasonably necessary to protect OpenAI’s services or third parties, or unless different approved data-retention controls apply.
AI-generated output may be incomplete, inaccurate or unsuitable for your circumstances. It is provided for general informational and educational purposes and is clearly identified as AI-generated. It is not a professional coaching, medical or safety assessment. MX Tech AI does not use AI to make decisions that produce legal or similarly significant effects about you.

7. Analytics, notifications and your choices

7.1 Optional usage analytics

Optional Firebase Analytics collection is disabled until you make an affirmative choice to allow it. You can later enable or disable usage analytics in the app’s profile settings. Disabling it stops MX Tech AI from intentionally collecting new optional Analytics events from that point onward, but does not affect processing that occurred before you withdrew consent.
Disabling Analytics does not immediately delete data already received by Google Analytics. Previously collected user-level and event-level data remains subject to the retention period described in Section 10, while aggregated or anonymised reporting may remain available for longer. Data that has already been irreversibly aggregated or anonymised may no longer be personal data and may not be capable of individual deletion. You may contact us if you wish to exercise a data-protection right concerning identifiable Analytics data.

7.2 Optional training reminders

Training reminders are optional. You can allow, postpone or decline them when prompted and can later enable or disable them through the app’s profile settings. You can also revoke the iOS notification permission in your device settings.
Disabling training reminders in the app stops future MX Tech AI training reminders and removes the active reminder schedule from your MX Tech AI account. Revoking permission only in iOS may prevent display of notifications but may not immediately update the preference stored in your MX Tech AI account; you can also switch reminders off in the app to update that preference.
When you successfully log out, we attempt to remove the current device’s push-token association from the account before completing logout. When you log back in with notifications permitted, the current token may be associated with that account again. Push tokens can change, for example after reinstalling the app, and providers may separately invalidate old tokens.
Your choices about Analytics and training reminders are separate. Refusing either optional feature does not prevent you from using the Service’s paid core features.

8. Who receives personal data?

We do not sell your personal data. We do not use or share your personal data for targeted advertising. We share data only as needed with the following categories of recipients:

• Google/Firebase and Google Cloud, for authentication, database, storage, serverless functions, cloud processing, Firebase Analytics, Firebase Cloud Messaging, security and operational logging;

• OpenAI, to generate the requested AI analysis;

• RevenueCat, to manage subscription entitlements and purchase status;

• Apple, for Sign in with Apple, App Store distribution, subscriptions, payments, Apple Push Notification service and related support;

• Google, where you choose Google Sign-In and for website or support-page hosting where applicable;

• professional advisers, insurers, auditors or authorities where reasonably necessary to comply with law, protect rights or handle claims; and

• a buyer, successor or restructuring party if the business is sold or reorganised, subject to appropriate confidentiality and data-protection safeguards.

Any third party with whom we share user data must provide the same or an equivalent level of protection as described in this Privacy Policy and required by applicable law and applicable platform rules. Where a provider acts as our processor, it may process personal data only for the relevant services, on our documented instructions or as otherwise permitted by applicable law. 

9. International transfers

Some recipients or their systems may be located outside the European Economic Area. Where personal data is transferred to a country that has not been recognised as providing an adequate level of protection, we use an approved transfer mechanism, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where appropriate. Providers may also rely on an applicable adequacy decision, including the EU–US Data Privacy Framework where valid and applicable. A copy of the relevant safeguards may be requested by emailing us, subject to lawful redactions.

10. How long we keep data

We keep personal data only for as long as needed for the purposes described above:

• account, profile and progress data is generally kept while your account remains active;

• uploaded photographs, analyses and saved tips are kept until you delete the relevant item or your account, unless temporary retention is required for security, legal or operational reasons;

• when a stored photograph is deleted from active Cloud Storage, Google Cloud’s soft-delete feature may retain a recoverable copy for up to seven days under our current bucket configuration before permanent deletion; 

• temporary onboarding quiz answers are not stored in your MX Tech AI account or backend database and are used only temporarily during onboarding;

• your Analytics preference is stored locally on or associated with your device so that the app can remember and apply your choice. It is retained until you change it or the relevant app or device data is cleared. Depending on the relevant iOS storage and backup behaviour, the preference may remain available after reinstalling the app. Analytics event data collected after consent is retained separately as described in the following bullet; 

• user-level and event-level data in Google Analytics is subject to a configured retention period of no more than 14 months; certain aggregated or anonymised reporting may remain available for longer;

• MX Tech AI push-token records are kept while needed to support notification functionality. Disabling training reminders removes the active reminder schedule and stops the token from being used for MX Tech AI training reminders, but may not itself delete the stored token record. We attempt to remove the current device’s token association on successful logout, and account-linked token records and reminder schedules are deleted when the account is deleted, subject to the exceptions below; 

• account-linked notification dispatch records may be retained while the account is active to prevent duplicate sends and troubleshoot delivery, and are deleted when the account is deleted, subject to the exceptions below;

• Firebase and Apple may retain installation identifiers, invalidated tokens, delivery information or service data in accordance with their own technical deletion cycles and legal obligations;

• OpenAI API abuse-monitoring logs are normally retained for up to 30 days, subject to the exceptions and different approved retention controls described in Section 6;

• routine application and service logs stored in Google Cloud’s _Default log bucket are normally retained for 30 days; certain mandatory Google Cloud audit logs are retained for 400 days;

• support communications are retained only for as long as reasonably necessary to respond to your request, provide support, maintain appropriate business records, resolve disputes or comply with legal obligations; and

• transaction, tax and accounting records are retained for the statutory period, generally up to ten years where Belgian law requires it.

After deletion from active systems, limited residual copies may remain temporarily in encrypted backups or provider deletion queues. These copies are isolated from ordinary use and are deleted or overwritten according to the applicable backup cycle and the relevant provider’s contractual deletion process. Apple, RevenueCat and other providers may retain or process transaction-related records where required or permitted under their respective roles, contractual arrangements or applicable law.

11. Security

We use reasonable technical and organisational safeguards appropriate to the nature and risk of the data, including access controls, authenticated requests, encrypted network connections, restricted service credentials, storage rules, monitoring and provider security controls. No internet service can guarantee absolute security. You are responsible for keeping your sign-in credentials and devices secure and for notifying us promptly if you suspect unauthorised access.

12. Your data-protection rights

Under applicable data-protection law, you have the following rights, subject to the conditions and exceptions provided by law: 

• request access to your personal data and a copy of it;

• correct inaccurate or incomplete data;

• request deletion of personal data;

• restrict processing;

• object to processing based on legitimate interests;

• receive data you provided in a structured, commonly used and machine-readable format, and ask that it be transmitted where technically feasible;

• withdraw consent at any time; and

• lodge a complaint with a data-protection authority.

To exercise a right, email support@mxtechai.com. We may ask for information reasonably necessary to verify your identity. We normally respond within one month, although the law may permit an extension for complex or numerous requests. Exercising your rights is generally free of charge, but we may charge a reasonable fee or refuse a manifestly unfounded or excessive request where the law permits.
You may also complain to the Belgian Data Protection Authority:
Data Protection Authority / Gegevensbeschermingsautoriteit
Rue de la Presse 35, 1000 Brussels, Belgium
https://www.dataprotectionauthority.be
If you live elsewhere, you may also contact your local supervisory authority.

13. Deleting an analysis, saved tip or account

You can delete individual analyses and saved tips in the app. Deleting an analysis removes the analysis record and its corresponding stored photograph from active MX Tech AI systems, subject to the limited backup, provider and legal-retention periods described above.
You can also initiate account deletion in the app. Account deletion removes your MX Tech AI authentication account, profile, analyses, saved tips, uploaded photographs, account-linked notification preferences, reminder schedules, stored push-token documents and account-linked notification dispatch records from active MX Tech AI systems, except for records we must retain by law or reasonably need for security, fraud prevention or legal claims.
Disabling optional Analytics stops future optional collection. Analytics data that has already been irreversibly aggregated or anonymised cannot be associated with an account and therefore cannot be individually deleted. Where identifiable Analytics data remains and applicable law gives you a deletion right, you may contact us using the details in Section 18.
Deleting your MX Tech AI account does not cancel an Apple App Store subscription. You must separately cancel the subscription through your Apple subscription settings to prevent future renewal charges. Deleting the app from your device also does not cancel a subscription.

14. Children and young users

MX Tech AI is not intended for children under the age of 13. If you are under 13, you must not create an account or use the Service.
If you are aged 13 to 17, you may use the Service only with the permission or supervision of a parent or legal guardian where required by applicable law.
Parents and guardians should supervise the use of motocross-related information and AI feedback. If we learn that we have collected personal data from a child in circumstances where the required authorisation was not obtained, we will take reasonable steps to delete it. A parent or guardian may contact support@mxtechai.com regarding a child’s data.

15. Photographs of other people

Do not upload a photograph of another identifiable person unless you have a lawful basis and all permissions needed to do so. For photographs of a child, permission must be obtained from the child’s parent or legal guardian where required. Do not upload content that is private, unlawful, unsafe or unrelated to the intended motocross-analysis purpose.

If a photograph depicts another identifiable person, you must ensure that the person depicted—or their parent or legal guardian where applicable—has been appropriately informed, including by making this Privacy Policy available where required, and that you have a valid legal basis and all necessary permissions before uploading the photograph. 

16. Website and cookies

Our website and legal or support pages are hosted using Google Sites. Google may process technical information and use cookies or similar technologies in connection with hosting, security, functionality, preferences and measurement of its services, in accordance with Google’s applicable privacy and cookie notices.
MX Tech AI does not currently add its own website Analytics, advertising pixels or marketing cookies. If that changes, we will update this notice and request consent where required.
Third-party pages you visit, including Apple, Google, payment or support pages, are governed by their own privacy notices.

17. Changes to this Privacy Policy

We may update this Privacy Policy when the Service, providers or legal requirements change. We will post the updated version with a new “Last updated” date and, where a change materially affects your rights or how we use data, provide an appropriate additional notice in the app or by email. Where the law requires consent for a new purpose, we will ask for it before beginning that processing.

18. Contact

Questions, requests or complaints about privacy can be sent to:
MX Tech AI — Levi Lupo
Email: support@mxtechai.com
Website / Support: https://www.mxtechai.com