Photography, Video and Image Use Policy

Why we film at all

A sailor almost never sees their own boat. They feel a bad tack; they do not see the bow lift, the late weight shift, or the sheet coming in a second too early. Video is one of the few tools that closes that gap, and a still photograph of a gate rounding can settle an argument a coach and a sailor have been having for a month.

That is the whole reason photography and video exist in SailCoach. Footage is a coaching tool. It is not a marketing library, it is not a highlights reel, and it is not a record of what a child looks like.

This policy explains what gets captured, who can see it, the rules coaches must follow when they film, the rules for parents and spectators, and how to get an image or a video removed.

It sits alongside our Privacy Policy, our Safeguarding Policy and our Code of Conduct.

What we capture and store

Two things about that list are worth saying plainly.

Annotations are commentary about a specific child's behaviour. "Late" with an arrow on a tiller at 04:12 is a judgement about a named sailor, and we treat it as seriously as we treat any written coaching note. The rules in our Code of Conduct about what a coach writes in a note apply equally to what a coach draws and types on a video.

We do not run face recognition, and we never will as this product is built. We do not analyse images to identify people, we do not build face templates, and we do not generate biometric data. A sailor in our system is identified by their account, their sail number or a coach naming them — never by a computer looking at their face.

We also do not send photographs or video to any artificial-intelligence service. Our AI features read text only. See our AI and Automated Decisions Policy for what those features do.

Who can see an image or a video

This is an area where the platform is genuinely strong, and we want to describe it precisely rather than generally.

• All media lives in a private storage bucket. No file is world-readable. There is no public link, no public content-delivery URL, and no "anyone with the link can view" mode anywhere in the product.
• Every view is served through a short-lived signed link. When someone with permission opens a photo or a video, our servers mint a temporary URL that stops working after a short period — one hour for video and note attachments, four hours for photos. Copying that URL and sending it to someone else buys them hours at most, not permanent access.
• A link is only minted after an access check on the record the file belongs to — the note, the session or the event — not on the file reference itself. That is deliberate: a sailor and their parent have to be able to watch a video their coach uploaded, which is a file that is not theirs. Separately, the server refuses to store a file reference that does not sit under the uploader's own prefix, which blocks the common failure where someone borrows another person's file reference and gets a working URL back.
• We only accept real media formats. The upload path accepts images, video, audio and PDF. It rejects HTML and SVG, which can carry scripts.
• An automated check in our build pipeline verifies this. Our test suite covers every route in our main API that can hand out a media link, and a continuous-integration guard fails the build if a new one is added without being covered. We do this because access control that is correct today quietly stops being correct as code changes. That guard reads our main API only; the administration console and the authentication service are not yet covered by it, and extending it is recorded in our Security Policy.
• Nothing is indexed by search engines. Our robots file blocks crawlers from every signed-in area, our sitemap excludes them entirely, and a coach's public profile page never names the sailors they coach.

Within that private boundary, who sees what depends on the note:

• A coach note marked shared is visible to the sailors in that session.
• A coach note marked private is visible only to the one sailor it is about.
• A parent or guardian of a sailor under 18 can see what their child can see, including video and annotations attached to notes about them. This read access ends automatically when the child turns 18. We have no intention of changing that age, and if we ever did we would publish a new version of this policy first and say why.
• No screen in the product hands a club administrator somebody else's coach-note video. A private note and its media are readable by the coach who wrote it, the sailor it is about and that sailor's guardian, and by nobody else — not a club administrator, not a system administrator. What our own system administrators do have is access to the underlying storage, in the course of running the platform or responding to a safeguarding referral. That is an infrastructure capability, not a feature, and it is covered by our Security Policy.

We do not sell media, we do not license it, and we do not share it with anyone outside the list above except where the law requires it or where a safeguarding referral makes it necessary.

We do not use images for marketing

Photographs and video of sailors are not used to promote SailCoach. Not on our website, not on social media, not in a pitch deck, not in an app-store screenshot, not in a newsletter.

If we ever want to use a particular image or clip that way, we will ask first, specifically, in writing, for that image and that purpose:

• If the sailor is under 18, we ask their parent or guardian.
• If the sailor is 18 or over, we ask the sailor.
• We say which image, where it will appear and for how long.
• A blanket "yes to anything, forever" is not something we will ask for or accept.
• Saying no has no consequence. Nothing about a sailor's coaching, squad place or account changes.

Permission given for marketing can be withdrawn at any time by emailing [email protected]. We will stop using the image and remove it from anything we control within ten working days. We cannot un-print something already printed or claw back a copy someone else has already saved, and we will say so honestly rather than promise otherwise.

The lawful basis for using an image in marketing is consent under Article 6(1)(a) of the UK GDPR. The lawful basis for coaching footage is different and is set out below.

Permission for a child to be filmed — where we actually stand

We want to be exact here, because a vague answer on this question is worse than an uncomfortable one.

The policy position. A child under 18 should not be filmed or photographed for coaching purposes without the permission of their parent or guardian. That permission can be withdrawn at any time, for any reason, without explanation.

How that permission is obtained today. It is obtained by the club or the coach, away from this platform — typically as part of club membership, a squad sign-up form or an event entry. Sailing clubs have been managing photography permissions this way for years, and most have a form for it.

What the product does not yet do. There is no per-child image permission field in SailCoach today. The platform does not record whether permission was given, does not ask a coach to confirm it before uploading, and cannot block an upload of a child whose parent has said no. Access to media is tightly controlled, as described above; permission to create it in the first place is not something our software currently checks.

We are stating this rather than implying a control we have not built. It means the protection currently rests on the coach and the club following this policy, not on the software enforcing it.

What we are committing to build. A per-child image permission record, set by the parent or guardian, visible to the coach before they upload, and enforced at the point of upload and the point of sharing. Until it ships, the paragraph above is the honest description of how this works.

Withdrawing permission now. Email [email protected] with the child's name and, if you have it, the club or squad. You do not need to give a reason. We then follow the process set out in "Asking for an image or video to be deleted" below, on the same timescale, and in addition we tell the child's coaches and club administrators that the child is not to be filmed, and we record that instruction.

The lawful basis for coaching footage is our legitimate interests under Article 6(1)(f) of the UK GDPR — coaching a sailor effectively — balanced against the sailor's rights. Where the sailor is a child, that balance is weighted towards the child, which is why a withdrawal request is honoured without argument. You can object to this processing at any time under Article 21; see Your Data Rights.

Rules for coaches when filming

These are not suggestions. Breaking them is a breach of the Code of Conduct and may be a safeguarding matter.

Never film in a changing area, a toilet, a shower block, a boat park where sailors are changing, or anywhere a sailor would reasonably expect privacy. There is no coaching justification that survives this rule. If you need footage of rigging, wait until the sailor is dressed and on the dinghy park proper.

If a sailor asks not to be filmed, stop. Immediately, without negotiating, and without making it a thing in front of the group. A twelve-year-old who does not want to be on camera does not owe you an explanation. Tell their parent or guardian afterwards so the preference is recorded, and note it for future sessions.

Film the sailing, not the person. The frame should be on the boat, the sail, the water and the sailor's technique. Close-ups of a child's face or body that do not serve a specific coaching point should not be taken, and if you take one by accident, delete it. If you could make the same coaching point with the camera further away, put the camera further away.

Film on club or platform equipment where you can, and never keep footage on a personal device. If you must use your own phone — and on a rib in a chop, often you must — the footage goes into SailCoach and then off the phone. Do not keep it in your camera roll, do not let it sync to your personal cloud backup, and do not keep a copy "in case it is useful later". Once it is uploaded, delete the local copy the same day.

Never send footage of a sailor to anyone outside the platform. Not by WhatsApp, not by AirDrop, not by email, not to another coach, not to a parent who asks nicely. Share it inside SailCoach, where the access rules apply and there is a record. If a parent wants a copy, tell them to ask us at [email protected].

Be careful who else is in the frame. On a start line you will capture other sailors, including children from other clubs whose parents have told nobody anything. That is unavoidable in fleet racing and it is why a wide race clip is treated the same as any other footage: private storage, restricted access, no publication. Do not upload a clip whose subject is somebody else's child.

Do not film to build evidence about a person. Video in this platform is for technique. If you have a concern about a sailor's welfare or another adult's behaviour, that is a safeguarding report to [email protected], not a recording project.

Write annotations as though the sailor and their parent will read them, because they can. See the Code of Conduct.

Rules for parents and spectators at events

Most of what happens at a regatta is outside our control, but the expectations we set for people using SailCoach still apply.

• Photograph your own child. That is normal, and nobody sensible objects to it. Do it in a way that does not sweep up somebody else's child as the subject.
• Follow the organising club's photography rules, which are usually stricter than ours and always take precedence at their venue. Some events ban photography in specific areas; some require a wristband or a lanyard to shoot from the shore.
• Do not post images of other people's children on social media, including in a club WhatsApp group or a class association Facebook page, without asking their parent. "It's a nice one of them" is not permission.
• Do not photograph or film in changing areas or toilets. This applies to everyone, always.
• If someone asks you not to photograph their child, stop. You will not always know why, and you do not need to.
• Do not upload footage of other people's children into SailCoach unless you are their coach and the footage is for coaching them.

If you see photography at an event that worries you, tell the event organiser or the club's welfare officer on the day, and tell us at [email protected]. On-the-day matters need an on-the-day response from someone present.

Third-party race photographers and published regatta media

Race photography is an established part of the sport. Professional and volunteer photographers shoot regattas, class associations publish galleries, tracking providers show fleets on a map, and results are posted with full names.

We do not control any of that, and we cannot remove it. If a photographer has taken an image of your child at an open meeting, that is between you, the photographer and the organising authority. If a class association has published a gallery, ask them. We will help you work out who to ask if you are stuck, but the request has to go to whoever published it.

Two related points, because people often raise them together:

• We do not import race photography. No third-party photo gallery feeds into this platform.
• We do import published race results and GPS tracking data, which contains sailors' names and is often about people who have never signed up to SailCoach. That is a different kind of data with its own treatment, set out in the Privacy Policy and in our DPIA. It is not image data and it is not covered by this policy.

Asking for an image or video to be deleted

Anyone can ask. A sailor can ask about themselves. A parent or guardian can ask about their child under 18. You do not have to give a reason.

Email [email protected]. Tell us, as best you can, which image or video — a session date, an event name, a coach's name and a rough date are all enough. If you want everything, say so.

What we do.

1. We acknowledge within five working days.
2. We search our media records and tell you what we found.
3. We delete what you ask us to delete: the original file, the 720p playback rendition, any thumbnail, any flattened copy with a coach's annotations drawn into it, and the annotations themselves.
4. We confirm in writing when it is done, without undue delay and in any event within one month of your request. Where a request is complex — one covering years of footage, for example — we may take up to two further months; if we do, we will tell you inside that first month and explain why.

Honest limits. A sailor can delete their own photos from their photo gallery, one at a time. There is no self-service deletion for video, or for media attached to a coach's note — for those, deletion is a manual process we perform on request, which is why we have given the timescales above rather than describing a feature. Extending self-service deletion is a commitment recorded in our Data Retention Schedule.

One defect in that button, because you are entitled to know it rather than assume it works: where a coach has annotated a photo, we store a second, flattened copy with the drawings burned into the image. The self-service delete removes the original and the record, and leaves that flattened copy in storage with nothing pointing at it. Fixing the button is on the list; until it is fixed, if a photo of your child has been annotated, ask us at [email protected] rather than relying on the button, and we will remove both copies by hand.

We may keep a minimal record that a deletion request was made and honoured — who asked, what was deleted, and when — because without it we cannot prove we did what we said. That record does not contain the image.

There is one case where we will not delete immediately: where the footage is part of a live safeguarding concern or a report to a statutory agency. In that case we say so, we explain why, and we keep it no longer than the matter requires. That decision is made by a person, and you can challenge it — see Complaints.

What happens to footage when a sailor leaves

Media does not disappear automatically when a sailor stops using SailCoach, and we are not going to pretend it does.

The honest position today:

• We do not run an automatic deletion job on media. There is no timer that removes a video after a set period.
• Closing an account today does not cascade through and delete the media attached to it. That work is on our roadmap, and it is recorded as an open item in our Data Retention Schedule.
• What that means in practice is that footage of a sailor who left last season is still stored, still private, and still reachable only by the people listed above.

So if you want it gone, ask. Email [email protected] and we will delete it, using the process in the section above. We would rather tell you to ask than leave you believing it handled itself.

When a child's account is closed by their parent, we recommend asking for media deletion in the same email. We will treat the two requests together.

Retention periods, and the distinction between what expires automatically and what we do by hand, are set out in full in our Data Retention Schedule.

Security of stored media

Media is stored with an S3-compatible object storage provider. It is transmitted over HTTPS. Access is restricted as described above, and our subprocessors are listed in full at Subprocessors.

We are not going to claim more than we can evidence. We have not independently verified encryption of media at rest with our storage provider, and we do not hold ISO 27001, Cyber Essentials or SOC 2 certification. Our Security Policy sets out what we do and do not have.

To report a security problem affecting media — a link that works when it should not, a file you can see that is not yours — email [email protected]. We will not pursue anyone who reports a genuine problem in good faith.

Questions, and who we are

Innovology Ltd, trading as SailCoach, is the data controller for images and video stored in this platform. We are registered in England and Wales.

We have not appointed a Data Protection Officer. We are not required to: we are a small organisation and we are not a public authority, but we do process children's data at scale, which makes this a decision we keep under review rather than one we consider closed.

You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. You do not have to come to us first, though we would like the chance to put it right.