Privacy Policy

8CTANE — PRIVACY POLICY Effective Date: July 27, 2026 This Privacy Policy describes how 8ctane Technologies, LLC ("8ctane," "we," "us," or "our") collects, uses, stores, and protects your personal information when you use our Platform. By using 8ctane, you consent to the data practices described in this policy. Where the Platform is provided to a school, college, or other organization under a separate written agreement (a "Signed Agreement"), that agreement governs and controls in the event of any conflict with this policy. 1. INFORMATION WE COLLECT Personal Information Provided by You: - Account information: name, email address, and, when provided through Google or Apple, profile image - Date of birth - Athlete physical and health metrics: height, weight, and body composition (entered by you or your coach) - Performance measurements: performance data and metrics you or your coach record Content You Upload: - Video recordings for biomechanical assessment - Video-derived biomechanical, movement, and pose data generated from those recordings - Training programs, exercise data, and athlete notes Information Collected Automatically: - Session data: IP address, browser user agent, login timestamps - Usage data: features accessed, pages visited, actions performed within the Platform Information from Third Parties: - Authentication data from Google or Apple - Billing information from Stripe (we store only your Stripe customer ID — Stripe processes and stores your payment card information directly) Some fields above (such as body composition and certain performance measurements) may not be collected in every configuration of the Platform; we collect them only where you or your organization provide them. 2. YOUR CONSENT By creating an account, using the Platform, and accepting this Privacy Policy, you consent to our collection, use, storage, and processing of the personal information described above, including: - Personal information: name, email address, and date of birth; and - Health, biometric, and performance data: height, weight, body composition, and performance measurements, including video recordings and video-derived biomechanical, movement, and pose data. Where you provide data about another individual (for example, a coach entering an athlete's metrics), you represent and warrant that you have obtained that individual's consent — and, for a minor, the consent of a parent or legal guardian or the authorization of the responsible school or organization. 3. HOW WE USE YOUR INFORMATION We use the information we collect to: - Provide, maintain, and improve the Platform and its features - Process video uploads through our AI analysis system to generate biomechanical assessments and training recommendations - Generate exercise and template recommendations using vector search technology - Manage your account, subscriptions, and billing - Send transactional communications (account verification, invitation notifications, billing receipts) - Enforce our Terms of Service and protect the security of the Platform - Comply with legal obligations We do not use your information for advertising purposes. We do not sell, rent, or share personal information with third parties for marketing or advertising purposes. 4. HOW WE SHARE YOUR INFORMATION We share your information only with the following categories of service providers, and only to the extent necessary to operate the Platform: Amazon Web Services (AWS S3) — Stores uploaded video frames and files. Data is stored in the United States. Neon — Provides managed PostgreSQL database infrastructure used to store Platform data. Data is stored in the United States. OpenAI — Processes video frame images for AI-powered biomechanical analysis. Video frames are sent to OpenAI's API for evaluation. 8ctane uses OpenAI's API services and does not permit OpenAI to use submitted data to train its models. Pinecone — Stores vector embeddings of exercise descriptions and training templates for semantic search functionality. No personally identifiable information is stored in Pinecone. Stripe — Processes subscription payments and billing. Stripe receives your name and email for billing purposes and directly handles all payment card information. 8ctane does not store or process payment card data. Resend — Sends transactional emails on our behalf (sign-in codes, invitations, notifications). Resend receives email addresses and message content necessary for delivery. Google and Apple — Authenticate your identity. Depending on the provider and the information you choose to share, they may provide your name, email address, and profile image during sign-in. Within Your Organization: Coaches, administrators, and other authorized members of your organization may access your data within the Platform according to their assigned roles and permissions, solely in connection with their legitimate role in training and developing the athlete. Where the Platform is provided to an educational institution, this access is limited to personnel with a legitimate educational interest in the athlete's records (see §7). Organization administrators control role assignments and data access within their organization. 5. WHERE YOUR DATA IS STORED Your personal, health, and performance data is stored and processed on systems located in the United States. By using the Platform and accepting this policy, you consent to the collection, storage, processing, and transfer of your data on systems located in the United States, including transfers across U.S. state lines and, if you access the Platform from outside the United States, across national borders into the United States. 6. AGGREGATED AND DE-IDENTIFIED DATA We may create and use aggregated and de-identified data — data that does not identify you and cannot reasonably be used to identify you — to operate, evaluate, and improve the Platform, to conduct research and analysis, and to develop new features and products. We will not include any individual's biometric, health, or performance data in any public, published, or externally shared statistics, benchmarks, leaderboards, research, or marketing materials in a form that identifies the individual, without that individual's consent (or, for a minor, the consent of a parent or legal guardian or the authorization of the responsible school or organization). 7. FERPA AND STUDENT EDUCATION RECORDS Where the Platform is provided to, or accessed by you through, a school, college, university, or other educational institution subject to the Family Educational Rights and Privacy Act ("FERPA," 20 U.S.C. § 1232g; 34 CFR Part 99), the following applies to any personally identifiable information from student education records that we hold or process on behalf of that institution: - 8ctane acts as a "school official" performing an institutional service or function for which the institution would otherwise use its own employees, and has a "legitimate educational interest" in the education records under 34 CFR § 99.31(a)(1). - 8ctane is under the direct control of the institution with respect to the use and maintenance of the education records. - 8ctane uses education records only to provide and support the Platform's services to the institution, and for no other purpose. - 8ctane will not re-disclose personally identifiable information from education records to any other party without the authorization of the institution, except as permitted by FERPA, by the institution's direction, or by a Signed Agreement. - Upon the institution's request or termination of service, 8ctane will return or delete education records as directed by the institution, subject to any legal retention obligations. For students who have reached 18 years of age or who are enrolled at a postsecondary institution ("eligible students"), FERPA rights transfer from the parent to the student. Nothing in this section limits any greater protection required by a Signed Agreement or by applicable state student-data-privacy law. 8. DATA SECURITY We implement the following measures to protect your data: In Transit: All data transmitted between your browser and our servers is encrypted using TLS/HTTPS. All communication with third-party services uses encrypted connections. At Rest: Our databases are hosted on managed infrastructure with encryption at rest. File storage on Amazon S3 uses server-side encryption. All API keys, database credentials, and service secrets are stored as environment variables on our hosting platform, not in application source code. Access Controls: The Platform enforces role-based access controls at the organization and team level. Users can only access data within their authorized scope. Session data is managed with secure, httpOnly cookies. 9. DATA RETENTION We retain your personal information for as long as your account is active or as needed to provide you with the Platform's services. Training programs, assessment results, and athlete data are retained as long as the associated account or organization is active. If you request account deletion, we will delete your personal information within a reasonable timeframe, subject to any legal obligations requiring retention. Where the Platform is provided to an institution, retention and deletion are handled as directed by that institution under a Signed Agreement. Some anonymized or aggregated data may be retained for service improvement purposes as described in §6. 10. CHILDREN'S AND MINORS' PRIVACY The Platform may be used by minors (under 18) with verifiable parental or legal guardian consent, or, where accessed through an educational institution, with the authorization the institution is responsible for obtaining. Organizations and coaches who create accounts for or upload data about minors represent and warrant that they have obtained the appropriate parental or guardian consent (or institutional authorization). For students who are enrolled at a postsecondary institution, FERPA rights and the ability to consent transfer to the student regardless of age (see §7). We do not knowingly collect personal information from children under 13 without verifiable parental consent. If we learn that we have collected personal information from a child under 13 without appropriate consent, we will take steps to delete that information. 11. YOUR RIGHTS Depending on your jurisdiction and any applicable Signed Agreement, you may have the following rights regarding your personal information: Access: You may request a copy of the personal information we hold about you. Correction: You may request that we correct inaccurate or incomplete information. Deletion: You may request that we delete your personal information, subject to legal obligations and, where applicable, the direction of your institution. Data Portability / Export: You may request a copy of your personal and performance data in a portable, machine-readable format (CSV or JSON). Objection: You may object to certain processing of your personal information. You may initiate account deletion from the Account screen in the 8ctane iOS app. To exercise other rights, or if you cannot access the app, contact us at support@8ctane.ai. We will respond to requests within 30 days. Where the Platform is provided to an institution, these requests may be directed or fulfilled through that institution. 12. COOKIES AND TRACKING The Platform uses essential cookies for authentication and session management. These cookies are necessary for the Platform to function and cannot be disabled. We do not use advertising cookies or third-party tracking cookies. We do not participate in cross-site tracking or behavioral advertising. 13. CHANGES TO THIS PRIVACY POLICY We may update this Privacy Policy from time to time. We will notify you of material changes through the Platform or via email. Your continued use of the Platform after changes are posted constitutes acceptance of the revised policy. 14. CONTACT For questions about this Privacy Policy or to exercise your data rights, please contact us at support@8ctane.ai.