Privacy Policy

We collect only the data necessary to provide and improve the Platform. This includes:

Account data — When you register, we collect your email address and a hashed version of your password. We never store your password in plain text.

Profile data — First name, last name, biography, and avatar image, if you choose to provide them. All profile fields except email are optional.

Athletic performance data — Performance metrics, goals, CRL assessment scores, and event records that you or your coach submit to the Platform.

Usage data — Standard server logs including IP address, browser type, pages visited, and timestamps. This data is used for security and platform performance monitoring only.

Communication data — If you contact us by email or through the Platform, we retain records of that correspondence to assist you effectively.

We do not collect payment card details directly. When payment processing is introduced, it will be handled by a PCI-DSS compliant third-party processor.

We use the data we collect solely to:

• Provide, operate, and maintain the Platform and its features;
• Authenticate your identity and maintain the security of your account;
• Calculate and display your Commercial Readiness Level (CRL) and performance metrics;
• Enable coaches and administrators to manage athlete rosters and conduct assessments;
• Power Pacer AI responses — your data is used to contextualise AI-generated informational responses;
• Send you service-related communications (account notifications, security alerts, Terms or Privacy Policy updates);
• Diagnose technical issues and improve platform performance;
• Comply with applicable legal obligations.

We do not use your personal data for advertising purposes. We do not profile you for the benefit of third-party advertisers.

CRL threshold alerts: If your CRL score crosses a defined threshold, the Platform may notify the Track Capital Inc. team and, with your consent, the Artists & Athletes affiliate programme. This is a core feature of the Platform's commercial pipeline and will be explained clearly at the point of opt-in.

All user data is stored on servers located in the State of Florida, United States of America, operated by Ekovista. Data does not leave the United States without your explicit consent.

We implement industry-standard security measures including:

• TLS encryption for all data in transit (HTTPS enforced across all Platform endpoints);
• Bcrypt password hashing — your password is never stored in plain text;
• Dual-token JWT authentication with server-side refresh token revocation;
• Firewall and access controls restricting database access to authorised services only;
• Role-based access control (RBAC) ensuring users only access data they are authorised to view;
• Soft-delete architecture — deleted accounts are flagged, not immediately destroyed, allowing recovery within a defined window.

No system is completely secure. While we take significant measures to protect your data, we cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you as required by applicable law.

We may share limited data with trusted third-party service providers who assist us in operating the Platform. These providers are contractually obligated to handle your data in accordance with this Privacy Policy and applicable law.

Current and planned third-party integrations include:

• Ekovista — VPS hosting provider (Florida, USA). Processes server infrastructure only; does not access application-level user data;
• Payment processor (coming soon) — Will handle payment card data under PCI-DSS compliance. Track Capital Inc. will not store card details;
• Artists & Athletes — Sister company in the TC ecosystem. Athlete data is shared only when a CRL threshold is crossed and the athlete has explicitly opted in.

We do not share your personal data with social media platforms, advertising networks, or data brokers. Social media links on the Platform (LinkedIn, Instagram, Facebook) are outbound links only — clicking them is governed by those platforms' own privacy policies.

Track Capital Inc. takes the privacy of minor athletes seriously. The following special protections apply to users under 18 years of age:

• Minors may only access the Platform through an invitation-only parental consent pathway initiated by a registered Team, Organisation, Coach, or Administrator;
• A parent or legal guardian must agree to these Terms and our Privacy Policy on the minor's behalf before an account is created;
• Parent-monitored accounts give the parent or guardian administrative access to review and manage the minor's data;
• Minor athletes are never enrolled in the Artists & Athletes commercial pipeline without explicit parental consent;
• We do not knowingly collect personal data from individuals under 13 years of age.

If you believe a minor under 13 has registered without parental authorisation, please contact us immediately at legal@trackcapitalinc.com and we will investigate and take appropriate action.

You have the following rights with respect to your personal data:

• Access — You may request a copy of the personal data we hold about you;
• Correction — You may request that we correct inaccurate or incomplete data. Profile data can be updated directly in your account settings;
• Deletion — You may request that we delete your account and associated personal data. Note that athletic performance data submitted to the Platform may be retained in anonymised form for platform integrity purposes;
• Portability — You may request a machine-readable export of your personal data;
• Objection — You may object to certain uses of your data, including the CRL threshold commercial pipeline opt-in;
• Email change — Email address changes must be requested via support@trackcapitalinc.com and are actioned by the Platform Webmaster.

To exercise any of these rights, contact us at support@trackcapitalinc.com. We will respond within 30 days. Where we are unable to action a request, we will explain why.

Track Capital Inc. uses a minimal, privacy-respecting approach to cookies and local storage:

• Authentication tokens — We store JWT access and refresh tokens in your browser's local storage to keep you securely logged in. These are essential to the Platform's operation and cannot be disabled without logging out;
• Session management — We use session data to enforce inactivity timeouts for your account security;
• No advertising cookies — We do not use advertising cookies, tracking pixels, or third-party analytics that profile you for commercial purposes.

We do not use Google Analytics, Facebook Pixel, or similar advertising or behavioural tracking tools. If analytics tools are introduced in the future, this policy will be updated and you will be notified.

Coming soon: A cookie preference centre will be added to the Platform when additional cookie categories are introduced.

We retain your personal data for as long as your account is active or as needed to provide you with the Platform's services.

• Active accounts — Data is retained for the duration of your account's active status;
• Deleted accounts — Upon account deletion, your personal identifiers are removed within 30 days. Anonymised athletic performance data may be retained for platform integrity and aggregate analysis;
• Refresh tokens — Revoked on logout and automatically expire after 7 days;
• Server logs — Retained for up to 90 days for security and diagnostic purposes, then deleted;
• Legal holds — Where required by applicable law, certain data may be retained beyond the above periods.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. The effective date at the top of this page always reflects the date of the most recent revision.

For material changes — those that significantly affect your rights or how we use your data — we will provide notice via the email address associated with your account at least 14 days before the changes take effect.

We encourage you to review this policy periodically. Your continued use of the Platform after any changes constitutes your acceptance of the revised policy.

For privacy-related questions, requests, or concerns, please contact us:

• General privacy enquiries: support@trackcapitalinc.com
• Legal and data protection matters: legal@trackcapitalinc.com

Registered address:
Track Capital Inc.
10396 West State Road 84, Suite 103
Davie, Florida 33324
United States of America

You also have the right to lodge a complaint with the relevant data protection authority in your jurisdiction. For users in the United States, this is the Federal Trade Commission (FTC) at ftc.gov.

Also governed by our Terms of Service. · EIN: 27-3753898 · Effective: April 22, 2026