Privacy Policy

Effective: October 5, 2026 · Last updated: October 9, 2026

This Privacy Policy explains how Show Up Show Out LLC ("Show Up Show Out," "we," "us," or "our") collects, uses, and shares information when you visit iVenza.app (the "Site") or use the iVenza mobile app (the "App," and together with the Site, the "Services"). iVenza is a training companion and athlete/coach platform for all sports. By using the Services, you acknowledge this Policy.

"iVenza" is a brand and trademark (registration pending) of Show Up Show Out LLC, so references to "iVenza," "Show Up Show Out," "we," "us," or "our" in this Policy mean the same company.

iVenza is offline-first: most of your training data is stored locally on your device and works without an account. If you create an account, your data syncs to our cloud so you can back it up and use it across devices.

1. Information We Collect

Information you provide

• Account & profile: your name and email address, a password or a token from a social sign-in, and profile details you add such as your discipline/sport, units, goals, and gym or team.
• Launch waitlist (closed): if you joined the pre-launch waitlist on iVenza.app, the email address and, optionally, the name and phone number you submitted (collected through Microsoft Forms). The waitlist is closed now that the apps have launched on the App Store and Google Play. We keep those details only to send you the launch announcements you signed up for, and you can ask us to delete them at any time by emailing help@susos.co.
• Blog subscription (optional): if you subscribe to the iVenza blog from a post on iVenza.app, we store the email address you enter, which post you subscribed from, your device or browser information, and a one-way hash of your network (IP) address, which we use only to rate-limit the form against abuse. Subscribing is confirmed opt-in: we email you once to confirm, and you are added to the list only when you click that link - so an address entered by somebody else is never subscribed. We use it for nothing but telling you when a new post is published. Every subscription email carries a one-click unsubscribe link, and you can also unsubscribe at any time by emailing help@susos.co.
• Free guides (optional): if you ask for one of our guides at ivenza.app/resources/, we store the email address you enter, which guide you asked for, the first name and organization you choose to give, which page of our site you came from, whether you ticked the box for updates, your device or browser information, and a one-way hash of your network (IP) address, which we use only to rate-limit the form against abuse. We email you the guide once. Asking for a guide does not put you on any list: if you tick the updates box, that is a blog subscription, and you are added only after you click the confirm link inside the guide email. For the guides written for gyms, schools, promotions, and scouting programs, our team is also told about the request so a person can follow up once by email; you can ignore that reply.
• Quizzes (optional): the one-minute quizzes at ivenza.app/quiz/ are scored in your browser. Your answers are not sent to us and are not stored. Our website analytics count that a quiz was started, how many questions were answered, and which result was shown, without the answers themselves. If you then ask for the guide from a result page, the result you were shown is recorded as the page you came from, as described above.
• Training & health content you log: techniques and notes, training sessions, strength workouts, runs, training programs, body weight and measurements, nutrition and meals, fasting, hydration, supplements, sleep, competitions and camps, goals, a daily “how you feel” check (sleep, energy, soreness, mood, stress, and any pain and where it is), an injury log with its return-to-play status, and photos or videos you attach.
• Coaching & gym data: if you join a gym or team or act as a coach, information such as roster membership, lesson plans, messages and broadcasts, bookings, schedules, and the training data you choose to share. Nothing about your training or your health is shared with a gym or coach until you choose to share it (see "Coaches and gyms" in section 3). If you share a film-review video with a gym, that clip and its comment thread are visible to that gym's coaches.
• Waivers, contracts & e-signatures: if you sign a gym waiver, membership agreement, or fight contract electronically through the Services, we store the signed record for you and for the gym, promotion, or organizer it is with. The signature record includes your typed or drawn signature, the document you signed, and metadata stamped at signing - the date and time, your network (IP) address, and your device or browser information - which together form the audit record of the signature.
• Fight promotion & event compliance: if you compete on a promotion's fight card, the promotion may require compliance items you submit through the Services, such as medical documents (for example bloodwork, physicals, or eye exams), promotional photos, and a completed IRS Form W-9. These are stored for that promotion and are visible to its staff and to you. Your Social Security or tax ID number is never stored as app data and never logged - it exists only inside the completed W-9 PDF held privately for the promotion that requested it (the app keeps only the last four digits and the ID type as a reference), and the promotion is responsible for using it solely for tax reporting. Photos you upload as event compliance items may be used by the promotion to promote that event, as disclosed at upload.
• Marketplace & recruiting profiles (opt-in): if you choose to publish a fighter-marketplace resume (limited to athletes 18 and older) or a recruiting profile, the details you include - and, for recruiting profiles, training and competition statistics computed from data you logged - become visible to the matchmakers, scouts, and recruiters those features serve. Nothing is published without your explicit action, and you can unlist at any time.
• Find friends and invitations (optional): if you use Find friends, the App reads your address book on your device and sends our servers only one-way hashes of phone numbers and email addresses so we can show you people you know who already use iVenza; the hashes are matched at that moment and are not stored, and the names and numbers in your address book never leave your phone. When you invite someone, the message is composed on your device. If a gym or coach invites a member, they give us that person's name, email address or phone number so we can send the invitation. If you share a referral code or link, we record that a sign-up used it so we can credit you.
• Payments: if you book a coach or buy a ticket, your payment is processed by Stripe. We receive limited transaction details (such as amount, status, and the last four digits of a card) but not full card numbers.
• Communications & support: messages you send us (for example, to help@susos.co), feedback, and in-app support requests.
• Security reports: if you submit a vulnerability report through ivenza.app/security/ or help@susos.co, the report details you provide, an optional contact email, a hashed network (IP) identifier we record for abuse prevention, and any files you attach (screenshots, PDFs, logs, archives, or documents). Attachments are stored privately, are readable only by our security triage team, and are never published or served publicly - so please don't include anyone's personal data beyond what is needed to demonstrate the issue.
• Text messages (SMS): if you provide a phone number and opt in, we - and the gyms, coaches, or organizers you interact with - may send you service texts and, where you have separately opted in, marketing texts through our SMS provider (Twilio). Your number reaches us only because you gave it: to gym staff in person, on a gym's own online form hosted by us, or when you turn on two-step verification and confirm the number by entering a code we text you. We do not buy, rent, or scrape phone numbers, we do not sell your number, and we do not share it with third parties for their own marketing. Each message names both the gym and iVenza, so you can tell who is contacting you. We keep a record of the messages sent and your opt-out state. Message frequency varies; message and data rates may apply; consent is not a condition of any purchase. Reply STOP at any time to stop texts, or HELP for help - you can also manage them under More › Reminders in the app or at Your Privacy Choices. Full messaging terms are in our Terms.

Health & fitness data

• The App records training and health information you enter and, if you grant permission, imports data from Apple Health (HealthKit) on iOS or Health Connect on Android, such as workouts, runs, body weight, and sleep.
• We use health and fitness data only to provide the Services to you. We do not use HealthKit or Health Connect data for advertising or marketing, and we never sell it.
• How you feel and injuries (self-reported): the daily “how you feel” check and the injury log are health information you report about yourself. They feed your own readiness score. The coaches of a gym or team you belong to can see them only while the “How you feel & injuries” sharing setting is on for that gym. It is off until you turn it on: when you join a gym we ask whether to share your health data with its coaches, and you can turn it on or off for any gym at any time in the App or at Your Privacy Choices. Coaches can read these entries but never change them. When you log an injury you can also choose “Let my coach know”, which tells the coaches of the gyms or teams you train at that you are hurt, with the short description you typed; that notice is withdrawn when you clear your last active injury. None of this is a medical record or medical advice, and we never use it for advertising or sell it.

Location data

• If you use GPS run tracking, the App collects precise location while you record a route, in order to map your run.
• Location- and map-based features (such as finding gyms or venues) use Google Maps / Google Places and may use approximate location.

AI-powered features

• Some optional features use a third-party artificial-intelligence provider (Anthropic, the maker of Claude) to help you log and manage your training - for example, filling in a workout, session, or meal from text or a photo you provide, drafting coach messages and lesson plans, and generating suggestions. When you choose to use one of these features, the specific content you submit for it (such as the text you type or the image you upload) and, for features that summarize your own training (the weekly briefing), the relevant entries already in your account - training, sleep, weight and recovery readings, reduced to totals and bands - are sent to the provider to generate the result, and only when you tap to run that feature. Gym staff can also ask for a plain-language narrative of their gym's own reports; the gym's aggregate figures are sent, and revenue figures only when that staff member already holds the gym's billing permission. Separately, if you leave a voice note on a film review and choose to transcribe it, that recording is sent to OpenAI for speech-to-text and the transcript is attached to your note. Neither provider uses what you submit to train its models under the API terms we use.
• This content is used only to provide the feature you requested. The provider acts as our processor, does not use your content to train its models, and we never use it for advertising. You control when AI features run - they only send content when you explicitly use them.

Information from third parties

• If you sign in with Apple, Google, Facebook, Discord, or Microsoft, we receive basic profile information from that provider (such as your name, email address, and profile picture). If you sign in with Facebook and grant the optional permissions, we also receive your date of birth (to fill in your profile and calculate your nutrition and macro targets by age) and your current city (to help you find nearby gyms, events, and training partners). We never request your Facebook photos, videos, or posts.

Information collected automatically

• Usage analytics: to understand how the App and website are used and decide what to improve, we record limited product-usage events, such as which screens or pages you open, in-app actions and counts, the order and timing of those actions within a usage session (so we can reconstruct a session's event timeline for debugging and product analysis), how far you get through key flows such as sign-up, onboarding, and subscription (conversion and drop-off, or "funnel", analysis), your platform (iOS, Android, or web), app version, and device model. These events do not include your name, email address, health or training values, message contents, or other free-form text you enter. We do not use session-recording or session-replay tools: nothing in the App, the web app, or the website records your keystrokes, mouse movements, or screen.
• Email delivery: for emails sent through the Services (ours, and a gym's announcements or marketing campaigns) we record whether each one was delivered or bounced, so we can stop sending to an address that does not work. We do not track whether emails are opened or links clicked: there is no tracking image and no tracked link, and a gym or team sees only whether its messages were delivered. Every marketing email includes an unsubscribe link.
• Consent records: when you make a privacy choice - the cookie banner on our website, the "Share usage & diagnostics" switch, what you share with a gym or a coach (including a parent's or guardian's answer for a child), your consent to marketing text messages and its withdrawal - and when you delete your account, we keep a record of it on our servers: the choice, when you made it and when we received it, how you made it (which screen), the exact wording you were shown (stored once per version, with a fingerprint so it cannot change), your platform and app version, your browser's user agent, and your network (IP) address only as a one-way hash combined with the record's own ID, so the record holds no address. A website choice is recorded under a random ID your browser keeps beside it (ivenza_consent_receipt), not under your name. We keep these records to show what you agreed to if a choice is ever disputed: they are chained so they cannot be quietly changed, you can see your own history under More → Data & Sharing in the App or Your data in the web app, and we keep each one for as long as the choice stands and for 6 years after it is replaced or your account is deleted, then delete it.
• Crash & error diagnostics: when the App hits an error or crash, it sends a diagnostic report containing the error message and technical stack trace, the screen you were on, and the same platform, app-version, and device-model details, so we can find and fix the problem.
• Web performance: when you use iVenza in a web browser, we collect anonymous performance measurements - such as Core Web Vitals (loading, interactivity, and visual-stability timings) and how long pages or components take to load - tied to the page or route and your browser platform, so we can find and fix slow or unstable pages. We take some of these through our own code and some through Vercel's Speed Insights service, which our web host provides. These measurements contain no personal content.
• This usage, diagnostic, and web-performance data is associated with your account when you have one (so we can group repeated events, measure conversion, and prevent abuse), but it is never used to build an advertising profile, is not sold, and is not used for cross-app or cross-site advertising or tracking. The one advertising tool we use, the Meta Pixel on our marketing website, is described separately below; it does not run in the App or the web app.
• You decide. Outside the EEA, the United Kingdom and Switzerland this collection is on by default, and you can disable it at any time with the "Share usage & diagnostics" switch under More → Data & Sharing in the App or Your data in the web app (this also turns off in-app funnel and event-timeline analytics tied to your account, crash and error reports, and web-performance measurements). In the EEA, the United Kingdom and Switzerland it is the other way round: none of this runs until you turn that same switch on, turning it off again stops it and deletes anything still queued on your device, and neither app asks you at the door because there is nothing to ask until you choose. Website analytics are covered in Cookies and Similar Technologies below: they stay off until you opt in if you are in the EEA, the United Kingdom or Switzerland, and you can switch them off anywhere with the "Cookie settings" link in the footer of any page. We can also disable this collection globally for everyone.
• The Site sets no cookies of its own. It keeps a few items in your browser's local storage and, only if you allow it (or, outside Europe, unless you opt out), runs the website analytics and the Meta Pixel described below. Every item is listed in our Cookie Notice.

Acquisition and referral data

• To understand how people discover iVenza, we record where a visit or sign-up came from: the referring website or link, and any campaign parameters in the URL (for example utm_source, utm_medium, and utm_campaign).
• Before you create an account, when you browse our website we collect this acquisition information on an anonymous basis, together with basic page-view analytics - in the EEA, the United Kingdom and Switzerland only after you accept analytics in our cookie banner, and elsewhere unless you opt out. To measure this without identifying you, we store a random identifier (an "anonymous ID") in your browser's local storage. This anonymous ID is not your name or email; it is used only to count visits and attribute a later sign-up to its original source. If you then create an account, we may associate that anonymous activity with your account so we can measure conversion.
• If you tell us which kind of visitor you are (for example "athlete" or "coach") using the selector on our homepage, we remember that choice in your browser's local storage so we can show you the most relevant part of the site and skip asking again if you sign up. It is a preference, not an identifier, and it is stored even if you have opted out of analytics.
• You can withdraw at any time. Switching analytics off in the Site's cookie settings (the "Cookie settings" link in the footer of every page, or Your Privacy Choices) stops it and deletes this identifier and the stored campaign information from your browser, and you can also clear them in your browser settings.

Advertising measurement on our marketing website (Meta Pixel)

• Our marketing website (ivenza.app) uses the Meta Pixel, a tool from Meta Platforms, Inc., so we can tell whether our ads on Facebook and Instagram lead people to our site, and so Meta can show those ads to people likely to find iVenza useful. When it runs, your browser sends Meta the page you visited, your browser and device details, your IP address, and cookie identifiers, and Meta may combine this with information it already holds about you, such as your Facebook or Instagram account.
• It reports only these events: that a page was viewed, that you tapped a sign-up or app-store button, and that you requested one of our free guides. Its automatic event and form detection is switched off, so it does not read button text or form fields on its own. We never send Meta your name, your email address, anything you type into a form, or any training, health, or payment data.
• It runs only on the marketing website. It is not in the iVenza App or the web app at my.ivenza.app, and it never runs on our privacy, terms, trust, security, or help pages.
• In the EEA, the United Kingdom and Switzerland it stays off until you accept advertising measurement in our cookie banner. Elsewhere it is off if your browser sends a Global Privacy Control or Do Not Track signal, or if you turn off advertising measurement in the cookie settings or on Your Privacy Choices; a Global Privacy Control signal always turns it off. Switching it off stops it at once and deletes the cookies it set on our site. You can also manage how Meta uses this information in your Facebook and Instagram ad settings. Its cookies are listed in the Cookie Notice.

2. How We Use Information

• Provide, sync, and back up the Services and your data across devices.
• Enable coaching and gym features and share the categories of data you have chosen to share with the coaches or gyms you authorize.
• Keep a record of the privacy choices you make, so we can show what you agreed to and when you withdrew (see "Consent records" above).
• Process payments and bookings (through Stripe).
• Power optional AI-assisted features (such as filling in a workout or meal from text or a photo, and drafting coach content) using a third-party AI provider, as described in "AI-powered features" above.
• Send communications: launch updates if you joined the waitlist, new-post notifications if you subscribed to our blog, the free guide you asked for, transactional messages, reminders and push notifications you enable, and responses to your support requests.
• Maintain security, prevent fraud and abuse, and debug and improve the Services.
• Measure how features and key flows perform (including conversion and drop-off), reconstruct usage sessions for debugging, monitor web performance, and understand how users discover iVenza.
• Create aggregated or de-identified information (for example, how many people use a feature) that does not identify you; we do not try to re-identify it.
• Comply with legal obligations.

If you are in the EEA, the United Kingdom or Switzerland, the notice below sets out the legal basis for each of these uses.

3. How We Share Information

We do not sell your personal information. We share information only as described here:

• Service providers (processors): companies that help us run the Services, including Supabase (cloud database, authentication, sync, and backups), Cloudflare (domain routing, rate limiting, email routing, and hosting for our administrator console), Vercel and Microsoft Azure (website and web app hosting), Better Stack (availability monitoring), Stripe (payments), Anthropic and OpenAI (AI-assisted features, as described in "AI-powered features" above), Daily (video rooms for online coaching sessions you book), Expo (the relay every push notification passes through), Apple and Google (health data you import, maps and places, sign-in, and push notifications), Resend (email delivery), Twilio (text messages and two-step verification codes by text), Lob (printed mail some gyms choose to send), RevenueCat (app-store subscription management), Google/YouTube (embedded video playback and video search, when you use those features), Microsoft (sign-in and the closed pre-launch waitlist form), Meta (Facebook) and Discord (sign-in, if you choose them), and USDA FoodData Central (nutrition lookups). These providers may process your data only to provide services to us. A complete, current list with the purpose and data category for each is published in our sub-processor register.
• Coaches and gyms: a gym, team or coach sees only the categories of data you choose to share with them. Nothing about your training or your health is shared until you choose. When you join a gym or team we ask, with two boxes that start unticked: My training (training sessions, workouts, runs, and competitions & camps - which can include heart rate, calories and routes you import from Apple Health or Health Connect, and a weight cut) and My health data (weight and body measurements, sleep, nutrition & hydration, fasting, and your daily “how you feel” answers and injury log). Ticking a box is your explicit consent for that gym's coaches to see it, and for a child whose profile a parent or guardian manages, the parent or guardian answers. Your name, profile picture and technique library are shared with gyms you join, because a roster needs to know who its members are, and you can turn those off too. A private coach sees only what you switch on for them. You control each category for each gym or coach and can turn it off at any time under Data sharing in the App or at Your Privacy Choices, and it stops at once. If you joined a gym before October 8, 2026, the training and health shares that joining had switched on were switched off on that date, and you are asked again; that gym's coaches see them again once you say yes. Waivers and agreements you sign with a gym or team, and compliance items you submit to a promotion (including any medical documents, photos, and tax forms described above), are visible to that organization's staff as part of running the gym, team, or event.
• Sellers you buy from: when you buy merchandise or other physical goods through the Services, the shipping address and contact details you enter at checkout are shared with the seller so they can fulfill your order.
• Other users: content you choose to publish (for example, a technique you share to the community feed) is visible to other users.
• Advertising partner (Meta): when the Meta Pixel runs on our marketing website, Meta receives the limited visit data described under "Advertising measurement" above. We do not sell personal information, but California and some other states treat this as "sharing" for cross-context behavioral advertising or "targeted advertising," which you can opt out of as described in sections 4 and 13.
• Legal and safety: to comply with law, enforce our terms, or protect the rights, safety, and security of our users and the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

Other sites and services. The Services link to websites and apps run by others, such as a gym's own site, a payment page, a social network or an app store. Their privacy practices are their own, and this Policy does not cover them.

4. Your Choices and Rights

Your Privacy Choices is the single page for exercising everything below: see and download your data, correct it, delete your account, and choose how your information is used and shared. It also carries a request form for anyone who cannot sign in - a lost account, a profile a gym created for you, or a parent acting for an athlete under 18.

• Access & export: you can view your data in the App and export a full backup of your data.
• Delete: you can delete your account and associated data from within the App, or on the web at my.ivenza.app/data without installing anything. Deleted gyms or teams may be recoverable for a limited window (about 30 days) before permanent deletion.
• Permissions: you can grant or revoke Health, Location, Camera, and Notification permissions in your device settings, and manage data-sharing with coaches and gyms in the App.
• Your consent history: the record of every privacy choice you made while signed in - what you shared with each gym or coach, the usage and diagnostics switch, and text-message consent - is under More → Data & Sharing in the App and Your data in the web app. For a choice made on our website, or to get a copy of your record, ask us through Your Privacy Choices.
• Sign-in providers: if you sign in with Apple, Google, Facebook, Discord, or Microsoft, you can manage what that provider shares in its own settings, and you can connect or disconnect Facebook under More → Support → Connected accounts in the App.
• Usage analytics & diagnostics: you can turn off product-usage analytics and crash diagnostics (including funnel, session-timeline, and web-performance analytics) at any time with the "Share usage & diagnostics" switch under More → Data & Sharing in the App or Your data in the web app. In the EEA, the United Kingdom and Switzerland they are off until you turn that switch on. The anonymous website analytics collected before sign-in can be turned off with the "Cookie settings" link in the footer of any page or on Your Privacy Choices, and we honor your browser's Do Not Track and Global Privacy Control settings.
• Communications: you can set email and text-message preferences by category under More → Reminders in the App or at my.ivenza.app/data, use the unsubscribe link in any marketing email, reply STOP to any text, and disable push notifications in your device settings.
• Cookies: use the "Cookie settings" link in the footer of any page, Your Privacy Choices, or your browser settings. See section 9 and the Cookie Notice.

California and other U.S. states (CCPA/CPRA and the state privacy laws): you can find out what we collect and why, get a copy, correct it, delete it, opt out of "sharing" and targeted advertising, limit the use of sensitive information where the law provides it, appeal a refusal, and use any of these rights without being treated differently. We do not sell your personal information. The details, a table of the categories we collect, and how to use these rights are in section 13.

EEA, United Kingdom and Switzerland (GDPR, UK GDPR and the Swiss FADP): you can access, correct, erase, restrict and object to the use of your personal data, take it with you, withdraw any consent you gave, and complain to your regulator. Our legal bases, transfer safeguards and the details of each right are in section 12.

We acknowledge privacy requests within 10 business days and complete them within 30 days, or tell you why we need longer, up to the extension the applicable law allows. Because anyone can type an email address into a form, we verify that you control an account before we delete or release anything.

5. Data Retention

We retain personal information only for as long as necessary to provide the Services and for the purposes described in this Policy, or as required by law. When you delete your account, we delete or de-identify your personal data, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. In particular, signed waivers, membership agreements, fight contracts, tax forms (such as Form W-9), and event compliance records are held for the gym, promotion, or organizer you provided them to, and may be retained after you delete your account where the law requires it - for example tax reporting and liability records.

A blog subscription is separate from an account, so unsubscribing removes you from the mailing list but does not delete an iVenza account, and deleting an account does not by itself remove a blog subscription made with a different address. Email help@susos.co if you want a blog subscription record deleted outright rather than marked unsubscribed. A free-guide request is likewise not tied to an account; we keep it until you ask us to delete it, which you can do by emailing help@susos.co.

To decide how long to keep something we consider what it is, how sensitive it is, why we collected it, whether we can reach the same purpose another way, and what the law requires. Deleted data can persist in encrypted point-in-time backups until they age out on their normal cycle, and backups are never used to restore an individually deleted record.

Consent records (the record of each privacy choice described in section 1) are kept for as long as the choice stands and for 6 years after it is replaced or your account is deleted - the longest common period in which a claim about it could be brought - and then deleted automatically. They survive account deletion for that reason: they are how we show what you agreed to, and when you withdrew.

Our full data retention schedule sets out the retention period for each category of data and names every carve-out that survives account deletion.

6. Data Security

We protect information using measures such as encryption in transit, access controls, and secure infrastructure provided by our cloud vendors. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

7. Children's Privacy

The Services are not intended for children under the age of 13 to use on their own. We do not permit anyone under 13 to create their own account. We ask for a date of birth before an account can be used: on the sign-up form, or, when you sign in with Apple, Google, Facebook, Discord, or Microsoft, on the first screen after that sign-in. If the answer is under 13, a sign-up form never creates the account, and an account a sign-in created moments earlier is deleted. That device then will not offer sign-up again for a day.

A child under 13 may appear in iVenza only through a profile created and owned by an adult - a parent or guardian who adds them to a family account, or a gym, team or club that adds them to its roster. That profile has no login of its own.

If an account is nevertheless established as belonging to someone under 13, we narrow it to internal use only. That account is not listed on any leaderboard, is not returned by contact matching or friend finding, cannot generate or redeem referral codes, receives no marketing email or text messages, and sends nothing to our AI provider. Messaging is limited to the coaches and staff of a gym or team the child has actually joined; other athletes cannot message them and they cannot message other athletes. Such an account is never asked to share its training or health data with a gym, and those shares stay off; for a child's profile that a parent or guardian manages, the parent or guardian decides what the child's gym can see. Practice reminders, schedule changes and other service messages still work, as does their own training history. These limits are enforced on our servers, and once an account is known to be under 13 that fact cannot be changed from the app.

We are building a verifiable parental consent flow for adult-created child profiles. In a school deployment, consent runs through the school under our agreement with it. If you believe a child has provided us information, or you are a parent or guardian who wants to review, correct or delete a child's information, contact help@susos.co or use Privacy Choices.

Where a country sets its age of digital consent above 13 (up to 16 in parts of Europe), we treat the parent or guardian involvement described below as required until the athlete reaches that age.

Athletes aged 13-17 may use the Services only with the involvement of a parent or guardian (for example through a family or guardian account). Publication features are age-gated: publishing a recruiting profile at 13-17 requires a parent or guardian to review and approve it in the app, that approval can be revoked at any time (which unlists the profile), and a minor's recruiting profile never shows health statistics or an exact city. The fighter marketplace, the affiliate and partner programs, and promotional sweepstakes are limited to users 18 and older.

8. International Data Transfers

We are based in the United States. Your information is stored and processed in the United States (our primary database is hosted there) and may be processed in other countries by our service providers. United States law is not the same as the law where you live. Where the law requires a safeguard for a transfer, we use one: for transfers from the European Economic Area, the United Kingdom and Switzerland, the recipient's certification under the EU-U.S. Data Privacy Framework (and its UK Extension and the Swiss-U.S. Data Privacy Framework) where it participates, or otherwise Standard Contractual Clauses in our agreement with the recipient. Section 12 has the details and explains how to ask for a copy of the safeguards that apply.

9. Cookies and Similar Technologies

A cookie is a small file a website asks your browser to keep. Local storage does the same job inside your browser, and a pixel is a tiny request a page makes to another company's server. We call all of these "cookies and similar technologies." Our Cookie Notice lists every item the Site uses, who sets it, and how long it lasts; this section is the summary.

• The Site sets no cookies of its own. It keeps a few items in your browser's local storage: your cookie choice and a random ID that links it to our record of your choice (ivenza_consent_receipt), the audience you pick on the homepage, and whether you have seen the blog sign-up. These are strictly necessary, so they are always on.
• Two things are optional: website analytics (a random ID, first-touch campaign information, page views and performance timings) and advertising measurement (the Meta Pixel, which sets Meta's _fbp and _fbc cookies and a fr cookie on facebook.com).
• If you are in the EEA, the United Kingdom or Switzerland, neither runs and nothing is stored until you choose in the banner that appears on your first visit. Choosing "Reject all" is as easy as "Accept all," you can choose analytics and advertising measurement separately, and the Site works fully whatever you pick. We ask again after 12 months, or sooner if what we use changes.
• Everywhere else, both run unless you opt out in the cookie settings or on Your Privacy Choices, or your browser sends a signal. A Global Privacy Control signal always turns advertising measurement off, and we treat it as a valid opt-out of "sale" and "sharing" under the state privacy laws. We also honor Do Not Track: if your browser sends it and you have made no choice, both stay off.
• How we tell where you are. The Site cannot know your location, so it uses your browser's time zone and language settings. If they suggest the EEA, the United Kingdom or Switzerland, or your browser will not say, we ask first. We would rather ask someone who did not need to be asked than the reverse.
• Changing your mind. The "Cookie settings" link in the footer of every page reopens your choices wherever you are. Switching something off stops it immediately and deletes what it stored on your browser. Your choice is saved in your browser, so it does not follow you to another browser or device.
• Our record of your choice. Each choice you save is also sent to our servers and kept as a consent record: the choice, when and how you made it, the version of the wording you saw, the page, the random ID above, your browser's user agent and a one-way hash of your network address. We keep it to show what you chose if a choice is ever disputed, for as long as it stands and 6 years after you change it. It carries no name or email. The Cookie Notice has the details.
• The App and the web app. Neither sets cookies of its own or runs an advertising tracker, and the web app does not run the Meta Pixel. They show no cookie banner because what is optional in them - usage analytics, crash and error reports and web-performance measurements, including Vercel's Speed Insights script - is off by default in the EEA, the United Kingdom and Switzerland and starts only when you turn on "Share usage & diagnostics" (More → Data & Sharing in the App, Your data in the web app). Everywhere else it is on until you turn it off (in the web app your browser's Do Not Track also counts as off). Before you sign in, the web app starts anonymous analytics in the EEA, the United Kingdom and Switzerland only for a visitor who already consented on ivenza.app. The web app also keeps a few items in your browser to sign you in and remember your preferences; the Cookie Notice lists every one. Your yes is saved on the device where you gave it; your no, and the account switch, apply everywhere you sign in.
• Fonts. Our typeface is served from our own site, so your browser does not contact a font provider when a page loads. See the Cookie Notice.

10. Changes to This Policy

We may update this Policy from time to time. We will post the updated version here and revise the "Last updated" date above. Material changes may also be communicated through the Services, and where the law requires your consent to a new use, we will ask for it first.

11. Contact Us

For privacy requests, use Your Privacy Choices. For anything else about this Policy:

12. Notice for People in the EEA, the United Kingdom and Switzerland

This section applies to individuals in the European Economic Area, the United Kingdom and Switzerland ("Europe"). It supplements the rest of this Policy and explains our legal bases and your rights under the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the UK Privacy and Electronic Communications Regulations (PECR), the EU ePrivacy Directive and the Swiss Federal Act on Data Protection. "Personal information" in this Policy means "personal data" as those laws define it.

Where we are and what we offer. We are a United States company and do not direct our marketing at people in Europe. The mobile apps are not offered in the European Union storefronts of the app stores, but they, our website and the web app can be reached from other places in Europe, including the United Kingdom. We therefore apply the protections in this section to anyone in Europe who uses iVenza, and the cookie rules in section 9 apply to every visitor whose browser suggests they are there.

Who is responsible for your information

Show Up Show Out LLC, 2125 Biscayne Blvd, Ste 204 #10150, Miami, Florida 33137, USA is the controller of the personal information covered by this Policy. Contact us at help@susos.co or through Your Privacy Choices. We have no establishment in the European Union or the United Kingdom and have not appointed a representative under Article 27 of the GDPR or the UK GDPR, nor a Data Protection Officer. If that changes, we will name them here. When you use iVenza through a gym, team, school or promotion, that organization is usually a separate controller of the information it collects for its own purposes, and we process it for them as a processor under our agreement with it; ask that organization about its own use.

Our legal bases

The GDPR requires a legal basis for each use of personal information. These are the bases we rely on. "Contract" means we need the information to give you the service you asked for. "Legitimate interests" means a use that is necessary for an interest of ours or a third party's that your rights do not override; you can object to it (see "Your rights"). "Consent" can be withdrawn at any time.

Where we rely on legitimate interests we have weighed them against your rights, and you can ask us for the details. We do not use your information for a different purpose that is not compatible with the one we collected it for without telling you and, where the law requires it, asking for your consent.

Special category data

Health and fitness information, including sleep, heart rate, body measurements, the daily "how you feel" check and the injury log, is a special category of personal data. We process it only to give you the features you ask for, and only on your explicit consent, which you give by choosing to log or import it, to connect Apple Health or Health Connect, to run an AI feature on it, or to tick the box or switch that shares a category with a gym or coach (nothing is shared with one until you do). We keep a record of each of those sharing choices, as section 1 describes. You can withdraw consent at any time by deleting the entries, disconnecting the health platform, switching the sharing category off, or deleting your account. Withdrawing does not affect what we did before you withdrew. The iVenza features still work without any health data. We never use health data for advertising and never sell it.

What happens if you do not give us information

You can use most of iVenza without an account and without giving us anything beyond what the App stores on your device. If you create an account we need an email address or a social sign-in, and for some features (a booking, a ticket, a waiver) we need the details the transaction requires; the screen tells you when that is the case. Everything else is optional.

Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The readiness score, the "how you feel" score and the weekly briefing are information for you, and the optional AI features produce suggestions you review before anything is saved or sent. Some gym tools flag members for a coach's attention, for example a lapsed payment or an unsigned waiver; a person at the gym decides what, if anything, to do.

Who receives your information

The recipients are described in section 3 (service providers, coaches and gyms you authorize, other users where you publish, authorities, and business successors) and in our sub-processor register, which names each provider and the category of information it handles.

Transfers outside Europe

We are in the United States, so your information is processed there, and our primary database is hosted in the United States. The European Commission, the UK and Switzerland have not found United States law adequate in general. For each transfer from Europe we rely on a recognized safeguard: the recipient's certification under the EU-U.S. Data Privacy Framework (with its UK Extension and the Swiss-U.S. Data Privacy Framework) where the recipient participates in it, or otherwise the European Commission's Standard Contractual Clauses, with the UK Addendum or International Data Transfer Agreement and the Swiss amendments where they apply, in our agreement with that recipient. In limited cases we rely on your explicit consent. You can ask us for a copy of the safeguards that apply to your information using the contact details above.

How long we keep it

Section 5 and the retention schedule give the period for each category and name what survives account deletion and why. When we no longer need information we delete it or de-identify it so it can no longer be linked to you.

Your rights

Under European data protection law you can ask us to:

• Access your personal information and receive a copy and details of how we use it;
• Correct information that is inaccurate or incomplete;
• Erase your information where there is no good reason for us to keep it;
• Restrict our use of it, for example while you contest its accuracy;
• Port the information you gave us in a structured, machine-readable format, or have it sent to another provider where that is feasible;
• Object to our use based on legitimate interests, and object at any time, without giving a reason, to use for direct marketing;
• Withdraw consent at any time where we rely on it, which is as easy as giving it; and
• Not be subject to a decision based solely on automated processing with legal or similarly significant effects (we make none).

Use Your Privacy Choices, which includes self-serve tools and a form for anyone who cannot sign in, or email help@susos.co. It is free. We confirm receipt within 10 business days and answer within one month; if a request is complex we may extend that by up to two more months and will tell you why. We verify that you control an account before we release or delete anything, and we may decline a request where the law allows, telling you the reason.

Complaints

Please tell us first so we can put it right: write to help@susos.co and we will acknowledge a complaint within 30 days and tell you the outcome. You also have the right to complain to a supervisory authority at any time:

• EEA: the data protection authority where you live, work or believe the issue occurred - the European Data Protection Board lists them all.
• United Kingdom: the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone +44 303 123 1113, ico.org.uk/make-a-complaint.
• Switzerland: the Federal Data Protection and Information Commissioner, edoeb.admin.ch.

13. Notice for California and Other U.S. States

This section is our notice at collection and privacy notice for residents of California under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the "CCPA"), and of the other states with comprehensive privacy laws that apply to us - today including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, and others as they take effect (together with the CCPA, the "State Privacy Laws"). The rights described here do not all apply in every state, and they do not apply to information that those laws exempt, such as information covered by FERPA when a school directs how we handle it. If you use iVenza through a school, the school's agreement with us governs that information, and you should also ask the school. "Personal information" here includes "personal data" as those laws define it.

The short version: we do not sell personal information, and we never have. We do not use health or other sensitive information for advertising. The one advertising tool we run, the Meta Pixel on our marketing website, can count as "sharing" for cross-context behavioral advertising, and you can switch it off or send a Global Privacy Control signal. We do not have actual knowledge that we sell or share the personal information of anyone under 16.

What we collected in the past 12 months, and where it came from

The table groups what we collect by the categories the CCPA names. It describes the 12 months before the date at the top of this Policy and what we do today. Information you type into a free-form box may contain other kinds of information than the ones listed.

Public sources. For some competitive records we use results that a state athletic commission publishes. We do not buy personal information from data brokers.

Why we use it, and who receives it

The service providers are named, with what each handles, in our sub-processor register. We also disclose personal information where the law requires it, to protect people's safety, and to a successor in a merger or sale of the business. We do not sell or share personal information for any other reason, and we do not retain it for longer than the table says.

Sale, sharing and targeted advertising

We do not sell personal information for money or other valuable consideration. The Meta Pixel on our marketing website lets Meta receive limited visit information to measure and target our Facebook and Instagram ads. California and some other states treat that as "sharing" for cross-context behavioral advertising, or as "targeted advertising." You can opt out at any time:

• turn off Advertising measurement with the "Cookie settings" link in the footer of any page or on Your Privacy Choices; or
• use a browser or extension that sends a Global Privacy Control signal. We honor it automatically as a valid opt-out, the Pixel never loads, and we do not ask you to confirm; or
• email help@susos.co.

The opt-out applies to the browser you use it in. Because we do not know who you are on the marketing website, we cannot match a signal to an account; the App and the web app never run the Pixel, so there is nothing to opt out of there. We do not knowingly sell or share the personal information of consumers under 16.

Sensitive personal information

We use sensitive personal information only to provide the Services you ask for, to keep them secure and to comply with the law - the uses the CCPA permits without a right to limit. We do not use it to infer characteristics about you, we do not sell or share it, and we never use health information for advertising. Because of that, we do not offer a separate "Limit the Use of My Sensitive Personal Information" link. In states that require your consent to process sensitive data (such as Virginia, Colorado, Connecticut, Texas and Oregon), we process it only with your consent, which you give by choosing to enter, import or share it, and you can withdraw it by deleting the data, disconnecting the health platform, switching sharing off or deleting your account. See also the Consumer Health Data Privacy Policy.

Your rights

Depending on where you live, you may have the right to:

• Know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients, and receive a portable copy;
• Delete the personal information we collected from you;
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects (we do none of the last);
• Limit the use of sensitive personal information, where the law gives that right and it applies;
• Appeal a decision to refuse your request; and
• Not be discriminated against for using any of these rights. We do not deny service, charge different prices or give a different quality of service because you did, and we do not offer financial incentives in exchange for personal information.

How to use them

Use Your Privacy Choices - self-serve tools for most of these, and a request form for anyone who cannot sign in - or email help@susos.co. We confirm receipt within 10 business days and respond within 45 days of receiving a request, and we aim to finish within 30. If we need more time we may extend once, by up to another 45 days, and will tell you why. Requests are free; we may decline or charge a reasonable fee only for requests that are manifestly unfounded or excessive, and we will say so.

Verification. Because anyone can type an email address into a form, we confirm that you control the account (or, for a profile a gym or guardian created for you, that you are the person or their guardian) before we delete or release anything. We ask only for what we need, which is usually a confirmation sent to the account's email address. We will not ask for a government ID unless we cannot verify you any other way and the law allows it.

Authorized agents. You may use an agent. We will ask for your written permission, or a power of attorney, and may contact you to confirm it. A parent or guardian may make requests for a child under 18 whose profile they manage.

Appeals. If we deny your request, you may appeal. Choose "Ask a privacy question" on Your Privacy Choices and begin your message with the word "Appeal," or email help@susos.co with the subject "Appeal" and the number or date of your request. A person who was not involved in the first decision will review it, and we will answer within 45 days (extendable by up to 60 more where state law allows, with notice to you) and explain the result. If you are not satisfied, you may contact your state's attorney general.

More for California residents

• Shine the Light. Under California Civil Code section 1798.83, you may ask which categories of personal information we disclosed to third parties for their own direct marketing in the past calendar year. We make no such disclosures. You can ask at help@susos.co with the words "Shine the Light Request."
• Minors. If you are a California resident under 18 with an account, you may remove content you posted by deleting it in the App or by asking us; deleting it from view does not always remove every copy.
• Do Not Track. We honor Do Not Track and Global Privacy Control signals as section 9 describes.
• Deidentified data. We do not attempt to re-identify information that has been deidentified.

More for residents of other states

• Colorado, Connecticut, Montana, Oregon, Texas and others that require it: we honor universal opt-out signals such as Global Privacy Control as a request to opt out of targeted advertising and sale, as described above.
• Oregon and Minnesota residents may ask for the specific third parties to which we have disclosed their personal information. Besides the service providers in the sub-processor register, the only recipient that receives it for advertising is Meta, through the Pixel.
• Nevada residents may opt out of the sale of covered information. We do not sell it. To ask us anyway, email help@susos.co.
• Texas: we do not sell sensitive personal data.
• Consumer health data. Washington, Nevada and Connecticut have laws that give extra protection to consumer health data. Our Consumer Health Data Privacy Policy covers them and the rights they give you, such as withdrawing consent and asking who receives your health data.

14. People in Other Countries

Many countries, including Canada (the Personal Information Protection and Electronic Documents Act and Quebec's Law 25), Brazil (the LGPD), Australia (the Privacy Act and Australian Privacy Principles) and others, give you rights over your personal information, usually to access it, correct it, delete it, object to some uses and complain to a regulator. We apply the choices in this Policy to everyone, and where your country's law gives you more, we will honor it to the extent it applies to us. Use Your Privacy Choices or email help@susos.co, and tell us where you live so we can apply the right rules. As described in section 8, your information is processed in the United States and by providers in other countries.