Privacy Policy

1. Scope and Who We Are

This Privacy Policy explains how CombatAI LLC (“CombatAI,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information when you visit our website, create an account, purchase a plan or report credit, upload footage, receive an analysis, communicate with us, or otherwise use our services (the “Services”). CombatAI LLC is responsible for the personal information described in this Policy.

This Policy does not govern a third party’s independent website or service. It also does not replace the privacy obligations of a gym, coach, account holder, or other person who uploads information about someone else.

2. Information We Collect

• Account information: name, email address, username, a protected password hash, account status, login and password-reset records, and policy-acceptance records.
• Customer Content: uploaded fight, sparring, training, or other videos; filenames; analysis titles and types; notes; comments; report requests; generated reports; and share links or access codes.
• Information about people in footage: images, voices, movements, apparent physical characteristics, performance, conduct, and other information visible or inferable from submitted video. Footage may concern opponents, teammates, coaches, spectators, or minors who do not have CombatAI accounts.
• Purchase and subscription information: selected product, price, report entitlements and usage, Stripe customer and transaction identifiers, subscription status, billing period, cancellation status, payment outcome, refunds, and disputes. CombatAI does not directly receive or store full card numbers entered into Stripe’s payment fields.
• Communications: support requests, email correspondence, report feedback, satisfaction-guarantee requests, and other messages.
• Device and usage information: IP address, browser and device information, referring and requested pages, timestamps, cookie and session identifiers, security events, server logs, and registration-rate-limit records.

3. How We Collect Information

We collect information directly from you when you register, purchase, upload content, add notes or comments, create a share link, or contact us. We collect technical information automatically from your browser, our hosting systems, WordPress, security tools, and payment integration. We also receive billing, fraud, dispute, and subscription information from Stripe and may receive information from coaches, gyms, team members, publicly available sources, and people authorized to act for an account holder.

4. How We Use Information

• Create and secure accounts, authenticate users, prevent abuse, and provide member features.
• Accept, store, retrieve, and analyze footage; generate, review, revise, and deliver reports; and provide customer support.
• Process payments, administer subscriptions and report credits, send transactional messages, and handle cancellations, refunds, disputes, and accounting.
• Protect customers, CombatAI, and the public; investigate security incidents and prohibited conduct; enforce our Terms; and comply with legal obligations.
• Maintain, troubleshoot, measure, and improve the reliability, accessibility, and performance of the Services.
• Create aggregated or de-identified statistics that do not reasonably identify a person.

5. AI Processing and Model Training

CombatAI may use automated tools, artificial intelligence providers, and authorized human analysts to process Customer Content and prepare a requested report. This processing can include transmitting an unlisted video URL, analysis title, analysis type, notes, and related instructions to the processing system.

CombatAI does not sell Customer Content and does not use or authorize customer footage to train public or general-purpose AI models. We may use limited de-identified operational information to test and improve our workflow. We will obtain separate consent before using identifiable Customer Content to train a model for a materially different purpose.

6. How We Disclose Information

We disclose personal information only as reasonably necessary for the purposes described in this Policy, at your direction, or as permitted by law. Recipients may include:

• Stripe for payment processing, subscription management, authentication, analytics related to payment performance, and fraud and loss prevention. Stripe may collect transaction, device, browser, IP-address, cookie, and payment-method information. See Stripe’s Privacy Policy.
• Cloudflare for R2 object storage, content delivery, security, and network services. See Cloudflare’s Privacy Policy.
• AI, report-processing, and authorized human-review providers that help retrieve footage, perform analysis, generate reports, and conduct quality review.
• Website hosting, database, backup, security, and email-delivery providers that operate the site, store records, protect the Services, and deliver account or report notifications.
• Automattic/Gravatar when avatars are enabled. WordPress may send a one-way hash derived from an email address and the browser requests the avatar from Gravatar. See Automattic’s Privacy Notice.
• Professional advisers and authorities when reasonably necessary for legal, accounting, insurance, safety, fraud, or compliance purposes, or to protect rights and prevent harm.
• A successor organization in connection with a merger, financing, reorganization, bankruptcy, or sale of all or part of the business, subject to appropriate confidentiality and legal requirements.

7. Storage, Media URLs, and Sharing

Customer Content and reports may be stored in WordPress, our hosting provider, backups, and Cloudflare R2. R2 encrypts stored objects and network transfers, but some videos and report files are delivered using unlisted object URLs. A share link or direct media URL should be treated as a bearer link: anyone who obtains the exact URL may be able to access the associated content. The link is not intended for public indexing, but an unlisted URL is not the same as account-only storage.

When you intentionally create or send a share link, you direct us to make the associated report and footage available to the recipient. Recipients may copy or further disclose content, and CombatAI cannot control those copies. Contact us promptly if a link was shared improperly.

8. Cookies and Similar Technologies

WordPress uses cookies and similar storage for login sessions, account security, preferences, and essential site functions. Stripe.js and Stripe payment elements use cookies, local storage, device identifiers, and network signals for payment functionality, authentication, fraud detection, loss prevention, and payment-performance analytics. Disabling essential cookies may prevent account or payment features from working.

The tracked CombatAI application does not currently include third-party behavioral advertising pixels. If we add non-essential analytics or advertising technologies, we will update this Policy and provide consent or opt-out controls where required.

9. Retention and Deletion

We retain account information while an account is active and as reasonably necessary to provide Services, maintain security, resolve disputes, enforce agreements, and meet legal, tax, accounting, and payment obligations. Stripe retains payment information under its own policies and legal duties.

Videos, notes, comments, reports, and related metadata are ordinarily retained until you remove the analysis, request permanent deletion, or the account is closed, subject to legal exceptions. Removing an analysis from the dashboard may first move the WordPress record to Trash rather than immediately erasing every copy. Contact us to request permanent deletion. Deletion from active systems may not immediately remove content from email already delivered to intended recipients, recipient-made copies, fraud and audit records, temporary caches, or disaster-recovery backups. Backup copies are isolated and removed through the normal backup lifecycle.

We retain registration rate-limit data for approximately one hour, short-lived upload and login tokens for minutes or hours, and security logs for a reasonable period appropriate to the risk. We delete or de-identify information when it is no longer reasonably necessary, unless retention is required or permitted by law.

10. Your Choices and Privacy Rights

You may access certain account, subscription, and report information through your account. Depending on where you live and subject to legal exceptions, you may have rights to request access to, correction of, deletion of, or a copy of personal information; object to or restrict certain processing; withdraw consent; opt out of sale, sharing, or targeted advertising; and appeal a denied request.

Submit a request using the contact information below. We may need to verify your identity and authority before acting. An authorized agent may submit a request where permitted by law. We will not discriminate against you for exercising a privacy right. You may also complain to the privacy or data-protection authority where you live.

11. United States State Disclosures

CombatAI does not sell personal information for money. We do not share personal information for cross-context behavioral advertising and do not currently use personal information for targeted advertising. If these practices change, we will update this Policy and provide legally required opt-out mechanisms, including recognition of applicable browser-based opt-out preference signals.

Where state privacy law applies, the categories collected during the preceding 12 months are the categories described in Section 2; the business and commercial purposes are described in Section 4; and the recipient categories are described in Section 6. We do not knowingly sell or share the personal information of consumers under 16.

12. Security

We use administrative, technical, and organizational measures designed to protect personal information, including transport encryption, password hashing, signed upload requests, access controls, authentication tokens, limited staff access, and vendor safeguards. No storage or transmission method is completely secure, and we cannot guarantee absolute security. You are responsible for protecting passwords, account sessions, and share or media links.

13. International Processing

CombatAI and its providers may process information in the United States and other countries where privacy laws may differ from those where you live. When required, we use appropriate contractual or legal safeguards for cross-border transfers. By using the Services, you understand that information may be processed outside your state, province, or country.

14. Children’s Privacy

The Services are intended for adults and are not directed to children under 13. We do not knowingly permit a child under 13 to create an account or directly submit personal information. If you believe a child submitted information without legally required parental consent, contact us so we can investigate and delete it. Adults uploading footage depicting minors must have all required parental, participant, privacy, and other permissions.

15. Changes to This Policy

We may update this Policy to reflect changes in the Services, providers, or law. We will post the updated version and revise the “Last updated” date. We will provide additional notice or obtain consent when required for a material change.

16. Contact Us

For privacy questions or requests, contact CombatAI LLC at info@combatai.com. Please use “Privacy Request” in the subject line and describe the request and the account email involved.