Privacy Policy

1. Who we are

VICTEVO Holdings, Inc., a Delaware corporation ("VICTEVO," "we," "us," or "our"), operates VictevoSports.com and the VICTEVO platform (collectively, the "Services"). We are the data controller for personal information collected through the Services.

• General: hello@victevo.com
• Privacy requests: privacy@victevo.com
• Security concerns: security@victevo.com
• Mailing address: VICTEVO Holdings, Inc., 8 The Green, Suite A, Dover, DE 19901

2. What this Policy covers

This Policy governs personal information we collect, use, share, and protect through the Services, including:

• The public VictevoSports.com marketing website
• The gated investor and strategic-partner section
• Athlete profile creation and management features
• Team roster, performance baseline, and coach interaction features
• Contact forms, meeting request submissions, and waitlist sign-ups

This Policy does NOT cover:

• Information collected by third parties not operated by VICTEVO
• Information you share with us outside the Services, such as email or phone conversations with our team

3. Information we collect

We collect only what we need to provide the Services.

3.1 Information you provide directly

• Identity data — legal name, sport, team, organization, age or date of birth
• Contact data — email address, phone number (optional)
• Profile data — athlete profile information, including photos you upload, performance baselines, and sport-specific metrics
• Access gate data — name, email, entity, acceptance signals, and electronic signature data when you complete the NDA gate
• Communication data — content of contact form submissions, meeting requests, and messages you send us
• Consent signals — marketing opt-in selections and timestamps

3.2 Information collected automatically

• Device and connection data — IP address, browser type, operating system, device type
• Usage data — pages visited, time of visit, referring page, click and scroll behavior
• Authentication data — session tokens managed by Clerk
• Cookies and similar technologies — see Section 7

IP addresses are retained for ninety (90) days for fraud prevention, then removed or anonymized.

3.3 Information from third parties

• Authentication provider (Clerk) about login and session events
• E-signature provider about the status of NDA signing
• Email delivery providers about whether confirmation emails reached you
• Investors or partners who refer you to us by name

3.4 Performance and biometric data

VICTEVO collects athlete performance and fitness data — including sport-specific metrics, baseline performance measurements, and training data — as core platform functionality.

We are not a covered entity under HIPAA. We do not provide medical services, process insurance claims, or act as a healthcare provider, health plan, or healthcare clearinghouse. Athlete performance and fitness data is not Protected Health Information (PHI) under HIPAA. We treat performance and biometric data as sensitive personal information and apply the security practices described in Section 6.

4. How we use your information

We do not sell personal information. We do not share personal information with third parties for advertising purposes. We do not use your personal information for targeted behavioral advertising.

Automated systems and coaching guidance: VICTEVO uses automated systems (including Personal Digital Manager Marlowe and the VICTEVO Chief of Staff automated features) for content generation, coaching guidance, and platform operations. Outputs from these automated systems are advisory. Final decisions — including training plans, recruitment outreach, and profile approvals — are reviewed by a human before they reach an athlete or coach. We do not use automated systems for solely automated decisions that produce legal or similarly significant effects on you. See Section 13 for our full automated-systems governance statement.

5. How we share your information

Service providers. Vendors who help us operate the Services, under contracts requiring them to protect the information and use it only on our behalf: Clerk (authentication), Neon (database), Vercel (hosting, US-East), e-signature provider, transactional email provider, Sentry (error monitoring).

Professional advisors. Lawyers, accountants, and other advisors as needed for legal, accounting, and audit purposes.

Legal compliance. If required by law, subpoena, court order, or to protect VICTEVO's rights, property, or safety.

Business transfers. If VICTEVO is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred. We will notify you if any such transfer materially changes how your information is handled.

With your consent. For any other purpose with your explicit consent.

6. How we protect your information

VICTEVO follows industry-standard security practices appropriate for an early-stage platform. Our controls include:

• Encryption in transit: TLS 1.3 for all data transmitted between your device and our Services
• Encryption at rest: AES-256 via our managed database (Neon) and hosting infrastructure (Vercel)
• Access controls: Role-based access control (RBAC) and least-privilege principles; MFA required for internal administrative access
• Security headers: Content-Security-Policy, HSTS (2-year max-age with preload), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Permissions-Policy
• Bot protection: Cloudflare Turnstile on forms; rate limiting on all API endpoints
• Monitoring: Error and security event monitoring via Sentry; CSP violation reporting

We are working toward SOC 2 Type II readiness ahead of broader public launch. We do not currently hold SOC 2, ISO 27001, or HITRUST certifications.

No system is perfectly secure. We cannot guarantee absolute security, and you use the Services at your own risk.

Breach notification. If we become aware of a security incident that materially affects your personal information, we will notify you and the appropriate regulatory authorities within seventy-two (72) hours of becoming aware, consistent with GDPR Article 33 and applicable U.S. state breach notification laws.

7. Cookies and similar technologies

Strictly necessary cookies are required for the Services to function (for example, to maintain your authenticated session). These cannot be disabled without breaking core functionality.

Analytics cookies help us understand how visitors use the Site. Where required by applicable law, we will request consent before deploying analytics cookies.

You can control cookies through your browser settings. Disabling necessary cookies will break authenticated features.

8. How long we keep your information

9. Your privacy rights

Multiple U.S. state privacy laws are in force as of 2026, including the CCPA/CPRA (California), VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), TDPSA (Texas), OCPA (Oregon), MCDPA (Montana), ICDPA (Iowa), DPDPA (Delaware), NHPA (New Hampshire), NJDPA (New Jersey), TIPA (Tennessee), MCDPA (Minnesota), MODPA (Maryland), KCDPA (Kentucky), and laws effective in Rhode Island, Indiana, and Nebraska in 2026.

The union of these laws affords residents of covered states the following rights:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct inaccurate information
• Deletion — request that we delete your personal information, subject to legal exceptions
• Portability — request your information in a portable, machine-readable format
• Opt-out of sale or sharing — opt out of sale of your personal information or sharing for targeted advertising or profiling (we do not do this, but you may still request)
• Opt-out of profiling — opt out of profiling for decisions with legal or similarly significant effects
• Appeal — if we decline your request, appeal by contacting privacy@victevo.com with "Privacy Request Appeal" in the subject line

If you are in the EU, UK, or a jurisdiction with equivalent data protection rights, you also have the rights to restrict processing, object to processing based on legitimate interest, lodge a complaint with your supervisory authority, and withdraw consent at any time.

To exercise these rights: email privacy@victevo.com with the subject "Privacy Request." We will respond within thirty (30) days. We do not discriminate against users who exercise their privacy rights.

10. Minors and youth athlete protection

10.1 Children under 13 — COPPA

COPPA (15 U.S.C. §§ 6501–6506) requires verifiable parental consent before collecting personal information from children under 13. Athletes under 13 are not directly onboarded through the public-facing platform. Only a parent, legal guardian, or authorized coach may create a profile record for an athlete under 13. If you believe we have collected personal information from a child under 13 without appropriate parental consent, contact privacy@victevo.com immediately and we will delete it.

10.2 Athletes ages 13–17

Athletes under 18 require verifiable parental or guardian consent before their profile data is collected or processed through the platform. We do not sell the personal information of any athlete under 18. We do not direct targeted advertising at minors. State laws in California, Utah, Texas, New York, and Florida impose additional youth online safety requirements that we apply as design principles for features accessible to users under 18.

11. International users and cross-border data transfers

VICTEVO V1 is a U.S.-based service with infrastructure hosted in the United States (Vercel, US-East). If you access the Services from outside the United States, your personal information will be transferred to, processed in, and stored in the United States.

We honor GDPR and UK GDPR rights for EU and UK data subjects. For cross-border transfers of EU/UK personal data to the United States, we rely on the EU-U.S. Data Privacy Framework (DPF, in force since July 10, 2023), Standard Contractual Clauses (SCCs), or other appropriate transfer mechanisms as required. We do not rely on the EU-U.S. Privacy Shield (invalidated) or Schrems II-era arrangements.

We honor rights under Quebec Law 25 (Canada) and Brazil's LGPD for residents of those jurisdictions. For other international data protection inquiries, contact privacy@victevo.com.

12. Third-party links

The Services may link to third-party websites or services we do not operate. We are not responsible for their privacy practices. Review their privacy policies before sharing information with them.

13. AI governance and automated decision-making

VICTEVO uses automated features to deliver coaching guidance, performance insights, and operational support.

• Automated systems in use: Personal Digital Manager Marlowe (coaching guidance), VICTEVO Chief of Staff (operational automation), automated content generation
• Human review: All AI outputs affecting training plans, recruitment outreach, or profile approvals are reviewed by a human before being delivered to an affected user
• No solely automated significant decisions: We do not make solely automated decisions with legal or similarly significant effects on you
• EU AI Act: GPAI provisions in force August 2025; our automated features are advisory tools, not high-risk AI systems within the meaning of the EU AI Act
• Colorado AI Act: Human oversight is applied to all algorithmic outputs that could constitute high-risk AI decisions under the Colorado Artificial Intelligence Act (effective February 1, 2026)
• Transparency: automated-system output is identified as such within the platform

14. Changes to this Policy

We may update this Policy from time to time. The updated version takes effect when posted. If we make a material change, we will note the new effective date and, where practicable, notify users by email. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

15. Contact us