Privacy Policy
Version 2026-10-07
This Privacy Policy explains how Valaritas AI, Inc., a corporation incorporated in the State of Delaware, United States (Valaritas, we, us), collects and uses personal data when you use the websites, dashboards, applications and services we provide (the Platform). Valaritas is the controller of your personal data. You can contact us at superstar@valaritasports.com.
1. What we collect
- Account data: your email address, name, account type, sign-in method and the organisations you belong to.
- Purchase data: what you bought, amounts, order status, Stripe customer, subscription and receipt references, and billing-portal activity returned to us by Stripe webhooks.
- Content you upload: for example training clips sent to Roast & Repair, first names for personal messages, campaign briefs, and files athletes and their teams upload.
- Safety data: text submitted for athlete requests, display names, reports, blocks, moderation outcomes, rate-limit events and safety audit records. We store hashes or decisions where possible instead of raw text.
- Athlete likeness data (athletes only): reference photos, video and voice recordings, and biometric identifiers and biometric information such as facial geometry and voiceprints, collected under the athlete's AI Likeness Rights Licensing Agreement.
- Signature records: when you accept these policies or sign an agreement, we record the document version and fingerprint, the date and time, your IP address and device information.
- Technical, monitoring and security data: your IP address, browser and device information, uptime checks, route status, rate-limit counters, server logs and browser error reports needed to run and secure the Platform.
- Communications: emails and messages you send us.
2. How we use it
- To provide the Platform (performance of our contract with you): accounts, pages, orders, subscriptions, deliveries, receipts, refunds, billing-portal access, payouts and consoles.
- To create licensed AI content (performance of contract, and the athlete's explicit consent for biometric data): building and approving athlete base models, generating personal messages and Roast & Repair responses, and detecting unauthorised use of athletes' likenesses.
- To analyse training clips (performance of contract): AI tools assess the technique in clips you send so the athlete can coach you. We do not use your clips to identify you or to build a likeness of you.
- To keep the Platform safe (legitimate interests): fraud prevention, security, abuse detection, moderation, reports, blocks, rate limits and enforcing our Terms.
- To monitor reliability (legitimate interests): uptime checks, error reports and alert emails so we can detect outages and broken launch flows.
- To meet legal obligations: tax, accounting and responding to lawful requests.
- To send you messages: service emails such as receipts, billing notices, approvals and account-deletion confirmations; marketing only where you have agreed or the law allows, with a way to opt out.
3. Athlete biometric data
Athletes' facial geometry, voiceprints and other biometric identifiers and biometric information are collected and used only with the athlete's written consent in their AI Likeness Rights Licensing Agreement, for the purposes described there. We keep them for the term of that agreement plus 90 days, unless longer retention is required by law or for legal claims, and then permanently destroy them. We never sell biometric data.
4. Who we share it with
We share personal data only as needed to run the Platform:
- Service providers acting on our instructions: Supabase (database, sign-in and file storage), Vercel (hosting, logs and cron), Cloudflare (network security), Stripe (payments, customer portal, subscriptions and athlete payouts), Resend (email), OpenAI (moderation and safety classification), Higgsfield (AI video generation), Amazon Web Services (AI image analysis and generation infrastructure) and ai.io (biomechanical analysis of training clips). Our pages load fonts from Google Fonts, which receives your IP address.
- The athlete side: when you order a personal message or send a training clip, the athlete and the people who manage them see what they need to fulfil it, such as your first name and your clip, unless safety screening refuses the request before delivery.
- Business partners in a campaign: brands, agencies and leagues see the campaign information needed to approve, pay for and deliver it.
- Legal and safety: where required by law, or to protect the rights and safety of users, athletes and Valaritas.
- Business transfers: in connection with a merger, acquisition or sale of assets, subject to this Policy.
We do not sell your personal data and we do not share it for cross-context behavioural advertising.
5. International transfers
We and our providers process data in the United States, the United Kingdom, the European Economic Area and other countries. Where data leaves the UK or EEA, we rely on adequacy decisions or standard contractual clauses, including the UK International Data Transfer Addendum.
6. How long we keep it
We keep account data while your account is open and for up to 6 years afterwards where needed for accounting, tax or legal claims. Purchase, receipt, refund and ledger records are kept for accounting, tax and dispute-handling periods. Safety reports, blocks and moderation decisions are kept as long as needed to protect athletes and users, usually up to 6 years for serious incidents. Browser error reports and uptime logs are kept only as long as needed to diagnose reliability issues. You can delete uploaded content at any time; deleted content is removed from active systems within 30 days and from backups within 90 days. Signature records are kept for as long as the agreement they evidence can be relied on, plus 6 years. Athlete biometric data is kept as described in section 3.
7. Your rights
Depending on where you live, you have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict certain processing, and to withdraw consent at any time (which does not affect processing already carried out). California residents have the rights to know, delete, correct and opt out of the sale or sharing of personal information, and we do not discriminate against anyone who exercises them. To exercise a right, email superstar@valaritasports.com. You can also complain to your data protection authority, such as the UK Information Commissioner's Office.
8. Deleting your data
To delete your account and personal data, use the deletion options in your dashboard where available, or email superstar@valaritasports.com from the address on your account. If you connected a social media account to the Platform, disconnecting it or emailing us removes the data we obtained from it. We complete deletion requests within 30 days and confirm by email, subject to records we must keep for legal, safety, accounting or dispute reasons.
9. Children
The Platform is not directed at children under 13, or under 16 in the European Economic Area and the United Kingdom. Anyone under 18 needs a parent or legal guardian to create and manage their account. Under-13 fan activity is processed only after verifiable parental consent is recorded.
10. Security and storage on your device
We protect personal data with access controls, encryption in transit, row-level security in our database, rate limits and audit logs. The Platform stores your sign-in session and a few preferences in your browser's local storage so you stay signed in. We do not use advertising cookies or third-party analytics trackers.
11. Changes
We may update this Policy. The version and date are shown at the top, and we will tell you about significant changes.
12. Contact
Valaritas AI, Inc. · superstar@valaritasports.com · www.valaritasports.com