Legal
Privacy Policy
Effective date: 26 September 2026
Last updated: 30 October 2026
1. Who we are
StriideAi is a sports training and athlete-development platform operated by STRIIDE SPORTS LTD, company number 16734879, registered in England and Wales.
Registered office: 54 New Road, Ilford, England, IG3 8AT
Privacy contact: privacy@striide.app
ICO registration: ZC112376
This Privacy Policy explains how StriideAi collects, uses, stores, shares and protects personal information when you use our website, mobile applications and related services.
Depending on how StriideAi is used, STRIIDE SPORTS LTD may act as:
- a data controller, where we determine why and how personal information is processed; or
- a data processor, where we process personal information only on documented instructions from a school, club, academy or other organisation under an applicable Data Processing Agreement.
2. Our privacy approach
StriideAi is designed for athletes, including young players, and our approach is based on a simple principle:
We collect only what we need, protect it properly, and use it responsibly.
We aim to minimise the amount of personal information we collect and use.
Where practical, we use:
- avatars rather than unnecessary profile imagery;
- age range or age-category information rather than collecting more identity information than is needed;
- sports-development information only where it helps provide the service safely and appropriately;
- parent or guardian approval for younger users; and
- technical controls designed to reduce unnecessary disclosure of personal information to third-party technology providers.
We do not sell or rent personal information.
We do not use children’s information to create advertising profiles.
3. Who can use StriideAi
The current version of StriideAi is for coaches and scouts aged 18 and over.
When athlete access is released, younger athletes will use the same parental-approval process as the Striide app: an account stays restricted until a parent or guardian approves it, approval is recorded with its date and method, and a parent can withdraw it at any time, which pauses the account.
This approval is StriideAi's own product rule and is stricter than the law requires in some places. Separately, under UK data-protection law, where we rely on consent for online processing of a child under 13, we must obtain parental authorisation and make reasonable efforts to verify it. Other countries set different ages.
Parents and guardians are encouraged to help younger users understand how StriideAi uses their information.
4. Information we collect
The information we collect depends on the features a user chooses to use.
4.1 Account and profile information
This may include:
- name;
- email address;
- avatar;
- age range or date-of-birth information needed to determine an appropriate age category;
- authentication information;
- parent or guardian approval status, where applicable; and
- information supplied through supported sign-in providers such as Apple, Google or Facebook.
We aim not to collect more identity information than is reasonably necessary to operate the service.
4.2 Sporting and training information
This may include:
- skill level;
- playing role;
- playing experience;
- sports-development goals;
- sporting aspirations;
- equipment available;
- preferred learning approach;
- available training time;
- training assessments;
- completed sessions;
- saved content;
- progress information;
- rewards and streaks; and
- other sports-development information voluntarily supplied through the service.
We use this information to make the StriideAi experience more relevant to the user’s age, level and sporting context.
4.3 Practice videos and other uploaded media
Where a user chooses to record or upload a practice video, the video may contain identifiable footage of the athlete.
Practice videos are used for the practice or review purpose for which they were submitted.
Under our standard retention approach:
- practice videos are retained for a maximum of 30 days by default;
- where a video has been submitted solely for a review or assessment and that purpose is completed earlier, it may be deleted earlier;
- users may delete their video before the end of the standard retention period; and
- account deletion triggers deletion of associated practice videos from active storage, subject to normal encrypted-backup expiry.
Practice videos are not sent to OpenAI. How they are analysed is explained in section 8.6.
Where StriideAi retains a review result after the raw video is deleted, that result may include items such as coaching comments, scores, progress information or recommended training activities. Results are kept until you delete them or your account.
4.4 AI-supported recommendation information
StriideAi uses AI for selected sporting-training and recommendation features.
For applicable features, StriideAi may process limited sporting information such as:
- age range;
- skill level;
- learning period;
- playing or match experience;
- sporting aspirations;
- available equipment;
- available training time;
- relevant preferences; and
- a user’s sporting question or assessment response.
For the current recommendation flow, StriideAi does not deliberately include direct identifiers such as the user’s name, email address, phone number or StriideAi account ID in the AI request.
Users should not enter unnecessary personal, medical or contact information into free-text AI fields.
4.5 Technical, security and diagnostic information
We may process limited technical information generated when the service is used, including:
- IP address generated through normal network activity;
- device model;
- operating-system information;
- browser or app version;
- session information;
- application logs;
- security events;
- crash information; and
- diagnostic information.
Our technical monitoring is configured to minimise the unnecessary capture of personal information.
4.6 Payment and subscription information
Payments may be processed through approved providers such as:
- Stripe;
- Apple App Store;
- Google Play; and
- other approved payment providers used in supported markets.
StriideAi does not store full payment-card numbers.
We may retain limited information such as:
- transaction references;
- subscription status;
- purchase identifiers;
- customer references; and
- records required for accounting, fraud prevention, support or legal obligations.
4.7 Communications
We may process information contained in:
- account emails;
- parent or guardian approval communications;
- support enquiries;
- service notifications;
- feedback; and
- communications sent to StriideAi.
4.8 Waitlist, enquiries and quotes
Before launch, and for schools, clubs and organisations, the StriideAi website at striideai.com collects:
- your name, email address and, where you choose to give it, phone number and organisation details;
- your role (for example athlete, parent or guardian, coach or organisation), sport and goals;
- the plan or institutional programme you were interested in, with the billing period and the market/currency shown to you;
- the StriideAi team member you chose to contact you;
- for organisation enquiries, the custom quote prepared for you, its revision history and delivery status of related emails; and
- one-time 6-digit access codes (stored only in protected form) used to open your private quote page.
We use this information to add you to the waiting list, send you a confirmation, respond to your enquiry, prepare and update quotes and measure demand. The team member you select is copied on enquiry and quote emails; access codes are only ever sent to you.
Prices shown on the website are selected automatically from your approximate location (browser language, time zone and, if needed, an IP-based country lookup). This is used for display only. It is not stored against your enquiry beyond the market shown to you, and it is not used to profile you.
5. How we use personal information
We use personal information only for defined purposes, including to:
- create and secure accounts;
- authenticate users;
- provide the StriideAi service;
- provide age- and level-appropriate sporting content;
- personalise training recommendations;
- save training history and progress;
- operate practice-video and coach-review features;
- provide AI-supported sporting recommendations;
- process subscriptions and payments;
- provide support;
- send essential account and service communications;
- maintain platform security and reliability;
- investigate errors, misuse or security incidents;
- prevent fraud or abuse;
- improve the service using proportionate and minimised information;
- comply with legal and regulatory obligations; and
- establish, exercise or defend legal rights where necessary.
We do not sell personal information.
We do not use children’s information for advertising-driven profiling.
6. Lawful bases for processing
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, subscriptions and credits | Contract |
| Practice video upload and AI video analysis | Contract, plus your explicit in-app permission before AI sharing |
| AI text recommendations | Contract, plus your explicit in-app permission before AI sharing |
| Waitlist, enquiries and quotes | Steps before a contract at your request |
| Service emails (receipts, security, quote updates) | Contract |
| Optional marketing emails | Consent (withdraw any time) |
| Security, fraud prevention and error monitoring | Legitimate interests |
| Accounting, tax and legal records | Legal obligation |
Where we rely on legitimate interests, we have assessed that the processing is necessary and does not override your rights, with extra care where young people could be affected.
7. Children and young athletes
Because StriideAi is used by young athletes, we apply additional privacy safeguards.
These include:
- collecting only limited information;
- using age-appropriate settings and content;
- requiring parent or guardian approval for users aged 8–16;
- avoiding unnecessary identity information;
- applying additional scrutiny to profiling and personalisation;
- providing clearer information about AI-supported features;
- avoiding advertising-driven profiling of children;
- maintaining defined retention and deletion controls; and
- assessing children’s privacy risks through our Data Protection Impact Assessment.
The best interests, safety and development of young users are important considerations in the design of StriideAi.
8. AI and machine learning
StriideAi uses AI to support selected sporting-training and recommendation features.
8.1 AI provider
StriideAi uses two separate AI flows:
- Text recommendations: OpenAI, accessed through server-side commercial API services.
- Video analysis: Google Gemma models in StriideAi's own Google Cloud environment (see 8.6).
8.2 What StriideAi sends
For applicable recommendation features, StriideAi sends only the sporting context required to generate the requested recommendation.
Direct identifiers such as:
- name;
- email address;
- phone number; and
- StriideAi account/user ID
are not deliberately included in the intended AI recommendation payload.
8.3 Model training
StriideAi uses commercial API services under terms where submitted API data is not used to train the provider’s general-purpose models by default.
8.4 Provider-side retention
The provider may temporarily retain API inputs and outputs for security or abuse-monitoring purposes in accordance with the applicable commercial API terms.
8.5 StriideAi retention
StriideAi’s current retention approach is:
- AI prompt/response content: maximum 90 days;
- AI technical/audit metadata: 12 months;
- records linked to an active security, safety or incident investigation: retained for as long as reasonably necessary for that investigation.
Technical/audit metadata is designed to be minimised and may include items such as timestamp, model/function used, request type, token/credit usage, success/failure and security/safety flags.
8.6 Practice video
Video analysis is a separate data flow from text recommendations:
- Who processes it: Google Gemma open models (4B and 12B parameter versions) run inside StriideAi's own secure, enterprise Google Cloud environment under STRIIDE SPORTS LTD's control. Footage is not sent to a consumer AI service or to OpenAI.
- What is sent: the video frames and minimal session context (sport, drill type, skill level). Names, email addresses and account IDs are not included.
- Where: Google Cloud data centres used by StriideAi's project; Google acts as our processor.
- Retention: raw video is kept for a maximum of 30 days; analysis results (scores, comments, recommended drills) remain until you delete them or your account.
- Model training: footage is not used to train Google's or any third party's models.
- Permission: the app asks for your explicit permission before any personal data is shared with an AI service, and you can withdraw it at any time.
8.7 User safeguards
StriideAi uses safeguards including:
- minimum-necessary information;
- server-side validation;
- PII-reduction or scrubbing controls;
- warnings not to submit unnecessary personal, medical or contact information; and
- ongoing product, security and privacy review.
AI recommendations are intended to support sporting development and are not used to make legal or similarly significant decisions about users.
9. Third-party providers
StriideAi uses specialist third-party providers to operate the service.
These may include providers for:
- cloud hosting;
- AI services;
- payments;
- authentication;
- app distribution;
- transactional email;
- technical monitoring;
- content/video delivery; and
- internal operational communications.
StriideAi maintains a Third-Party Providers & Subprocessors Register describing, where applicable:
- provider;
- service purpose;
- information involved;
- processing location;
- retention;
- legal role;
- DPA/contract status; and
- international-transfer position.
Not every third party acts as a subprocessor. Some providers may act as independent controllers for certain activities.
The current register is published in the StriideAi Trust Centre.
10. International data transfers
StriideAi’s core production environment is hosted on Amazon Web Services in London, United Kingdom (eu-west-2).
This includes the primary:
- application environment;
- database;
- file storage;
- caching;
- backups; and
- snapshots.
The transfers we actually make are:
| Provider | Purpose | Safeguard |
|---|---|---|
| OpenAI (USA) | AI text recommendations | UK International Data Transfer Agreement / UK Addendum to EU SCCs |
| Google Cloud | AI video analysis | UK Addendum to EU SCCs (Google Cloud Data Processing Addendum) |
| Resend (USA) | Service email delivery | UK Addendum to EU SCCs |
| Sentry (USA) | Error monitoring | UK Addendum to EU SCCs |
| Stripe, Apple, Google Play | Payments and app stores | Their own controller terms and UK transfer safeguards |
11. Data security
StriideAi uses technical and organisational measures designed to protect personal information.
These include, as appropriate:
- HTTPS/TLS encryption in transit;
- encryption at rest for production data stores and backups;
- MFA for privileged production access;
- named administrative accounts;
- least-privilege access;
- role-based access control;
- separation of production and staging environments;
- secure server-side secret management;
- secure mobile-device storage for credentials;
- PII-reduced technical monitoring;
- application and security logging;
- vulnerability management;
- backup and restore controls;
- account-deletion controls;
- formal incident-response procedures; and
- periodic access and security reviews.
No internet-connected service can guarantee absolute security, but we review and improve controls in proportion to the risks involved.
12. Data retention
We retain personal information only for as long as needed for the relevant purpose, service requirement, legal obligation, security need or legitimate business requirement.
Our current retention framework is:
| Information | Retention |
|---|---|
| Active account/profile data | While the account remains active |
| Deleted account data in live systems | Deleted promptly after a valid deletion request, subject to legally required records |
| AWS database backups/snapshots | 7 days |
| Application logs | 14 days |
| Sentry diagnostic events | 30 days |
| Resend delivery logs | 30 days |
| Practice videos | Maximum 30 days by default; earlier deletion where review/analysis is complete and the raw video is no longer needed |
| Video analysis results and reports | Until you delete them or your account (deleted within 30 days of account deletion) |
| AI prompt/response content | Maximum 90 days |
| AI technical/audit metadata | 12 months |
| Parent/guardian approval evidence | While the account is active plus 12 months after account closure |
| Payment/accounting records | 6 years after the transaction (UK tax law) |
| Security incident records | For as long as required to investigate, evidence and meet legal/compliance obligations |
Where information is removed from live systems, copies may remain temporarily in encrypted backups until the normal backup cycle expires.
13. Account deletion
How to delete your account today: email privacy@striide.app from the email address on your account and ask for deletion. We confirm receipt within 2 working days and complete deletion within 30 days, then email you to confirm.
When an account is deleted we remove your profile, practice videos, analysis results, AI conversations, saved content and notifications from live systems. Encrypted backups expire within 7 days after that.
We keep only:
| What we keep | Why | How long |
|---|---|---|
| Invoices and payment records | UK tax and accounting law | 6 years |
| Records of a deletion request | To prove we acted on it | 12 months |
| Records linked to an open security or safety investigation | Legal claims and safeguarding | Until the investigation closes |
An in-app button to start account deletion will be added before StriideAi is offered in the app stores.
14. Security incidents and personal-data breaches
StriideAi maintains a formal security-incident and personal-data-breach process.
The process covers:
- detection;
- escalation;
- containment;
- investigation;
- impact assessment;
- evidence preservation;
- recovery;
- notification assessment;
- corrective action; and
- post-incident review.
Where legally or contractually required, StriideAi will notify the relevant organisation, regulator and/or affected individuals.
Privacy or security concerns can be reported to:
15. Your rights
Depending on the circumstances, UK data-protection law may give you rights to:
- access your information;
- correct inaccurate information;
- request deletion;
- restrict processing;
- object to processing;
- receive portable information in certain circumstances;
- withdraw consent where processing is based on consent; and
- complain to the Information Commissioner’s Office.
To exercise a right, contact:
We may need to confirm identity before completing certain requests.
16. Schools, clubs and organisations
StriideAi may be used by individuals directly or through arrangements with schools, clubs, academies or other organisations.
The data-protection role depends on the deployment model.
Direct-user / school-recommended deployment
Where a pupil or parent creates a normal StriideAi account and the school does not instruct StriideAi to process a school-managed pupil dataset, StriideAi generally acts as controller for the StriideAi account and service.
Organisation-managed deployment
Where a school or other organisation instructs StriideAi to process personal information on its behalf, the applicable controller/processor responsibilities are documented in a Data Processing Agreement.
A dedicated school/cohort administration capability remains part of StriideAi’s institutional roadmap unless otherwise stated in the applicable service agreement.
Schools can request the StriideAi School Data Protection & Security Assurance Pack.
17. Cookies and similar technologies
The StriideAi website and applications may use necessary storage technologies and approved diagnostic or analytics services.
We will maintain a separate Cookie & Tracking Notice based on the technologies actually active in production.
We will not describe a provider as actively collecting analytics data unless that reflects the live production service.
18. Changes to this Privacy Policy
We may update this policy when:
- our services change;
- a material provider is introduced or removed;
- applicable legal requirements change;
- our data practices change; or
- we improve our privacy and security controls.
Material changes will be communicated through an appropriate channel.
19. Contact us
STRIIDE SPORTS LTD
Company number: 16734879
Registered office: 54 New Road, Ilford, England, IG3 8AT
Privacy email: privacy@striide.app
ICO registration: ZC112376
You may also complain to the UK Information Commissioner’s Office if you are dissatisfied with how your personal information has been handled.
Questions about this page? Email privacy@striide.app.