Trust Centre

Schools & Clubs Assurance

StriideAi is designed for athletes, including children and young people.

Our approach is based on a simple principle:

Collect only what we need, protect it properly, and use it responsibly.

For school deployments, StriideAi applies:

data minimisation;
age-appropriate processing;
parent/guardian approval for users aged 8–16;
UK-hosted core infrastructure;
encryption in transit and at rest;
MFA and least-privilege privileged access;
defined retention and deletion;
documented incident response;
third-party provider governance;
DPIA and Legitimate Interests review;
responsible AI controls.

StriideAi does not sell or rent pupil information.

StriideAi does not use children's information to create advertising profiles.

2. Product Purpose

StriideAi provides sports-development functionality including:

structured training content;
personalised recommendations;
progress tracking;
practice recording;
coach review where enabled;
AI-supported sporting recommendations;
subscriptions and account services;
technical support and service communications.

The information collected is used to provide, protect and improve the service.

3. Young-Athlete Privacy by Design

StriideAi was designed to minimise unnecessary collection from young users.

Key principles include:

use of avatars where practical;
limited profile information;
use of age range and sport and level only where relevant to suitability;
parent/guardian approval for users aged 8–16;
avoidance of unnecessary identity information;
no advertising-driven profiling of children;
defined retention and deletion;
separate handling of practice video and AI recommendation data;
minimum-necessary AI inputs.

Where the same outcome can be achieved using less personal information, StriideAi aims to use the less intrusive approach.

4. Data Processing and Lawful Basis

StriideAi maintains a documented lawful-basis assessment.

Depending on the processing activity, the lawful basis may include:

Contract — where processing is necessary to provide a requested account, training, subscription or progress feature.
Consent — where required for optional communications or another consent-based activity.
Legitimate interests — for limited, documented purposes such as service security, fraud prevention, reliability monitoring, customer support and proportionate service improvement.
Legal obligation — where required by applicable law or regulation.

Where legitimate interests are relied upon, StriideAi records:

the purpose;
necessity;
whether a less intrusive alternative exists;
the likely impact on users;
additional impact on children;
safeguards;
balancing conclusion.

For product improvement, anonymised or aggregated information is preferred where practical.

5. Personal Information Processed

Depending on the features used, StriideAi may process:

Account and profile information

name;
email address;
avatar;
age range;
parent/guardian approval status;
authentication information;
limited social-login data where used.

Sporting and training information

skill level;
playing role;
playing experience;
training goals;
equipment access;
training availability;
learning preference;
assessment answers;
training history;
progress.

Practice video

user-recorded or uploaded practice footage;
coach review where enabled.

AI-supported recommendation data

age range;
skill level;
playing experience;
training context;
goals;
available equipment;
sporting questions or assessment responses.

Technical information

device and app diagnostics;
security logs;
crash/error information;
limited operational metadata.

Payment/subscription information

transaction and subscription identifiers;
billing status;
accounting/support records.

StriideAi does not store full payment-card numbers.

6. Children and Parent/Guardian Approval

StriideAi is available to users aged 8 and above.

Users aged 8–16 require parent or guardian approval.

The approval process is designed to:

prevent unapproved use by younger users;
record approval status;
minimise unnecessary parent/child identity information;
support age-appropriate use.

Parents/guardians are encouraged to help younger users understand:

what information StriideAi uses;
how AI-supported features work;
what not to enter into free-text fields;
how practice videos are handled;
how to request deletion.

7. Data Sharing and Third-Party Providers

StriideAi uses specialist providers to operate the service.

These may include providers for:

cloud hosting;
AI;
payments;
authentication;
transactional email;
diagnostics;
app distribution;
video/content delivery.

StriideAi maintains a Third-Party Provider & Subprocessor Register that records:

provider;
purpose;
information involved;
legal role;
processing location;
retention;
contractual safeguards;
international-transfer status.

StriideAi does not authorise providers to use pupil information for unrelated purposes.

8. Current Core Providers

Subject to final legal-role confirmation, current providers include:

Provider	Purpose	High-level role
Amazon Web Services	Core infrastructure, database, storage, backups	Processor
OpenAI	Selected AI recommendation functions	Processor for StriideAi API processing
Sentry	Error/crash monitoring	Processor
Resend	Transactional email	Processor
Stripe	Payments/subscriptions/payouts	Mixed role depending activity
Apple	App distribution, billing, Sign in with Apple	Platform/provider role varies
Google	App distribution, billing, sign-in, YouTube services	Platform/provider role varies
Meta/Facebook	Social login	Separate platform role
Slack	Internal operational alerts	Processor where personal information is transmitted

9. Data Location and International Transfers

StriideAi's core production infrastructure is hosted on Amazon Web Services in:

London, United Kingdom — eu-west-2

This includes:

application infrastructure;
production database;
file storage;
caching;
backups;
snapshots.

Some specialist providers may operate internationally.

Where a restricted international transfer occurs, StriideAi documents the transfer and applies an appropriate legal safeguard where required.

This may include:

UK adequacy regulations;
UK International Data Transfer Agreement;
UK Addendum to approved Standard Contractual Clauses;
another lawful transfer mechanism.

10. Security Measures

StriideAi applies layered technical and organisational controls.

Infrastructure security

AWS-hosted production environment;
separated production and staging environments;
encryption at rest;
encrypted backups;
TLS/HTTPS in transit.

Access security

named privileged accounts;
MFA;
least-privilege permissions;
role-based access;
periodic access reviews;
restricted direct production access.

Application security

server-side validation;
controlled authentication;
secure mobile credential storage;
backend-only secret keys;
managed server-side secrets;
dependency/security scanning;
secure code review.

Monitoring

error/crash monitoring;
technical logging;
PII reduction/scrubbing;
operational alerts;
security escalation.

Resilience

scheduled backups;
defined backup retention;
restore testing;
incident recovery process.

11. Security Incident and Personal Data Breach Response

StriideAi maintains a formal incident-response procedure covering:

detection;
internal escalation;
severity assessment;
containment;
investigation;
evidence preservation;
recovery;
personal-data-breach assessment;
notification decision;
corrective action;
post-incident review.

Where legally or contractually required, StriideAi will notify:

relevant institutional customers;
affected individuals;
the appropriate regulator.

Institution-specific notification arrangements should be included in the relevant agreement or DPA.

12. Data Retention

StriideAi maintains defined retention periods rather than relying only on general phrases such as "as long as necessary".

Current retention position

Data category	Retention
Active account/profile	While account is active
Deleted account data in live systems	Prompt deletion following valid deletion request
AWS backups/snapshots	7 days
Application logs	14 days
Sentry diagnostic logs	30 days
Resend delivery logs	30 days
Practice video	Maximum 30 days, with earlier deletion where the review purpose is complete
AI prompt/response content	Maximum 90 days
AI technical/audit metadata	Up to 12 months
Parent/guardian approval record	Account lifetime + 12 months
Payment/accounting records	Applicable statutory/accounting retention
Security incident records	For as long as justified by investigation/compliance needs
Deleted data in encrypted backup	Until normal backup expiry

13. Practice Video

Practice-video functionality is treated as a separate data flow from AI recommendation processing.

Where enabled:

the user chooses to record or upload a video;
footage may contain an identifiable child or adult;
the file is stored in Striide-controlled cloud storage;
access is restricted to the user and authorised review workflow;
the default retention period is a maximum of 30 days;
deletion may occur earlier where the review purpose is complete;
account deletion removes associated practice video from active storage;
practice video is not sent to OpenAI under the current recommendation workflow.

Where possible, StriideAi retains the outcome of a review rather than the raw video.

Examples:

coach comments;
score;
recommendations;
progress metrics.

14. AI & Machine Learning

StriideAi uses OpenAI commercial API services for selected sporting recommendation functions.

Current data flow

The user completes a sporting assessment or asks a sporting question.
The StriideAi backend selects only relevant sporting context.
Direct identifiers are excluded from the intended AI payload.
Validation and PII-reduction controls are applied.
The request is sent server-side to the approved AI provider.
The recommendation is returned to StriideAi.
Retention follows StriideAi and provider rules.

Direct identifiers not deliberately included

name;
email;
phone number;
StriideAi user ID;
StriideAi account ID.

Typical sporting context

age range;
skill level;
playing experience;
goals;
training availability;
access to equipment;
learning preference;
sporting question.

Training of general-purpose models

StriideAi uses commercial API services under terms where submitted API data is not used to train the provider's general-purpose models by default.

AI retention

StriideAi prompt/response content: maximum 90 days.
StriideAi technical/audit metadata: up to 12 months.
Provider-side temporary retention: according to the provider's applicable commercial API terms.

User safeguards

free-text warnings;
input validation;
PII reduction/scrubbing;
age-aware prompting;
no legal or similarly significant decisions.

Practice videos are not sent to OpenAI under the current recommendation workflow.

15. Data Protection Impact Assessment

StriideAi maintains a DPIA covering:

children and young athletes;
data minimisation;
age-related processing;
parent/guardian approval;
profiling/personalisation;
AI;
practice video;
third-party providers;
international transfers;
security;
retention;
deletion;
school/institutional use.

The DPIA is reviewed when there is a material change to:

AI provider/model/purpose;
children's data;
school administration;
video analysis;
health/biometric processing;
international transfers;
security architecture.

A public DPIA summary can be provided.

The full internal DPIA may be shared under controlled disclosure where justified.

16. Legitimate Interests Assessment

StriideAi maintains LIAs for relevant legitimate-interest processing.

Likely examples include:

service security;
fraud/abuse prevention;
reliability/error monitoring;
customer support;
proportionate product improvement.

Each LIA documents:

purpose;
necessity;
alternatives;
impact;
children's interests;
safeguards;
balancing conclusion.

For product analytics and service improvement, StriideAi prefers anonymised or aggregated information where practical.

17. Account Deletion

Users can request deletion through the available account-deletion process.

Deletion is designed to:

remove the active user profile;
remove associated saved content;
remove related notifications;
remove user-uploaded practice videos;
remove or de-identify associated records where appropriate;
retain only legally necessary records;
allow encrypted backup copies to expire under the normal backup lifecycle.

Payment/accounting records may be retained where required by law.

18. School Deployment Model

Current / direct-user deployment

For current school use where pupils use standard StriideAi accounts:

the pupil/parent completes the StriideAi account process;
parent/guardian approval applies for users aged 8–16;
the school does not need to supply unnecessary pupil identity information;
StriideAi manages the account under its Privacy Policy.

Future institutional administration

Dedicated school/cohort administration remains future product scope unless formally released.

Potential future functionality may include:

cohorts;
school-admin roles;
pupil lifecycle management;
school-triggered deactivation;
institutional reporting;
cohort administration.

This functionality should not be represented as currently available until released.

19. Controller / Processor Roles

The legal role depends on deployment.

Scenario A — School recommends StriideAi

Where the school recommends StriideAi and the pupil/parent creates a normal StriideAi account independently:

StriideAi generally acts as controller for the StriideAi account and service processing;
the school does not necessarily instruct StriideAi to process pupil information on its behalf.

Scenario B — School provides data or instructs StriideAi

Where the school provides pupil information and instructs StriideAi to process it:

the school may act as controller;
StriideAi may act as processor;
the arrangement should be documented in a Data Processing Agreement.

Each institutional deployment should be assessed on its actual data flow.

20. Data Processing Agreement

Where StriideAi acts as processor, the DPA should cover:

parties and roles;
documented instructions;
purpose/nature/duration;
categories of personal data;
categories of data subjects;
confidentiality;
technical and organisational measures;
subprocessors;
international transfers;
data-subject-rights support;
breach notification;
DPIA/regulator assistance;
return/deletion on termination;
backup expiry;
proportionate audit/assurance rights.

Final wording should be reviewed by UK counsel.

21. School Rights and Requests

Depending on the deployment and legal role, StriideAi can support requests concerning:

access;
correction;
deletion;
restriction;
objection;
portability where applicable;
withdrawal of consent.

Where StriideAi acts as processor, assistance will be provided to the controller as defined in the DPA.

22. Assurance Documents Available to Schools

The following should be available either publicly or under controlled disclosure:

Public / standard

Privacy Policy
Terms of Service
Children's Privacy Notice
AI Transparency Notice
Trust Centre
Public DPIA Summary
Third-Party Provider & Subprocessor Register
Data Retention & Deletion Summary
Security Overview
International Transfer Statement

Controlled / on request

School DPA
Full DPIA
LIAs
Technical & Organisational Measures schedule
Incident Response Procedure
Detailed Retention Schedule
Vendor Due-Diligence Register
International Transfer Assessments
Security testing / penetration-test summary where appropriate
ISO 27001 documentation/certificate only when formally achieved

23. Recommended School Procurement Answers

Where is StriideAi hosted?

Core production services are hosted in AWS London (eu-west-2).

Is information encrypted?

Yes. Core production information is encrypted in transit and at rest.

Is MFA used?

Yes, for privileged production access.

Does StriideAi sell pupil information?

No.

Is pupil information used for advertising?

No advertising-driven profiling of pupils is part of the service design.

Who provides AI?

OpenAI commercial API services are used for selected sporting recommendation functions.

Is pupil information used to train general-purpose AI models?

StriideAi uses commercial API services under terms where submitted API data is not used to train the provider's general-purpose models by default.

Are pupil names/emails sent to OpenAI?

Not deliberately in the current sporting recommendation workflow. Direct identifiers are excluded from the intended payload.

Are practice videos sent to OpenAI?

No, not under the current recommendation workflow.

How long are practice videos retained?

Maximum 30 days by default, with earlier deletion where the review purpose is complete.

How long is AI content retained?

AI prompt/response content is retained for a maximum of 90 days. Minimized technical/audit metadata may be retained for up to 12 months.

Can users delete their accounts?

Yes, subject to limited legal/accounting retention and backup expiry.

Does StriideAi maintain a DPIA?

Yes.

Does StriideAi maintain a breach process?

Yes.

Does StriideAi maintain a third-party provider register?

Yes.

Does StriideAi have dedicated school administration?

Not yet. Dedicated school/cohort administration is future institutional scope. A walkthrough of the planned administration interface for schools can be found here: School admin portal walkthrough.

Questions about this page? Email privacy@striide.app.