Privacy Policy

Vault Kinetics Inc. (“Vault,” “we”) makes the Vault One force platform, the Vault apps and Vault AI. This policy explains what personal information we collect through our products, website and business, how we use and share it, and the rights you have. It covers everyone who uses Vault, from individuals training on their own to schools, teams and clinics and the people they test. If our Terms of Service and this policy differ on how personal information is handled, this policy applies.

Words we use

• Customer: the organization or person that buys Vault and sets up an account.
• Authorized Users: the people a Customer lets sign in, such as coaches, teachers and clinicians.
• Participants: the people tested on Vault.
• Customer Data: identifiable information about Participants that a Customer or its Authorized Users put into Vault.

In short

• Customers own the identifiable data they collect about their Participants. We use it to provide Vault to them.
• We own de-identified data, which cannot reasonably identify anyone, and use it for research and to improve our products. We may license de-identified datasets, but never with data from anyone under 18 and never with photos or video.
• We never sell information that identifies a Participant, and we never use Participant data for advertising.
• We show a Customer’s name or logo only with its permission.
• You can ask us to access, correct or delete your information at info@vaultkinetics.com.
• Vault is not currently used with children under 13 (Section 5).

1. Information we collect

1.1 Information you give us

Name, email, phone number, organization and role when you create an account, buy from us, fill out a form or contact us. Shipping and billing details when you order. Our payment processor handles card numbers; we do not store them. Messages you send to support, answers to our surveys, and job applications.

1.2 Participant data

Information Authorized Users or individual users enter or record in Vault: name or another identifier, date of birth or age, sex, height, body mass, group or level, test results, force and pressure data from Vault platforms, and notes staff add, which can include health or injury information. Authorized Users can hide body mass from Participants.

1.3 Photos and video

Authorized Users can take photos or video in the Vault app during sessions. Using the camera is optional. Photos and video are stored inside the Vault app on the device that took them, not in the device’s photo library, unless an Authorized User saves them to a Participant’s profile, which uploads them to our cloud. Only signed-in Authorized Users can view them, on the device or in the cloud.

1.4 We do not identify people from movement, photos or video

We never use movement data, photos or video to recognize who someone is. When photos or video are used for research, faces are blurred, and face detection is used only to find the faces to blur.

1.5 Vault AI

The questions Authorized Users ask Vault AI and the answers it gives, which can include Participant data they choose to include.

1.6 Devices and apps

Device type, operating system, app version, connection details for Vault platforms, and crash and error reports. On Android 11 and earlier, Android requires location permission to find nearby Bluetooth devices. We use that permission only to connect to Vault platforms, not to track where you are.

1.7 Our website

Pages visited, referring sites, and device and browser type, measured as described in Section 8.

1.8 If you choose not to share

We will never penalize you for saying no. If you don’t provide information we need to run Vault, we may not be able to provide some or all of it. Saying no to optional uses, such as research or marketing, never changes the service you get.

2. How we use information

We use personal information to:

• Provide Vault: run tests, show results and reports, track progress over time, sync data between devices, and answer Vault AI questions.
• Support Customers and communicate about accounts, orders, updates and security.
• Keep Vault secure, prevent misuse, and fix problems.
• Improve Vault and develop new features, using de-identified data wherever we can.
• Create de-identified data for research (Section 4).
• Send Customer contacts news about Vault. You can unsubscribe anytime. We never send marketing to Participants based on their Participant data.
• Review job applications, comply with the law and enforce our agreements.

Vault AI

Vault AI answers are generated by a third-party AI model provider, currently Anthropic. The provider processes questions only to return answers and may not use them to train its models.

What we never do

• Sell information that identifies a Participant.
• Use Participant data for advertising or to build advertising profiles.
• Use movement data, photos or video to identify or recognize people.

3. Schools, teams and clinics

3.1 Who owns what

• Customer Data is owned by the Customer. It is the identifiable information about the Customer’s Participants, including test results, photos and video.
• De-identified Data is owned by Vault. It is data derived from Customer Data that cannot reasonably identify anyone (Section 4).
• Research Outputs are owned by Vault. They are the findings, models, benchmarks and features we build from De-identified Data.
• Platform Data is owned by Vault. It describes how the apps and Vault platforms perform: usage, diagnostics and error logs.

Ownership never limits privacy rights. Participants and parents keep the rights in Section 10, and any Platform Data that could identify a person is protected by this policy.

3.2 Our role

The Customer decides what Customer Data is collected and why. We use Customer Data only to provide Vault to that Customer and to create De-identified Data under Section 4. Under US state privacy laws we act as the Customer’s “service provider” or “processor” for Customer Data.

3.3 Customer responsibilities

The Customer gives its Participants, or their parents, the notices and obtains the consents the law requires. We can help.

3.4 Deletion

We delete Customer Data when the Customer asks or closes its account. The only exceptions are De-identified Data, which no longer identifies anyone, and backups, which are overwritten on a rolling schedule.

3.5 Requests from Participants

If a Participant asks us about Customer Data, we refer the request to the Customer and help it respond.

3.6 Health care providers

We do not currently sign HIPAA Business Associate Agreements. Health care providers covered by HIPAA should contact us before using Vault to record patient information.

3.7 Agreements take priority

If our agreement with a Customer gives Customer Data more protection than this policy, the agreement applies.

4. Research and de-identified data

Our goal is to advance the science of human movement and performance. We do that with de-identified data.

4.1 What “de-identified” means

De-identified data cannot reasonably be used to identify a person. Before we treat data as de-identified, we remove names, contact details and other direct identifiers, generalize details that could single someone out, and blur faces in photos and video. We will not try to re-identify it, and we contractually forbid anyone we share it with from trying.

4.2 How we use it

To study movement, performance and injury risk, to improve Vault and Vault AI, and to publish findings. We never publish statistics that describe fewer than 10 people, and we never name a Customer in research without its written approval.

4.3 Photos and video

We may use photos and video in research only after faces are blurred and other identifying details are removed.

4.4 De-identified datasets

We may license or sell de-identified datasets to research institutions, sports science and health organizations, AI developers, and equipment and software developers, under contracts that forbid re-identification. We never provide them to data brokers or advertisers. Datasets never include photos or video, or data from anyone under 18. A Customer can ask us to leave its data out of datasets we license by emailing info@vaultkinetics.com.

4.5 Ownership

De-identified Data and Research Outputs belong to Vault and remain after the original Customer Data is deleted, because they cannot identify anyone.

4.6 Identifiable research

If a research project ever needs information that identifies people, we will ask for consent first.

5. Children and teens

5.1 Children under 13

Vault is not currently offered for use with children under 13, and we do not knowingly collect their personal information. Customers should not enter information about children under 13. Before any school, team or clinic uses Vault with children under 13, we will put a children’s privacy notice and parental consent in place, as the Children’s Online Privacy Protection Act (COPPA) requires, and update this policy. If we learn that we collected a child’s information without that, we will delete it.

5.2 Teens aged 13 to 17

We use information about Participants aged 13 to 17 only to provide Vault to their Customer and to keep Vault secure. We use it for research, including de-identified research, only with the consent the law requires, such as the teen’s own consent under New York’s Child Data Protection Act. Saying no never changes the service.

5.3 Protections for everyone under 18

We never use information about anyone under 18 for advertising, never sell it, and never include it in datasets we license. We use a minor’s name, photo or video in marketing only with a parent’s or guardian’s written consent (Section 7).

6. How we share information

We never sell or share information that identifies a Participant, and we never use Participant data for advertising. We may license de-identified datasets, which cannot identify anyone (Section 4.4). Our website may share visit data with advertising partners through cookies (Section 8). Otherwise, we share personal information only:

• With the Customer and its Authorized Users.
• With service providers that help us run Vault, under contracts that limit their use of the information to that work and require them to protect it (listed below).
• For legal reasons, when the law requires it or to protect the rights and safety of people or Vault.
• In a business transfer, such as a merger or acquisition. The new owner must honor this policy.
• With your consent.

Service providers

All of our service providers store and process data in the United States.

• Cloud hosting and database: store and process Vault data.
• Website hosting: run this website.
• AI model provider: generate Vault AI answers.
• Payment processing: process orders and payments.
• Email and customer support: send service messages and handle support.
• Meeting scheduling: book calls with our team.
• Crash and error reporting: diagnose app problems.
• Website analytics: measure website use.

Customers can ask us for the names of the service providers that handle their data.

7. Names, logos and images

7.1 Customer names and logos

We show a Customer’s name or logo on our website or in marketing only with its permission, and we remove it when the Customer asks.

7.2 Participants

We use a Participant’s name, photo, video or story in marketing only with that person’s written consent, or a parent’s or guardian’s written consent if the Participant is under 18.

7.3 Group results

We publish results about a Customer’s Participants as a group, such as “average jump height rose 8%,” only with the Customer’s approval and only for groups of at least 10 people.

8. Cookies and website analytics

The Vault apps and the signed-in parts of this website contain no advertising tools.

• Strictly necessary cookies keep you signed in and protect the site from bots and abuse.
• Analytics: we measure page visits and site performance with Vercel Web Analytics, which does not use cookies or track you across other sites.
• Scheduling: if you book a call with us, our scheduling provider may set its own cookies.
• Advertising cookies: we may use advertising cookies and pixels on our public pages to measure our ads and to show ads to people who visited our website. You can block them in your browser settings or by sending a Global Privacy Control signal. They are never used in the Vault apps, on pages that show Participant data, or with Participant data.
• Browser signals: we treat Global Privacy Control signals as a request to opt out of any sale or sharing. There is no common standard for “Do Not Track” signals, so we do not respond to them.

9. Security, storage and retention

9.1 Security

We encrypt data in transit and at rest, require sign-in to view Participant data, limit each Customer’s access to its own data, and limit staff access to the people who need it. No system is perfectly secure, and we keep improving these protections.

9.2 Breach notice

If a security breach affects a Customer’s data, we notify the Customer without undue delay and within 72 hours of confirming it. We also notify affected individuals and regulators as the law requires, including under New York’s SHIELD Act.

9.3 Where data is stored

We store and process personal information in the United States.

9.4 How long we keep it

We keep personal information only as long as we need it for the purposes in this policy.

• Customer Data, including photos, video and Vault AI history: while the Customer’s account is active. Deleted when the Customer asks or closes its account.
• Account and contact details: while the account is active, then only as long as needed for the records below.
• Orders, billing and warranty records: as long as tax, accounting and warranty obligations require.
• Support messages: as long as needed to resolve the request and keep a record of it.
• Backups: overwritten on a rolling schedule.
• De-identified data: may be kept indefinitely, because it cannot identify anyone.

10. Your rights

10.1 Everyone

You can ask us to:

• Tell you what personal information we hold about you and give you a copy.
• Correct it.
• Delete it.
• Stop sending you marketing emails.
• Withdraw a consent you gave.

Email info@vaultkinetics.com. We will verify your identity before acting and respond within 45 days. We will not treat you differently for using these rights.

10.2 Participants of a Customer

If your information is in Vault because a school, team or clinic tested you, we will pass your request to that Customer and help it respond.

10.3 Parents

Parents and guardians can make these requests for their minor children.

10.4 What deletion covers

Deleting your information removes it from our active systems. It does not affect de-identified data or datasets already created, which cannot identify you, or records the law requires us to keep.

10.5 US state privacy laws

Residents of California, Colorado, Connecticut, Virginia and other states with privacy laws have the rights above, plus the right to opt out of sale, sharing, targeted advertising and profiling. We never sell or share information that identifies a Participant, or use Participant data for targeted advertising. Website visitors can opt out of advertising cookies by blocking them in their browser or by sending a Global Privacy Control signal. You can use an authorized agent, and if we deny a request, you can appeal by replying to our decision. California residents: we do not share personal information with third parties for their own direct marketing.

10.6 EU and UK

If you are in the European Union or United Kingdom, you also have the rights to restrict or object to our use of your information and to move it to another service, and you can complain to your data protection authority.

11. Changes and contact

11.1 Changes

When we update this policy, we post it here with a new “Last updated” date. For material changes, we email Customers at least 30 days before they take effect.

11.2 Contact us

• Vault Kinetics Inc., 1 Lamb Rd, Nashua, New Hampshire 03062
• Phone: (617) 299-1346
• Email: info@vaultkinetics.com
• Privacy contact: Paul Douglass, Chief Operating Officer