ReadLab Hoops Privacy Policy for Organizations

1. Who we are and what this covers

ReadLab Sports LLC ("we", "us") makes ReadLab Hoops, a basketball training application for Meta Quest devices (the "App"), and the ReadLab Hoops customer portal at readlabsports.com (the "Portal"). This policy explains what information the App, the Portal and our website collect, where it comes from, how it is used, who it is shared with, how long it is kept, and the choices and rights you have. It is written to be readable by the people it affects; if any part is unclear, ask us (Section 15). We provide this policy in a form accessible to people with disabilities; contact us for an alternative format.

ReadLab Hoops is sold to Organizations. App Users, such as athletes and coaches, use the App under their Organization's account. If you are an App User or a parent, your Organization decides how ReadLab Hoops is used and is your first point of contact for questions about your information (Section 2).

2. Our role: your Organization and us

For information about App Users (drill results and practice history), your Organization is the controller: it decides to use ReadLab Hoops and who uses its devices, and is responsible for obtaining any consents the law requires, including parental consent for children. We act as the Organization's service provider under a written agreement: we handle that information only to provide the service to the Organization, never for our own marketing, and never sell or share it.

For Portal account holders' own account information, and for the technical information the App sends so that we can license, secure and operate the service, we are the business responsible.

3. Information we collect and where it comes from

We collect information from three sources: your Organization (its devices and the people it invites to the Portal), you (what you do in the App and the Portal), and automatically from the device and your connection. We also receive limited information from Meta's platform when you use multiplayer features. We do not buy information about you from anyone. When you contact us through our website or by email, we also receive what you choose to send us (Section 3.8).

3.1 From your Organization

• Devices: the devices your Organization adds to its account, the name it gives each one, and their seat settings.
• Portal users: the people it invites to the Portal (Section 3.7).
• Purchases: if your Organization buys licenses in the Portal, our payment processor collects the buyer's billing and payment details on its own pages; we never receive full card numbers. The billing address comes to us from the payment form the buyer fills in with our payment processor (Stripe), which is how we keep your Organization's billing details current. We keep records of your Organization's purchases and subscriptions.

The App has no individual profiles. Your Organization enters no names or other details about the people who use its devices, apart from what it may send us to get the App onto its devices (Section 3.5).

3.2 Created when you use the App

• Drill and session results: for each drill you complete — which drill, difficulty, how long it took, hits and misses, a grade, and drill-specific results (for example, how many zones you reached or whether you read a screen correctly). Results are recorded for the device and your Organization, not for a person. Nothing is sent about a drill while it is in progress; results are uploaded when a session ends.
• App settings and progress: settings such as court size and passthrough, and your progress through the in-app tutorial.
• Performance summaries: per-session summaries of the device's frame rate and battery level, used to keep the App running well on your hardware.

The App uses your device's hand tracking and position to run drills. That tracking data is processed on the device and is not transmitted to us or stored, except as the drill results described above. The App does not record video or images.

3.3 Spoken coaching

The App's coaching lines are turned into speech using Meta's Voice SDK. Only the script text is sent for synthesis; nothing about you is included. The App does not listen for voice commands.

3.4 Multiplayer

When you use multiplayer features, your position, gestures and voice are transmitted to the other App Users in your session through Normcore, a real-time networking service operated by Normal VR. This data passes through Normcore's servers to reach the other App Users and is not recorded by us.

3.5 From Meta's platform

The App runs on Meta Quest and uses Meta's platform services. On every launch the App confirms with Meta that it is entitled to run. When you use multiplayer features, the App uses your Meta user ID and profile name to show who is in the session, to set your presence, and to let you invite others or join by invitation and deep link. This information is used inside the App and by Meta; we do not store your Meta user ID or Meta profile on our servers. Meta's own privacy policy governs Meta's handling of your account.

Getting the App. ReadLab Hoops is installed through Meta, including through release channels Meta runs for us, under Meta's terms. Meta may show us which Meta accounts can install the App, and your Organization may send us the email address of a Meta account so we can give it access. We use this only to make the App available to your Organization's devices. Meta requires these accounts to belong to adults.

3.6 Automatically, from the device and your connection

Each time the App starts it sends us technical information about the device and the installation so that we can license the App to your Organization, keep it secure, detect misuse (including unauthorized copies), and support you: a device identifier and an installation identifier; the device model, operating system and build details; the App version and how it was installed; battery level, free storage and network type; the device's clock and time zone; and counts of any results waiting to be uploaded. When the App or the Portal contacts our servers we also record the connection's IP address and the approximate (city-level) location derived from it, the date and time, and which version of our service was used.

If the App crashes, a crash report (device model, operating system, App version and technical details of the crash, with no user identifiers) is sent to Unity Cloud Diagnostics, a service operated by Unity Technologies.

This technical information is sent by every copy of the App, including copies that are not signed in to any Organization; we use it to detect and investigate unauthorized distribution of the App.

3.7 Portal accounts

If your Organization gives you a Portal account, we collect your name, email address and role; how you sign in (with Google, with Microsoft, or with a link we email to you — the Portal never uses a password); whether you have set up an authenticator app (the app's secret is held by our sign-in provider and never by us); sign-in records; and an audit log of the actions you take in the Portal (for example, adding, releasing or removing a device, or inviting a colleague).

Refused sign-in attempts. Portal accounts are by invitation only. If someone tries to sign in to the Portal with an email address that has not been invited, or asks for a sign-in link for one, we do not create an account and we do not send the email. We record the email address that was used, how they tried to sign in, the IP address the attempt came from, and the time. We use this to detect and stop abuse and to help people who used a different address from the one they were invited with.

Emails we send you. We send sign-in links, invitations and other emails about the service through our email provider (Section 8). We keep a record of each one: the address it went to, what kind of email it was, when it was sent and whether it was sent. We do not keep a copy of what it said. For some emails about your account, we also record whether the email was opened and whether a link in it was used, so we know our emails are reaching people. We keep only the time, never your IP address or details of your device.

Accepting the Customer Agreement. When a Portal owner accepts the ReadLab Hoops Customer Agreement for their Organization, we record who accepted it (their name, email address and role as they were at that moment), which version they accepted, that they confirmed they are authorized to accept it for the Organization, the time, the IP address the acceptance came from and the browser's user agent. If the Organization signs a paper copy instead, we record the signer's name, title and email address, the date they signed, and where our copy of the signed document is kept. This record is the evidence of the agreement between your Organization and ReadLab.

3.8 When you contact us

If you write to us using the contact form on our website, or by email, we receive what you choose to send. The form asks for your name, email address and, if you wish, a phone number; your city, state and country; your role, your organization's type and name, and about how many athletes you work with; how many Meta Quest 3 and 3S devices you have; where and how you would use ReadLab Hoops and which features interest you; how you heard about us; and any questions or comments. The form sends this as an email to our sales team, through our email provider (Section 8), and Google Workspace hosts that mailbox. We use it to answer you and to talk with you about ReadLab Hoops, and for nothing else. We do not keep another copy of what the form sends. The form also asks, optionally, whether you are 18 or older, so that we can answer in the right way; it does not ask your age or date of birth.

Checking that a person sent it. Before the form sends anything, Cloudflare Turnstile checks that a person, not an automated program, is using it. To do that it processes information about your browser and device, including your IP address. We receive only the result of the check.

4. Categories under California law

California law asks businesses to describe personal information using set categories. In the 12 months before the effective date, and going forward, we collect the following categories, for the purposes in Section 6, and disclose them only to the service providers in Section 8. We have not sold or shared personal information in any category.

5. Information we do not collect

We do not collect names of App Users, dates of birth, home addresses, photographs, precise geolocation, biometric identifiers, consumer health data, advertising identifiers, or free-text messages other than what you choose to write to us when you contact us (Section 3.8). We do not show advertising, do not sell personal information, do not share it for cross-context behavioral advertising, and do not use it for targeted advertising to students or to build profiles of students for purposes other than the coaching service.

6. How we use information

We do not use information about App Users to build profiles for any purpose other than the coaching features their Organization has chosen, and we do not make decisions about individuals by automated means that produce legal or similarly significant effects. We do not use sensitive personal information for any purpose other than providing and securing the service.

Why we may use it

We use information only when we have a reason the law recognizes. Where we handle information for your Organization (Section 2), the Organization decides why it is used, and we use it only on its instructions. Otherwise:

• To provide the service under our agreement with your Organization: the App, the Portal, licensing, purchases and support.
• For our legitimate interests in keeping the service secure, detecting misuse and unauthorized copies, fixing problems, improving the App with aggregated statistics, and answering inquiries, balanced against your rights.
• To meet legal obligations, such as tax and accounting records and responding to lawful requests.
• With consent, where we ask for it, which you may withdraw at any time without affecting what we did before.

7. Children, and notice to parents

ReadLab Hoops is used by young athletes under the supervision of their Organization. We design for that: the App has no individual profiles, so each device records practice under its Organization's shared Guest profile, which records nothing about a particular person; it asks no one's name, age or date of birth; and it never uses a child's information for advertising, for profiling beyond the coaching service, or for any purpose other than providing the service to the Organization. We do not condition a child's use of the App on providing more information than is reasonably necessary to use it.

7.1 What we collect from children

From a child using the App we collect: drill results and App activity (Section 3.2), recorded for the device and not for the child; multiplayer voice and movement relayed to other App Users if the Organization uses multiplayer (Section 3.4); and the technical information every device sends (Section 3.6). We use it only as described in Section 6 and disclose it only to the service providers in Section 8 and to the child's Organization. Meta requires the account used to install the App (Section 3.5) to be an adult's, never a child's.

7.2 Consent

The Organization is responsible for obtaining any consent the law requires before a child uses its devices, including verifiable parental consent under the U.S. Children's Online Privacy Protection Act (COPPA) where it applies. Under COPPA, a school may consent on parents' behalf when the App is used for the school's educational purpose; the Organization agrees in its contract with us that it has done so, and we provide this notice to the Organization to pass on to parents. We do not knowingly collect personal information directly from children outside the Organization's account. Our contact form asks only, and optionally, whether someone is 18 or older; if we learn that a message came from a child under 13, we use the contact details in it only to reply once, for example to ask a parent to get in touch, and then delete it.

7.3 Parents' rights

A parent or guardian may review the personal information collected from their child, have it deleted, and refuse to permit any further collection or use. Contact us (Section 15) or the child's Organization; we will verify that you are the child's parent or guardian, then act on the request or, where the Organization controls the information, refer it to the Organization and confirm that it has been handled. If we learn that we hold a child's personal information that an Organization was not authorized to provide, we will delete it.

7.4 Operators

The operator that collects and maintains children's personal information through the App is ReadLab Sports LLC, 1110 W Elliot Rd #1081, Tempe, AZ 85284, United States, telephone 928-382-0108, email privacy@readlabsports.com. The service providers in Section 8 process information on our behalf.

We do not sell or share the personal information of anyone under 16, and we have no actual knowledge of doing so.

8. How information is shared

• With your Organization. Drill results and practice history are shown in the App on your Organization's devices. That is the purpose of the service.
• With service providers that help us run ReadLab Hoops, who may use the information only to provide their service to us and are bound by contract to protect it:

• For legal reasons: when required by law, legal process, or to protect the rights, safety and security of our users, our Organizations or us.
• In a business transfer: if we are involved in a merger, acquisition or sale of assets, information may be transferred as part of that transaction, subject to this policy.

We do not sell personal information, we have not done so in the preceding 12 months, and we do not share personal information for cross-context behavioral advertising. We do not disclose personal information to third parties for their own direct-marketing purposes (California "Shine the Light").

9. How long we keep information

We keep information for as long as we need it for the purposes in this policy, including our legal, tax and accounting obligations, and then delete it or remove what identifies anyone. Within that rule:

Organization information (devices, results, practice history, Portal accounts) is kept for as long as the Organization's account is active, and afterwards so that the Organization can return to its history if it comes back to ReadLab Hoops. An Organization can ask us to delete its information at any time: we first provide the Organization with an export, hold the information for 30 days in case the request was made in error, then permanently delete it.

Portal accounts of people who leave. When a person is removed from an Organization's Portal, they lose access at once. We keep their email address and sign-in account for 30 days, so that a removal made by mistake or without authority can be looked into, and then erase them: the sign-in account is deleted and the email address is replaced, and our audit records keep only an anonymous reference to what the person did. A removed person may ask us to erase this sooner (Section 10.3). There are two exceptions: an agreement they accepted for their Organization, kept as described next, and our record of the emails we sent them, kept as described after it.

Agreement acceptance records (Section 3.7) are kept for as long as the Organization is a customer and for six years after the relationship ends (when its agreement ends, or when it asks us to delete its information), because they are the evidence of the agreement and may be needed if a question about it arises in that time. They are not erased when the person who accepted is removed from the Portal or erased, or when the Organization's other information is deleted; they are deleted when that period ends.

Records of the emails we send (Section 3.7) are kept, with the address each one went to, for as long as we provide the service. They show what we sent and when, and they are not erased when a person is removed from the Portal or when the Organization's other information is deleted.

Security records. We keep records we need to protect ReadLab Hoops, our customers and the people who use it from fraud, misuse and unauthorized use for as long as they are needed for that purpose. They are not removed when an account is closed or its other data is deleted.

Refused sign-in attempts (Section 3.7) are kept for 30 days and then deleted automatically. They are stored in a log that cannot be edited, so a request to erase one is met by that automatic deletion, which is never more than 30 days away.

Inquiries (Section 3.8) are kept in our email for as long as we are talking with you, and deleted within 24 months of our last exchange. If you become a customer, what we need to serve you becomes part of your Organization's information.

Technical information (Section 3.6) is kept for the security and licensing purposes described in Section 6; the criteria for keeping it are the need to identify devices licensed to Organizations and to detect misuse over time. The IP address and approximate location recorded when the App contacts our servers are deleted after 90 days, for every device; the rest of that record is kept. Audit logs are kept to demonstrate who did what with your information. Backup copies are kept for a limited period and cannot be altered before it ends; information deleted from the service leaves every backup within 90 days. Where the law where you live sets shorter limits, we apply them.

10. Your rights and choices

10.1 Choices in the Portal

• Your Organization's administrators can remove a device from its account, and remove a person's Portal access, in the Portal.
• Your Organization can ask us for a copy of its information, or to delete it (Section 9).

10.2 Your privacy rights

Wherever you live, you may: know what personal information we collect, use and disclose, and get access to it; correct inaccurate information; delete your information; receive a copy in a portable form; object to or restrict some uses of it; withdraw consent you gave us at any time, which does not affect what we did before; complain to the authority that oversees privacy where you live (Section 10.3); and not be discriminated against for exercising these rights. We will not deny you service, charge a different price or provide a different level of service because you exercised a right. Some laws, such as California's, also give a right to opt out of the sale or sharing of personal information and of targeted advertising (we do none of these) and to limit the use of sensitive personal information (we use it only to provide and secure the service).

10.3 How to make a request

Your Organization controls the results recorded on its devices, so you may make a request to it, or to us by email at privacy@readlabsports.com. We will confirm receipt within 10 business days and respond within 30 days; if a request needs longer, we will tell you why within those 30 days, and never take longer than the law where you live allows. Where your Organization controls the information, we refer your request to it and help it respond. There is no charge unless requests are excessive.

Verification. To protect your information, we match the details in your request against what we hold (for Portal Users, a message from your account email; for App Users, confirmation through your Organization; for parents, confirmation that you are the child's parent or guardian). We will not verify by asking for more personal information than necessary. Authorized agents may submit requests with your signed permission; we may ask you to confirm directly. Appeals. If we decline a request, you may appeal by replying to our decision; we will respond within 30 days with the reasons, and you may complain to the authority that oversees privacy where you live, such as your state Attorney General or your country's data protection authority.

11. How we protect information

Information is encrypted in transit and at rest. Access to information is limited to staff who need it, protected by multi-factor authentication, and recorded in an audit log. Portal owners and administrators must confirm their sign-in with an authenticator app before they can make changes to their Organization's devices or people. Backups are stored separately and cannot be altered or deleted before their retention period ends. On devices, information is stored in the App's private storage. No method of transmission or storage is completely secure; if we learn of a breach affecting your information, we will notify affected Organizations and individuals, and authorities where required, without undue delay and within the time the law requires.

12. Where information is stored

Information is stored and processed in the United States, unless your Organization's agreement with us says otherwise. Information about people outside the United States is transferred here only under safeguards recognized by law. Our service providers in Section 8 are contractually bound to equivalent protections.

13. Cookies, tracking signals and "Do Not Track"

The Portal and our website use only the cookies and similar browser storage that are strictly necessary to sign you in and keep the site secure. When you use our contact form, Cloudflare Turnstile runs in your browser to check that you are a person; it is part of keeping the site secure, and we do not use it for advertising or to follow you across websites. We do not use advertising or third-party analytics cookies or trackers, and no third party collects personal information about your online activities over time and across websites through our services. Some of our emails tell us when they are opened or a link in them is used (Section 3.7); that record is ours alone. Because we do not sell or share personal information or track you across sites, there is nothing for a "Do Not Track" browser setting or a Global Privacy Control signal to opt you out of; we treat both as confirmation of the choice we already apply to everyone.

14. Changes to this policy

We review this policy at least once a year and whenever the App, the Portal, our service providers or the law change. We post changes here with a new effective date, and notify Organizations of material changes through the Portal or by email before they take effect.

15. How to contact us

ReadLab Sports LLC
1110 W Elliot Rd #1081
Tempe, AZ 85284
United States
Telephone: 928-382-0108
Privacy requests: privacy@readlabsports.com
Security issues: security@readlabsports.com