Privacy Policy

1. Overview

This Privacy Policy describes how Social Butterfly AI LLC ("Company," "we," "us," or "our"), a limited liability company organized under the laws of the Commonwealth of Pennsylvania, collects, uses, shares and retains information in connection with mmaGPT ("the Service").

This policy applies to three groups of people:

• Individual users. Adults who create their own account on a free or paid plan.
• Athletes on an academy seat. People who use mmaGPT through a gym, academy or organization that pays for their seat. This includes junior athletes aged 13 to 17, who may only use the Service this way and only with parent or guardian consent.
• Visitors. People who browse our public pages, book an academy consultation, join a waitlist or contact support without ever creating an account.

We use analytics and advertising measurement tools, including cookies and server side event sharing with advertising platforms. We explain exactly what runs and how to turn it off in the section titled Cookies, Tracking and Advertising.

We do not sell personal data for money. Our use of advertising cookies and the Meta Conversions API may still count as "sharing" for cross context behavioral advertising under California law. See Data Sharing and Subprocessors and Your Rights.

By creating an account or using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Account information. Email address, authentication credentials, display name, preferred language, account type, and role assignments such as athlete, coach, gym owner, organization administrator, agency user or partner.

2.2 Profile and training data. Discipline, skill level, years of experience, rank or belt where applicable, weight class, height and reach where you provide them, training goals, weekly training frequency, training history, streaks and cadence, and the focus areas you select for each session.

2.3 User generated content. Video files you upload or video links you submit, generated thumbnails and marked subject frames, session metadata, session notes and free text you enter.

2.4 AI derived data. Generated feedback and scores, session findings, athlete snapshots, adaptive curricula, weekly focus records, drill history, and a persistent coaching memory profile stored with your account that the AI builds across sessions so that later feedback can refer back to earlier work.

2.5 Opponent and training partner information. If you build an opponent profile, we store the name, stance, tendencies and free text notes you enter about that person. Footage you upload may also contain training partners and coaches.

2.6 Academy and roster data. Gym or academy membership, assigned coach, group assignments, seat type, invite records, join requests, and coach notes about you. For a junior seat, the academy supplies the student's full name, the parent or guardian's full name, and the student's date of birth, and a parent or guardian consent form is generated and stored in a private bucket.

2.7 Communications and support. Emails you send us, support requests (which can be submitted without an account), unlisted academy requests, waitlist entries, ambassador applications, and consultation bookings.

2.8 SMS consent records. If you provide a phone number and opt in, we store the phone number and a consent record containing the exact consent text shown to you, the consent version, the timestamp, your IP address and your user agent. This audit trail is required for A2P 10DLC carrier compliance.

2.9 Payment and billing information. Payments are processed by Stripe. Stripe collects and stores your card details under PCI DSS. Checkout requires a billing address and collects tax location so that automatic tax can be applied. We store Stripe customer, subscription and payment method identifiers, plan tier, subscription status, credit balances and transaction metadata. We do not store full card numbers or bank account details.

2.10 Device, technical and usage data. Device type, operating system, browser, IP address, user agent, pages viewed, feature usage, error and performance traces, and rate limiting records.

2.11 Attribution, referral and campaign data. UTM source, medium and campaign values, signup source, referral codes and links, referral click records including IP address and user agent, a hashed IP and user agent recorded when a referral is locked to an account, and an attribution audit log.

2.12 Information about visitors who are not registered users. Waitlist signups and leads, mobile app waitlist entries, booking leads including a hashed attendee email and email domain from calendar bookings, ambassador applications, unlisted academy requests, support requests, and academy page visit records containing IP address, user agent, advertising cookie identifiers and the page URL.

3. How We Use Information

• Delivering analysis and feedback. Processing your video and session details through AI models to produce technical feedback, scores and drills.
• Personalizing coaching. Maintaining a persistent memory profile, snapshots, curricula and weekly focus so that feedback builds on your history rather than starting fresh each time.
• Operating academy features. Running rosters, invites, seats, groups and coach visibility, so that your coaches and academy administrators can review your sessions.
• Managing subscriptions, credits and seats. Billing, session allotments, add on balances, refunds of failed analyses, upgrades, downgrades and seat pooling.
• Improving the Service and our AI systems. We score engagement signals on generated feedback, such as whether it was viewed, when it was viewed, whether a training session was started from it, whether the same focus was run again and whether the user returned within 14 days. Feedback that scores highly may be distilled into de-identified coaching material, such as scripts, drills and cues, and that material may be used when generating feedback for other users. The distillation record retains an internal reference to the source account and submission so it can be audited or withdrawn. You may opt out of this use by emailing support@mmagpt.app.
• Transactional email and SMS. Account, security, billing and session messages, and one time authentication codes.
• Marketing and lifecycle email. Product announcements, feature launches, digests and re engagement messages, each with an unsubscribe link.
• Advertising measurement and attribution. Measuring which campaigns produce signups and subscriptions, including server side event sharing with Meta.
• Fraud prevention, rate limiting and abuse detection. Including referral fraud checks and quota enforcement.
• Legal compliance. Tax, accounting, carrier compliance and responding to lawful requests.

4. Cookies, Tracking and Advertising

4.1 Essential technologies. We use browser storage for your authentication session, your language and consent preferences, attribution values carried from the link you arrived on, and a service worker for offline and performance behavior. These cannot be turned off while you use the Service.

4.2 Analytics. Google Analytics 4 (measurement ID G-CPNB2GG6S4) runs on our pages and sets Google Analytics cookies to measure page views, feature usage and funnels.

4.3 Advertising. The Meta Pixel (ID 1235756575336201) runs on our production pages and sets Meta cookies, including _fbp and, when you arrive from an ad, _fbc. In product events are also sent to Meta, including signup, onboarding completion with discipline and skill level, video upload, feedback received, analysis viewed, checkout started, and subscription started with value and currency.

4.4 Server side event sharing. We also send these events to Meta from our servers through the Meta Conversions API. Where we send identifying fields such as email address, first name, last name and phone number, those values are SHA-256 hashed before transmission. We also send the Meta cookie identifiers, IP address and user agent so Meta can match the event.

4.5 Academy visitor logging. When anyone visits an academy page, we record the IP address, user agent, Meta cookie identifiers and page URL to attribute academy interest to campaigns. These records are deleted after 30 days.

4.6 Your choices. A consent banner is shown on your first visit. If we detect that you are in the European Economic Area, the United Kingdom or Brazil, analytics and advertising tools are not loaded until you accept. Elsewhere they load by default and you can reject them at any time. You can change your choice at any time using the "Cookie settings" link in the site footer, and you can also use browser controls, the Google Analytics opt out browser add on, and your Meta ad preferences.

4.7 Global Privacy Control. We honor the Global Privacy Control signal. If your browser sends it, we treat it as a rejection of advertising cookies and of sharing for cross context behavioral advertising, without you needing to do anything else.

Full detail, including the vendor table, is on the Cookies and Tracking page.

5. AI Processing

5.1 Automated analysis. Your video, session details and relevant history are processed automatically by AI models to produce feedback. Requests are routed through the Lovable AI Gateway to Google Gemini models.

5.2 Model training. We instruct our AI infrastructure providers not to use customer content to train their general purpose models, and we rely on their contractual commitments to that effect. We cannot offer this as an absolute guarantee of a third party's conduct.

5.3 Limitations. AI outputs may be inaccurate, incomplete or unsuitable for your circumstances. They are not medical advice and are not a substitute for a qualified coach.

5.4 Human review. In the individual consumer product, no human reviews your video as part of the standard analysis workflow. In the academy product, listed coaches, the gym owner and organization administrators can open an athlete's video and full feedback. Platform administrators may also access submissions for support, abuse investigation and quality review.

6. Academy and Organization Accounts

6.1 Who can see your data. If you are on an academy seat, the following people can see your profile, sessions, videos, feedback, notes and progress: your assigned coach, other coaches listed as staff at your academy, the gym owner, and administrators of the parent organization or headquarters if your academy belongs to one.

6.2 The academy decides who its coaches are. We do not control which staff an academy lists. Adding or removing a coach changes who can see athlete data, and that is the academy's decision and responsibility.

6.3 Our role. For roster and athlete data handled on an academy's behalf, we act as a service provider or processor and follow the academy's reasonable instructions. For our own platform operations, including security, billing, abuse prevention and improving the Service, we act as a controller.

6.4 Leaving an academy. When you leave an academy, or when the academy's contract ends, the academy's staff lose access to your account going forward. Your account, history and feedback remain yours, and your video retention reverts to the retention window of your own plan tier, which may be shorter than the academy window.

6.5 Seeing who has access. Your account settings show the academies and organizations linked to your account. You can leave an academy from there, or email support@mmagpt.app if you need help.

7. Children and Junior Athletes

Direct consumer accounts are for adults aged 18 and over.

Athletes aged 13 to 17 may use mmaGPT only through an academy seat, and only after a parent or legal guardian has signed the consent form for that athlete. Uploads are blocked until that consent is on file. Children under 13 are prohibited from using the Service and the system rejects an under 13 date of birth at signup.

What we collect about a junior athlete. Student full name, date of birth, parent or guardian full name, assigned coach and academy, training video and session details, and the AI feedback and progress data generated from them. This information is supplied by the academy when it issues the junior seat, and by the athlete when they train.

Who can see it. The athlete, the parent or guardian who holds the consent, the assigned and listed coaches, the gym owner, organization administrators, and platform administrators for support and quality review.

Advertising. We do not serve advertising to accounts identified as minors and we do not include them in advertising measurement events.

The academy's responsibility. The academy is responsible for obtaining parental or guardian consent before issuing a junior seat, for retaining the signed consent, and for producing it on request.

Withdrawing consent. A parent or guardian may withdraw consent at any time by contacting the academy or by emailing support@mmagpt.app directly. Withdrawal stops the athlete's uploads immediately. On request we will also delete the athlete's account and content, subject to the deletion process described in Data Retention.

8. Data Sharing and Subprocessors

We share information with the following categories of recipients.

The current list, with a last updated date, is kept on the Subprocessors page.

Academies. If you are on an academy seat, your data is shared with that academy's staff as described in Academy and Organization Accounts.

Legal disclosure. We may disclose information where required by law, subpoena, court order or regulation, or where we believe disclosure is necessary to protect our rights or someone's safety.

Business transfer. If we are involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that transaction, subject to this policy.

Sale and sharing. We do not sell personal data for money. Our use of advertising cookies and the Meta Conversions API may constitute "sharing" for cross context behavioral advertising under the California Consumer Privacy Act as amended by the CPRA. You can opt out through the cookie settings link in the site footer, or by sending a Global Privacy Control signal, or by emailing support@mmagpt.app.

9. Data Retention

9.1 Uploaded video. Video retention depends on your plan.

9.2 Account data. Retained while your account is active.

9.3 Account deletion. When you request deletion, your account enters a 30 day grace period. During that window the request can be cancelled. After it, the account and its stored files are permanently deleted.

9.4 Feedback and training history. Retained with your account so progress tracking works, and deleted with the account.

9.5 Academy visitor records. Deleted after 30 days.

9.6 Junior consent forms. Retained for the duration of the academy relationship plus any period required by law.

9.7 Email suppression lists. Retained indefinitely so that we continue to honor your unsubscribe.

9.8 Financial records. Retained as required by tax and accounting law.

9.9 De-identified derived material. Coaching material distilled from feedback, as described in How We Use Information, may persist after the source content is deleted because it no longer identifies you.

10. Data Security

We implement technical and organizational safeguards to protect information against unauthorized access, alteration, disclosure or destruction. These include encryption of data in transit and at rest, row level security policies on the database so that each account can only reach its own data, private storage buckets with time limited signed links for video and consent forms, rate limiting on sensitive operations, audit logging of administrative actions, and least privilege access for staff.

No method of electronic transmission or storage is completely secure and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials.

If a breach affects your personal data, we will notify you and the relevant supervisory authorities as and when required by applicable law.

11. Your Rights

11.1 Everyone. You may request access to your personal data, correction of inaccurate data, deletion of your data, a portable copy, and closure of your account. Account deletion is available in your settings and is subject to the 30 day grace period. Email support@mmagpt.app for anything else. We respond within 30 days, or within 45 days where the law allows an extension and we tell you why.

11.2 California residents (CCPA as amended by the CPRA). In the last 12 months we have collected the following categories of personal information: identifiers, customer records, commercial information, internet and network activity, geolocation inferred from IP address, audio and visual information in the form of uploaded video, professional or athletic information, inferences drawn to personalize coaching, and, where an academy provides it for a junior seat, information about a person under 18. We have disclosed identifiers, commercial information and internet activity to our service providers listed in Data Sharing and Subprocessors for business purposes, and we have shared identifiers and internet activity with Meta for cross context behavioral advertising. You have the right to know, delete, correct, opt out of sharing for cross context behavioral advertising, limit the use of sensitive personal information, and not be discriminated against for exercising these rights. Authorized agents may submit requests with written proof of authorization. Use the cookie settings link in the footer to opt out of sharing, or email support@mmagpt.app.

11.3 Other US states. Residents of Virginia, Colorado, Connecticut, Utah, Texas and other states with comprehensive privacy laws have rights to access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, sale and certain profiling. Where the law provides it, you also have the right to appeal a denied request. To appeal, reply to our decision or email support@mmagpt.app with the word Appeal in the subject line. We respond to appeals within 45 days and will tell you how to contact your state attorney general if the appeal is denied.

11.4 European Economic Area and United Kingdom (GDPR). Our legal bases are: performance of a contract for account creation, analysis, billing and academy features; legitimate interests for security, fraud prevention, service and AI improvement, and basic product analytics; consent for marketing email, advertising cookies and advertising measurement; and legal obligation for tax, accounting and carrier compliance. You have the rights of access, rectification, erasure, restriction, portability, objection, including objection to processing based on legitimate interests, and the right to withdraw consent at any time without affecting prior processing. You may lodge a complaint with your local supervisory authority. Transfers out of the EEA and UK rely on Standard Contractual Clauses or an equivalent safeguard with each subprocessor where required.

11.5 Brazil (LGPD). You have the rights to confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, information about sharing, information about the consequences of refusing consent, revocation of consent, and to petition the Autoridade Nacional de Proteção de Dados. Email support@mmagpt.app to exercise these rights.

12. International Data Transfers

The Service is operated from the United States and information is processed and stored there and in other countries where our subprocessors operate. Where required, we rely on Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent safeguards with our subprocessors. By using the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data protection law may differ from the law of your country.

13. SMS Communications

If you provide a phone number and opt in, we may send you one time authentication codes and, where you have opted in, account and training notifications. We do not send marketing SMS. Message and data rates may apply and message frequency varies.

Reply STOP to any message to opt out, or HELP for help. You can also change your phone number and SMS preferences in your account settings.

For carrier compliance under A2P 10DLC, each opt in is recorded with the exact consent text shown to you, the consent version, the timestamp, your IP address and your user agent. SMS is delivered by Twilio, which also returns delivery status information to us. We do not share phone numbers with third parties for marketing.

14. Email Communications

Transactional email covers account verification, password and login links, billing receipts and failures, session results, invites, join requests and support replies. These cannot be turned off while your account is active because they are necessary to operate the account.

Marketing and lifecycle email covers product announcements, feature launches, pricing news, re engagement messages and digests. Your weekly digest preference is on by default and can be turned off in your settings.

Every marketing and lifecycle email contains an unsubscribe link. Unsubscribing adds your address to a suppression list that we keep indefinitely so the preference is honored even if you sign up again. You can also manage preferences at /unsubscribe.

15. Content Depicting Other People

Training footage usually contains other people, such as sparring partners and coaches, and opponent profiles contain information about a named third party. If you upload footage or enter information about someone else, you are responsible for having their consent, or the consent of their parent or guardian if they are a minor, and for having a lawful basis to do so.

If you appear in footage someone else uploaded, or you believe information about you has been entered without your consent, email support@mmagpt.app with enough detail to identify the content. We will review the request and, where appropriate, remove the content and the analysis derived from it.

16. Changes to This Policy

We may update this Privacy Policy. For material changes we will give notice by email to the address on your account at least 14 days before the change takes effect, and we will update the effective date at the top of this page. Continued use of the Service after a change takes effect means you accept the updated policy.

17. Contact

For privacy questions, requests or complaints, including access, deletion, opt out and appeals:

If we deny a request, we will tell you why and how to appeal. Appeals are handled by a different reviewer where practicable and answered within 45 days. If your appeal is denied you may contact your state attorney general, your supervisory authority in the EEA or UK, or the Autoridade Nacional de Proteção de Dados in Brazil.