Privacy Policy

This Privacy Policy explains how SkiGraph, Inc. (“SkiGraph,” “we,” “us,” or “our”) collects, uses, discloses, retains, and otherwise processes personal information through the SkiGraph mobile applications, website at www.skigraph.com, and related services (collectively, the “Service”).

The SkiGraph Terms of Service govern use of the Service and the rights needed to process content. This Policy governs our handling of personal information. Applicable law controls where it provides rights that cannot be waived.

What we collect and why

Sections 2 and 3 explain the personal information we collect and how we use it. We do not sell personal information or share it for cross-context behavioral advertising. Section 7 explains how long we retain information.

1. Scope and responsible entity

SkiGraph, Inc. is responsible for the personal information covered by this Policy unless another notice identifies a different responsible entity.

This Policy applies to information processed through the consumer Service. Coaches, organizations, and other users may separately determine how they use information you share with them. Their practices are their responsibility unless SkiGraph expressly agrees otherwise.

Contact details appear in Section 13.

2. Personal information we collect

The information we collect depends on the features you use, the permissions you grant, and how you interact with the Service.

2.1 Account and profile information

We may collect your name, username, email address, authentication information, representation that you meet the Service's age requirement, account settings, profile photo, skill level, skiing interests, coach or athlete role, and similar profile information. An authentication service provider processes account credentials on our behalf. If we offer sign-in through another account provider, we may receive an identifier and the account information you choose to share through that provider.

2.2 Videos and other content

We collect content you upload, record, create, send, or otherwise provide through the Service, including videos, images, audio, annotations, comments, messages, feedback, sharing settings, and associated file or upload information.

Videos and images may include faces, voices, body movement, equipment, location information, companions, and other information about people in the recording. You are responsible for complying with applicable copyright, recording, privacy, publicity, and other laws when uploading or sharing content involving another person.

We may generate information from video-organization and comparison features, including tags, skiing attributes, reference selections or rankings, playback and comparison activity, and preferences.

2.3 Activity, device, diagnostic, and monitoring information

We may collect information about how you use the Service, including features used, screens viewed, uploads, playback and comparison activity, sharing, session timing, and errors.

We may also collect IP address, device and app identifiers where permitted, device model, operating system and app version, language, time zone, network information, crash logs, performance information, security events, and approximate location inferred from an IP address.

We use error and performance monitoring providers to diagnose faults, monitor reliability, investigate incidents, and improve the Service. These providers may receive diagnostic and technical information such as crash reports, stack traces, app and device details, performance information, opaque account and trace identifiers, and connection information from which approximate location may be derived. We configure these services to limit unnecessary personal information and do not use them for advertising or cross-context behavioral tracking.

The Service may request access to your camera, microphone, or photo library when needed for a feature. Your device settings control those permissions. If a future feature requests other device or sensor permissions, we will provide any notice or choice required at that time.

The Service and website may use local storage, software development kits, or similar technologies where needed for authentication, preferences, security, and functionality. Browser or device settings may provide related controls.

2.4 Transactions and other sources

If paid features are offered, we may receive transaction identifiers, subscription information, purchase status, and limited billing information from an app store or payment provider. Those providers process payment details under their own policies unless we state otherwise.

We may also receive information from other users and from providers supporting authentication, hosting, security, communications, distribution, payments, or customer support. Notifications may include another user's display name and activity information.

3. How we use personal information

We may use personal information to:

• provide, operate, personalize, support, and improve the Service, including processing and sharing content as directed and selecting or ranking reference content;
• create and manage accounts, transactions, preferences, communications, and support requests;
• understand Service use and evaluate, develop, and improve SkiGraph products, features, and related technologies;
• secure the Service, prevent and investigate misuse, and enforce our Terms; and
• comply with law, protect rights and safety, maintain records and legal claims, and evaluate or complete a business transaction.

Authorized SkiGraph personnel and service providers may access and review uploaded content when reasonably necessary to provide, support, secure, evaluate, or improve the Service; investigate reports or suspected misuse; or comply with law. SkiGraph does not routinely review every upload.

If we later use personal information for a materially different purpose, we will provide additional notice, obtain consent, or offer a choice when required by applicable law.

4. How we disclose personal information

We may disclose personal information to:

• Service providers and contractors that perform services for SkiGraph, such as hosting, media processing, authentication, security, error and performance monitoring, communications, customer support, payments, distribution, and professional advice;
• Other users and recipients you choose, according to your sharing actions, audience settings, invitations, and links;
• Affiliates and professional advisers for the purposes described in this Policy;
• Authorities and other legal recipients when disclosure is required by law or reasonably necessary to protect rights, safety, security, or the integrity of the Service;
• Transaction participants and successors in connection with a financing, merger, acquisition, reorganization, asset sale, bankruptcy, or similar transaction; and
• Others at your direction or with your consent.

Service providers and contractors may process personal information only for authorized purposes and under contractual restrictions appropriate to their role. We will provide any additional notice or choice required when a feature discloses information to another recipient.

5. Audience settings and shared links

Audience settings control visibility to other users but do not prevent SkiGraph or service providers acting on our behalf from processing content for the purposes described in this Policy. Anyone who obtains a shared or unlisted link may be able to access and forward the content. Disabling a link does not retrieve copies already made by recipients.

6. Sale, sharing, and advertising

Some privacy laws define “sale” or “sharing” more broadly than an exchange of information for money.

During the 12 months before the effective date of this Policy, SkiGraph did not sell personal information or share it for cross-context behavioral advertising as those terms are defined by the California Consumer Privacy Act.

If our practices change, we will update the applicable notice and provide any consent, opt-out method, browser-signal recognition, or other choice required by law. Disclosures to service providers, disclosures you direct, and corporate transactions may be treated differently under applicable definitions.

7. Retention and deletion

We retain personal information for as long as reasonably necessary for the purposes described in this Policy. The period depends on the type of information, account and feature status, the purposes for which it is processed, legal requirements, security needs, applicable limitation periods, and backup schedules.

We may retain account information and content while an account or relevant feature is active; transaction, acceptance, security, moderation, and legal records for applicable recordkeeping periods; and deleted information temporarily in backups or recovery systems until it is overwritten or isolated through ordinary cycles. Identifiable source content kept solely for SkiGraph's internal evaluation or development is subject to the maximum period in our internal retention schedule and to earlier deletion requirements. We may also retain aggregated or deidentified information that is no longer reasonably linked to a person.

When we honor a deletion request, we remove covered information under SkiGraph's control, subject to exceptions for backups, security, fraud prevention, legal compliance, disputes and claims, completed processing or disclosures, and aggregate or deidentified information no longer reasonably linked to a person. Deletion cannot retrieve copies independently held by recipients. After deletion is completed, SkiGraph will not use deleted raw or identifiable User Content for new evaluation or product-improvement work. Applicable law controls if it requires otherwise.

8. Privacy rights and choices

Depending on where you live and subject to legal exceptions, you may have rights to:

• know about or access personal information;
• obtain a portable copy of certain information;
• correct inaccurate information;
• delete personal information;
• opt out of certain sales, sharing, targeted advertising, or profiling;
• limit certain uses of sensitive personal information;
• object to or restrict certain processing;
• withdraw consent where processing relies on consent;
• appeal a refusal to act on a request; and
• receive equal service without unlawful discrimination for exercising a privacy right.

You may request deletion of your account and associated data through the in-app account-deletion control or by contacting us at support@skigraph.com. You may use other available account controls or the same contact address for other privacy requests. We may need to verify your identity and authority before completing a request. Where permitted, an authorized agent may submit a request on your behalf, subject to appropriate verification.

If we refuse to act on a request, you may appeal by replying to our decision or emailing support@skigraph.com with “Privacy Appeal” in the subject line. We will respond to the appeal within the period required by applicable law, explain our decision in writing, and, if we deny the appeal, provide an available method to contact the appropriate regulator when required.

If you believe that you appear or can be heard in content submitted by another person, you may contact us even if you do not have a SkiGraph account, link, or video identifier. Please provide the information reasonably available to help us locate the content. We may request additional information needed to identify the content or verify the request. If we cannot identify the content after a reasonable search, we will explain that outcome when required by law.

Some information may be exempt from a request under applicable law, including information needed for security, fraud prevention, legal obligations, free-expression rights, internal uses permitted by law, or legal claims. We will explain a refusal when required.

9. Additional U.S. state disclosures

Where required by applicable U.S. state privacy law, the categories of personal information we may process include identifiers; account and transaction information; internet or electronic activity; approximate geolocation; audio, visual, and similar information; professional information; inferences; and sensitive personal information collected through an enabled feature.

We obtain this information from you, your devices, other users, and the providers described in Section 2. We use and disclose it for the purposes and to the recipients described in Sections 3 and 4. Sections 6 through 8 describe sale and sharing, retention, and available rights.

We do not knowingly sell or share personal information of anyone under 16. The Service is limited to adults.

10. EEA and UK information

This Section applies when European Economic Area (“EEA”) or United Kingdom data-protection law applies to our processing.

10.1 Controller

SkiGraph, Inc. is the controller for the processing described in this Policy. Our contact information appears in Section 13.

10.2 Purposes and legal bases

We rely on the following legal bases for the indicated processing. More than one basis may apply when the processing serves distinct purposes.

Our legitimate interests do not automatically override your rights. We assess necessity, reasonable expectations, privacy impact, and safeguards before relying on that basis. A materially different future use—including using uploaded videos or identifiable personal information to train or fine-tune a model—is not treated as authorized by this schedule merely because it may improve a future product. Before such a use begins, we will identify an appropriate legal basis and provide any additional notice, consent, or choice required by law.

Account and authentication information is required to create and secure an account. Content and related information is required only when you choose to use the corresponding upload, comparison, annotation, communication, or sharing feature. Transaction information is required only if you choose a paid feature. Optional profile fields and device permissions are not required, but a feature that depends on them may not work if you do not provide them.

10.3 International transfers

SkiGraph is based in the United States, and we and the recipients described in Section 4 may process personal information in the United States and other countries. When a restricted transfer is not covered by an applicable adequacy decision, we use an approved safeguard appropriate to the transfer. These safeguards may include the European Commission’s Standard Contractual Clauses for EEA transfers and the UK International Data Transfer Agreement or UK Addendum to the European Commission’s Standard Contractual Clauses for UK transfers, together with supplementary measures where required.

You may contact us using Section 13 to ask about the safeguard used for a relevant transfer or to request a copy. We may redact only information that the law permits us to withhold, such as another person’s personal information or protected confidential information.

10.4 EEA and UK rights

Subject to applicable conditions and exceptions, you may ask us to access, correct, erase, or restrict processing of your personal information; provide certain information in a portable format; or object to processing based on legitimate interests. You have an absolute right to object to processing for direct marketing. When processing is based on consent, you may withdraw consent at any time without affecting processing lawfully completed before withdrawal.

Use the methods in Section 8 to exercise these rights. We will respond without undue delay and ordinarily within one month after receiving a request and any information reasonably required to verify it. We may extend the response period when the law permits and will provide the required notice of an extension.

You may complain to a data-protection authority in the EEA country where you habitually reside, work, or believe an infringement occurred. If you are in the UK, you may complain to the UK Information Commissioner’s Office. You do not have to contact us first.

10.5 Retention criteria

Section 7 describes our general retention and deletion rules. For EEA and UK information, we apply those rules by category as follows:

• account and profile information is retained while the account is active and afterward only for the period needed to complete closure, maintain necessary business and acceptance records, protect the Service, and address legal claims;
• videos, annotations, comments, messages, and other content are retained until the user deletes them, the relevant feature or sharing relationship ends, or the account is closed, followed by the applicable deletion and backup cycle, unless a disclosed legal, security, or claims exception applies;
• activity, device, diagnostic, and security information is retained under the applicable operational, reliability, and security schedule, with incident-related records retained longer only when needed to investigate the incident, prevent recurrence, or address a legal claim;
• transaction, support, agreement-acceptance, consent, moderation, and legal records are retained for the applicable accounting, tax, recordkeeping, dispute, and limitation periods; and
• identifiable source content retained solely for internal evaluation or development is subject to the maximum period in our internal retention schedule and to earlier account-deletion, objection, or other legal requirements.

We use the shortest period reasonably consistent with the stated purpose, legal requirements, security needs, and documented deletion and backup cycles. We periodically review the underlying schedules.

10.6 Information received from another person

Another user may provide videos, audio, annotations, comments, messages, invitations, reports, or labels about you as described in Sections 2.2 and 2.4. The source is ordinarily the user who submitted or shared the information. The purposes, legal bases, recipients, transfers, retention criteria, and rights described in this Policy also apply to that information.

Where the law requires SkiGraph to give privacy information directly to a person whose information we received from another source, we will do so within the required period using contact information reasonably available to us. We will rely on an exception to direct notice only when its requirements are satisfied and documented. Section 8 explains how a person depicted or heard in content can contact us even without an account or content identifier.

11. Sensitive information, automated processing, and adults only

Video and related information may be regulated as biometric, health, or sensitive information in some jurisdictions depending on the technology and use. The Service does not currently perform biometric identification or create face or voice templates. Before introducing processing that requires a specific notice, consent, retention policy, or other safeguard, we will provide it as required by law.

The Service is not intended for medical diagnosis or treatment. Do not submit medical records.

SkiGraph does not make decisions based solely on automated processing that produce legal or similarly significant effects concerning users.

The Service is intended only for people 18 or older. You may not create an account if you are under 18 or upload content depicting a person you know or reasonably should know is under 18. If you believe a minor's information has been submitted, contact us. We will investigate and take action required by law and our Terms.

12. Security

We use administrative, technical, and organizational measures designed to protect personal information, taking account of its nature and risk. No system, transmission, or storage method is completely secure. You are responsible for protecting account credentials and shared links and for promptly notifying us of suspected unauthorized access.

If a security incident requires notice under applicable law, we will provide the required notice.

13. Contact us

SkiGraph, Inc., 7533 South Center View Court, West Jordan, Utah 84084, United States

Email: support@skigraph.com

14. Changes to this Policy

We may update this Policy as the Service, our practices, or applicable law changes. We will post the updated version and revise the effective date. We will provide additional notice, request acceptance, obtain consent, or offer a choice when required by law.

Changes apply prospectively from their effective date unless applicable law permits otherwise.