2. HOW DO WE PROCESS YOUR INFORMATION?

Purpose & Examples of processing

• Provide the Service (e.g. Pair with wearables, compute real‑time zones, deliver AI voice prompts, store workouts)

• Account management (e.g. Sign‑up, log‑in, subscription management, restore purchases)

• Customer support (e.g. Respond to e‑mails, bug reports, surveys)

• Research & development (e.g. Aggregate, de‑identify usage statistics to improve coaching models)

• Marketing (e.g. Send product updates or offers (you may opt out at any time)

• Legal / security (e.g. Detect fraud, enforce Terms, respond to lawful requests)

We do not use your biometric data for advertising or sell it to third parties.

3. LEGAL BASES (EEA / UK GDPR, CANADA PIPEDA)

• Consent – when you connect a wearable, enable location, or join beta programs.

• Contract – to deliver the Services you request.

• Legitimate interests – to develop and secure our platform.

• Legal obligation – to keep tax or accounting records, comply with court orders.

You may withdraw consent at any time (see section 8).

4. WHEN & WITH WHOM WE SHARE DATA

Recipient & Reason

• Cloud infrastructure & analytics (e.g., AWS, Google Cloud, Amplitude). Used for hosting, data processing, product analytics

• Payment & app‑store providers (Apple, Google). Used managing subscriptions and refunds

• AI & speech vendors (e.g., 11 Labs for TTS) . Used for generating voice prompts; only the text of the prompt, never raw biometric streams

• Business transfers. Used for an acquisition, merger, or asset sale (we will notify you).

• Legal / safety. To comply with subpoenas or protect rights, property, or safety

All processors are bound by strict data‑protection agreements.

If you reside in the EEA or UK, your data may be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) and additional safeguards to protect your information in accordance with GDPR requirements.

5. COOKIES & SIMILAR TECH

The Site uses first‑ and third‑party cookies for analytics and session management. Manage preferences in your browser or review our full Cookie Notice (link in Site footer).

6. DATA RETENTION

We keep personal data only as long as necessary for the purposes described or as required by law. Workout and biometric history remain until you delete it or close your account.

Billing & Transaction Records: Retained for up to 7 years as required by tax and accounting laws.

Back‑ups are purged on a rolling 30‑day schedule.

When you delete your account, your data is removed from active systems immediately. Copies may persist in encrypted backups for up to 30 days, after which they are automatically permanently deleted. These backups are not used for routine access or processing and are automatically overwritten after the retention window.

Sensitive Personal Information (SPI)

Cadence processes sensitive personal information, such as biometric workout data (e.g., heart rate, cadence) and precise geolocation, solely to provide and improve the Service. We do not use or disclose sensitive personal information for advertising, profiling, or any purpose not permitted under California Civil Code §1798.121. California residents may exercise their right to limit the use of SPI (see Section 10).

7. SECURITY

Cadence employs SOC‑2–aligned controls: encryption in transit (TLS 1.2+), encryption at rest (AES‑256), least‑privilege access, routine pen‑testing, and incident‑response procedures. No Internet system is 100 % secure; you transmit data at your own risk.

8. YOUR PRIVACY RIGHTS

Depending on your region you may have the right to:

• access or download a copy of your data in a portable format (e.g. JSON/CSV);

• correct inaccurate data;

• delete your account and associated data;

• restrict or object to certain processing;

• withdraw consent;

• opt out of marketing e‑mails (click “unsubscribe” in any message).

To exercise rights, e‑mail eric@joincadence.ai or submit an in‑App request. We will respond within the timelines required by applicable law.

We provide exports in standard machine-readable formats (e.g., CSV/JSON) covering account data, subscription history, and workout summaries. Raw biometric time-series can be included upon request.

9. DO‑NOT‑TRACK

Because there is no uniform DNT standard, Cadence does not currently respond to DNT signals.

10. CALIFORNIA PRIVACY (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to Know/Access: Request disclosure of the categories and specific pieces of personal information we have collected about you.

• Right to Delete: Request that we delete personal information we hold, subject to certain exceptions.

• Right to Correct: Request that we correct inaccurate personal information.

• Right to Opt Out of Sale/Sharing: Request that we do not sell or share your personal information. Cadence does not sell or share your data for cross-context behavioral advertising.

• Right to Limit Use of Sensitive Personal Information: Restrict our use of SPI (e.g., biometric and location data) to only what is necessary to provide the Service.

• Right to Non-Discrimination: We will not discriminate against you for exercising your rights.

To exercise these rights, email us at eric@joincadence.ai with “California Rights Request” in the subject line or submit a request via the App.

11. VIRGINIA PRIVACY (VCDPA)

Virginia residents may exercise rights of access, correction, deletion, and opt‑out of targeted advertising as detailed in § 8. Appeals may be sent to the same address; unresolved complaints may be raised with the Virginia Attorney General.

12. CHANGES TO THIS POLICY

We may update this Policy periodically. Material changes will be highlighted in‑App or on the Site. The “Last updated” date reflects the latest revision. Continued use after an update constitutes acceptance.

13. CONTACT US

Cadence Innovation Labs LLC

118 35th Street,

Hermosa Beach, CA 90254

eric@joincadence.ai

14. REVIEW / UPDATE / DELETE YOUR DATA

To protect your privacy and security, we verify consumer requests by matching the information you provide (such as your account email, device authentication, or transaction records) with the information already on file. We may request additional information if necessary to confirm your identity.

Submit an in‑App request under Settings or e‑mail eric@joincadence.ai. If we deny your privacy request, you may appeal our decision by emailing eric@joincadence.ai with “Appeal” in the subject line. We will review and respond within the time required by law. If you remain unsatisfied, you may contact your state Attorney General.

When you delete your account, we permanently erase your personal identifiers and unlink them from workout data. Remaining workout data is stored only in a de-identified form that cannot reasonably be re-associated with you. We may retain de-identified or aggregated workout data (e.g., GPS traces, heart rate samples) that cannot reasonably identify you, for analytics and product improvement.

© 2025 Cadence Innovation Labs LLC. All rights reserved.