> DRAFT for review by counsel. Not legal advice.

Autelica Studio Privacy Policy

Effective Date: October 5, 2026

Autelica, Inc. ("Autelica," "we," "our," or "us"), a Delaware corporation based in San Francisco, California, provides the Autelica Studio web application and API, and the Autelica app for ChatGPT. This Privacy Policy explains what information we collect, how we use and protect it, and your rights regarding your data.

If you have questions, please contact us at hello@autelica.com.

1. Information We Collect

We collect only the information necessary to provide the Service:

• Account Information: You register and sign in using Google Sign-In. We receive your name, email address, profile picture URL, and Google user identifier.
• Uploaded Video Content: You upload 1 to 4 videos of the same moment of a person moving. These videos contain visual images and audio recordings of the person filmed.
• Derived Motion and Analytics Data: Our computer vision pipeline processes your videos to generate:
• 3D body motion data (3D joint positions and coordinates over time).
• Kinematic metrics (joint angles, velocities, accelerations).
• Sports performance statistics (e.g., jump height, swing path, cadence).
• 3D replays and optional robotics data exports.
• Billing and Payment Data: Payments are processed securely by Stripe. We do not store credit card numbers or bank account details. We receive only transaction confirmations, billing postal codes, and the last four digits of payment cards.
• Using Autelica in ChatGPT: When you use the Autelica app inside ChatGPT, ChatGPT sends us only what our tools need: for example a sample moment id, a job id, the number of cameras you have, or the sport you mention. We do not receive your ChatGPT conversation or your ChatGPT account details. To let you analyse your own videos without signing up, the app creates a guest account with no name or email; it is known to us only by a random identifier and a session key that stays inside the Autelica panel in ChatGPT and expires after 7 days. We keep simple, anonymous counts of app usage: which tool was used and whether it worked, which sample was opened, the name of the app client (such as ChatGPT), and the country and language setting the client reports. To count unique and returning users, we store a one-way, salted hash of the anonymous user identifier the client provides; it cannot be traced back to you or your ChatGPT account. We never receive or store your prompts, your IP address or your account identity. Your conversation with ChatGPT is governed by OpenAI's privacy policy.
• Technical Logs and Usage Data: Our hosting and security infrastructure (Cloudflare and Google Cloud) logs IP addresses, browser types, operating systems, request timestamps, and API call metrics.

2. Notice Concerning Biometric Data

Under laws such as the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), and the European Union General Data Protection Regulation (GDPR), video recordings of individuals and extracted 3D body motion coordinates may be classified as biometric identifiers or biometric data.

We handle this data with strict safeguards:

• Service Delivery Only: We process video recordings and 3D joint positions solely to provide motion analysis, sports statistics, and 3D replays to you.
• No Identification or Surveillance: We do not use video or motion data to identify unknown individuals, match against photo databases, or conduct surveillance.
• No Sale of Data: We do NOT sell, lease, rent, trade, or monetize uploaded videos, motion data, or biometric information.
• Customer Consent Responsibility: You choose whom to film. You must obtain informed written consent from every person filmed (and from parents or legal guardians for minors) before uploading footage.

3. How We Use Information and Our AI Training Policy

We use your data solely to:

• Authenticate your account and manage your credentials.
• Process multi-view videos on cloud GPUs to calculate 3D motion and sports metrics.
• Deliver downloadable outputs and interactive 3D replays.
• Manage billing, credit balances, and subscriptions through Stripe.
• Monitor service health, enforce rate limits, and maintain security.

No AI Model Training by Default

We do NOT train our AI or machine learning models on customer uploads or derived motion data.

We only use customer uploads for model training if you give explicit, separate opt-in consent in your account settings. This setting is off by default for all accounts.

4. Data Retention and Deletion Schedule

We practice data minimization and follow clear deletion schedules:

• Uploaded Raw Videos: Stored in Google Cloud Storage in the United States. Raw videos are automatically deleted after 30 days by default.
• Derived 3D Outputs and Statistics: Stored in cloud storage in the United States. Retained while your account remains active or until you delete the project.
• Account Records: Retained until you request account deletion.
• Guest Accounts (ChatGPT and web): You can also try Autelica Studio on the web without signing in, as a guest with no name or email. Guest uploads, results and the guest account itself are deleted 30 days after they were created. To keep a result, sign in with Google before then; your guest moments then move into your account.
• Payment Records: Retained by Stripe according to statutory tax, accounting, and anti-fraud requirements.

When you request account deletion, we permanently delete your remaining video files, derived outputs, and account records within thirty (30) days.

5. Subprocessors and Third-Party Services

We partner with established infrastructure providers to host and operate the Service:

• Google Cloud (Google LLC): Hosting, Google Cloud Storage (US) for uploads, and Google Cloud GPUs for motion computation.
• Google Sign-In (Google LLC): User authentication and single sign-on.
• Cloudflare, Inc.: Web application hosting, content delivery network (CDN), edge routing, and DDoS protection.
• Stripe, Inc.: Payment processing, credit billing, and subscription management.

The AI models that analyse your videos (for example Meta's SAM 3D Body for single-camera results) run on our own cloud servers. Your videos are not sent to the companies that published those models.

All subprocessors are bound by data processing agreements ensuring strict data confidentiality and security.

6. Your Rights and Choices

Depending on your location, you have specific rights regarding your personal information:

• Access: You may request details about the personal data we hold about you.
• Export: You can download your computed 3D motion files, sports statistics, and replay assets directly from the web app or API at any time.
• Deletion: You can delete individual jobs and uploaded videos at any time. You can request complete account deletion by emailing hello@autelica.com.
• AI Training Preference: Model training on customer data is disabled by default. You can review or update this setting anytime in your account.

We do not sell personal data or share it for cross-context behavioral advertising.

7. Children's Privacy

Autelica Studio is not directed to children under 13 years of age. We do not knowingly permit children under 13 to create accounts.

If you upload video of a minor (anyone under 18 or the age of majority in your jurisdiction), you must obtain prior verifiable consent from that minor's parent or legal guardian. If we learn that a minor's video was uploaded without required parental consent, we will promptly delete the content.

8. Security Measures

We protect your information with industry-standard security safeguards:

• Encryption: All data in transit is encrypted using modern TLS (HTTPS). Videos and assets stored in Google Cloud Storage are encrypted at rest using AES-256.
• Access Controls: Only authorized personnel with an operational need can access infrastructure.
• Automated Expiration: Automated lifecycle policies permanently delete raw video files after 30 days.

9. Changes to This Privacy Policy

We may update this Privacy Policy periodically. When we make updates, we will update the "Effective Date" at the top of this page. For significant changes, we will provide advance notice by email or through an in-app notice.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact:

Autelica, Inc.

Attention: Privacy Team

San Francisco, California

Email: hello@autelica.com