FightClear Privacy Policy

This Privacy Policy explains how Kotuvium, LLC, a Maryland limited liability company ("Kotuvium," "Company," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information through the FightClear websites, hosted platform, beta programs, communications, and related services (collectively, the "Services").

FightClear℠ ("FightClear") is the online software service owned and operated by Kotuvium, LLC.

This Policy is a notice about data practices. The Terms of Service and EULA govern use of the Services. When a customer organization submits information about fighters, staff, ticket activity, or events, Kotuvium generally processes that information on the organization’s instructions, and the organization remains responsible for its collection and use.

PRIVACY HIGHLIGHTS • FightClear is a business operations platform. It may process account details, fighter and event records, limited weight or physical-status information, licensing or identity-document metadata, ticket-tracking records, communications, and security logs. • Kotuvium does not intentionally sell personal information for money or use personal information for cross-context behavioral advertising as of the Effective Date. • Payment-card details are handled by Stripe or another payment provider; Kotuvium should not receive or store full card numbers or card security codes. • Customers control most fighter and event data. Individuals should usually contact the promoter or organization that entered their information; Kotuvium will assist as required by law. • Appendix A is the FightClear Consumer Health Data Privacy Notice. Because some weight, injury, physical-status, or related information may be regulated in certain states, the Appendix should be prominently linked wherever legally required.

1. Scope

This Policy applies to personal information Kotuvium processes through the Services, account creation, billing, support, beta testing, and business communications. It does not apply to independent websites, platforms, or services controlled by third parties, even if linked or integrated with FightClear.

The Services are intended for United States business users age eighteen (18) or older. They are not directed to children or offered for personal, family, or household use.

2. Our Privacy Roles

2.1 Kotuvium as Controller or Business

Kotuvium determines the purposes and means of processing for account registration, subscription billing metadata, security logs, product operations, service communications, support records, website activity, and Kotuvium’s business administration. For this information, Kotuvium acts as a controller, business, or equivalent role under applicable law.

2.2 Kotuvium as Processor or Service Provider

A customer organization usually decides what fighter, event, bout, ticket, document, and internal-note information to place in FightClear and who may access it. For that Customer Data, Kotuvium generally acts as a processor or service provider and uses it only on the customer’s documented instructions, as needed to provide and secure the Services, or as law permits.

2.3 Customer Responsibilities

Customers must provide legally required notices, obtain legally required consent or authorization, limit collection to necessary information, configure access appropriately, and respond to individuals whose data they control. This Policy does not replace a customer’s own privacy notice.

3. Information We Collect

3.1 Account and Contact Information

• name, display name, business email, phone number, avatar, job or organization role, and authentication identifiers;
• organization name, type, website, location, logo, team membership, permissions, and onboarding status;
• acceptance records for legal terms and policies, including document version, timestamp, account identifier, and technical evidence of assent; and
• support requests, scheduling information, feedback, survey responses, and communications with Kotuvium.

3.2 Fighter and Participant Information Submitted by Customers

• legal and display name, photograph, date of birth, email, phone number, city, state, travel preferences, and availability;
• weight class, current weight, weight history, stance, fight record, experience, BoxRec or similar public profile link, and short-notice availability;
• license jurisdictions, license or federal identification expiration dates, verification status, and document-status information;
• assignment, backup, response, travel, compensation-expectation, contact, and participation information;
• check-in responses, notes, communications, and records entered by a promoter or submitted through a secure link; and
• limited physical, injury, training, availability, weight, licensing, or physical-confirmation indicators, as further described in Appendix A.

3.3 Event, Bout, Operational, and Ticket Information

• event name, date, venue, location, commission jurisdiction, schedule, status, and internal notes;
• bout order, weight, rounds, fighters, backups, commission status, operational risk status, explanations, and communications;
• ticket types, inventory, allocations, reported sales, returns, collections, outstanding balances, refunds, lost or complimentary tickets, deadlines, and related notes;
• event expenses, projected or actual costs, revenue estimates, break-even calculations, and audit records; and
• alerts, acknowledgments, changes, user actions, and other operational history.

3.4 Documents and Files

Where document functionality is enabled, customers may upload files such as license, federal ID, physical-confirmation, profile-verification, or other business documents. Kotuvium may collect file names, paths, type, issue and expiration dates, verification status, visibility settings, notes, and the file contents.

During beta, separate Beta Program Terms may prohibit uploading complete identification documents, medical records, or other sensitive files even if a technical field exists.

3.5 Subscription and Billing Information

• plan, subscription status, billing period, customer and subscription identifiers, payment status, invoices, and limited transaction metadata;
• billing contact and tax information when applicable; and
• payment-method type and limited display information provided by the payment processor, such as card brand and last four digits, if available.

DO NOT SUBMIT FULL PAYMENT-CARD NUMBERS, CARD SECURITY CODES, BANK CREDENTIALS, OR PAYMENT AUTHENTICATION DATA TO FIGHTCLEAR FIELDS OR SUPPORT CHANNELS. STRIPE OR ANOTHER PAYMENT PROVIDER PROCESSES PAYMENT CREDENTIALS UNDER ITS OWN PRIVACY TERMS.

3.6 Technical, Usage, and Security Information

• IP address, approximate location inferred from IP, browser, device type, operating system, language, time zone, and referring page;
• session and authentication identifiers, login time, pages or features used, clicks, errors, performance data, and diagnostic events;
• audit logs, security events, access attempts, user agent, request metadata, and information needed to detect abuse or protect accounts; and
• essential cookie and similar-technology data used for authentication, preferences, security, and service operation.

Kotuvium does not intentionally collect precise geolocation, biometric identifiers, or advertising-profile data unless a future feature is clearly disclosed and appropriate consent is obtained where required.

4. Sources of Information

• you and other Authorized Users;
• the customer organization that creates or manages records;
• fighters or other individuals who submit information through a secure FightClear link or communication;
• public sources that a customer chooses to reference, such as a public fighter profile;
• payment, hosting, authentication, security, and communications providers;
• devices, browsers, cookies, logs, and interactions with the Services; and
• business partners or authorities where permitted by law.

5. Why We Use Information

Kotuvium uses personal information for the following purposes, depending on context:

• create, authenticate, administer, and secure accounts and organizations;
• provide event, bout, fighter, backup, check-in, ticket-tracking, expense, alert, document, reporting, and related functions;
• process subscriptions, maintain billing records, prevent payment fraud, and provide invoices;
• route secure links, notifications, service messages, and customer-directed communications;
• provide support, troubleshoot, monitor performance, test changes, and repair defects;
• protect the confidentiality, integrity, availability, and lawful use of the Services;
• enforce agreements, investigate abuse, resolve disputes, and comply with legal obligations;
• conduct internal analytics, research, capacity planning, and product improvement using information appropriate for those purposes;
• administer beta programs, evaluate feedback, and determine product readiness; and
• create aggregated or de-identified information for lawful business purposes.

Where a law requires a legal basis, Kotuvium relies as appropriate on performance of a contract, legitimate business interests, compliance with law, protection of rights and security, and consent. A customer may rely on different grounds for Customer Data and remains responsible for them.

6. How We Disclose Information

Kotuvium may disclose personal information to:

• the customer organization, its administrators, and Authorized Users according to account permissions and customer instructions;
• service providers and subprocessors that support hosting, databases, storage, authentication, billing, communications, support, security, monitoring, and professional services;
• integrations or recipients a customer enables, requests, or directs;
• professional advisers, auditors, insurers, financing sources, and prospective or actual transaction counterparties under appropriate confidentiality obligations;
• courts, regulators, law enforcement, commissions, or other parties when Kotuvium reasonably believes disclosure is required or permitted by law, necessary to protect rights or safety, or appropriate to investigate fraud or abuse; and
• a successor or relevant counterparty in a merger, financing, reorganization, bankruptcy, acquisition, sale of assets, or similar transaction, subject to applicable law.

Kotuvium may disclose aggregated or de-identified information that does not reasonably identify an individual, subject to applicable law.

7. Sale, Targeted Advertising, and Automated Decisions

AS OF THE EFFECTIVE DATE, KOTUVIUM DOES NOT SELL PERSONAL INFORMATION FOR MONETARY CONSIDERATION AND DOES NOT USE OR DISCLOSE PERSONAL INFORMATION FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING OR TARGETED ADVERTISING BASED ON ACTIVITY ACROSS UNAFFILIATED SERVICES.

Kotuvium does not make solely automated decisions that produce legal or similarly significant effects about fighters or customers. Operational statuses and alerts are decision-support tools and require human review.

If these practices change, Kotuvium will update this Policy and provide rights or consent mechanisms required by law before the change takes effect.

8. Cookies and Similar Technologies

Kotuvium may use cookies, local storage, session identifiers, and similar technologies that are necessary for login, security, preferences, load balancing, fraud prevention, and core functionality. Kotuvium may also use limited first-party measurement tools in the future after updating this Policy and, where required, providing notice or choice.

Blocking essential technologies may prevent login or cause the Services to malfunction. Browser "Do Not Track" signals do not have a uniform legal meaning. Where applicable law requires recognition of a universal opt-out signal, Kotuvium will process a recognized signal for the covered browser or device.

9. Core Service Providers

Kotuvium currently expects to use providers in the following categories. The exact providers may change as the Services evolve. Customer should review the current online version before relying on this list.

Category: Current Example — Purpose / Data

Hosting and deployment: Vercel — Application hosting, delivery, request and performance logs

Database, authentication, and storage: Supabase — Account authentication, application database, private file storage, access controls

Subscription billing: Stripe — Checkout, subscription status, invoices, payment metadata; Stripe receives payment credentials

Communications: Provider selected by Kotuvium, if enabled — Service email, notifications, or customer-directed messages

Professional and security services: As engaged — Legal, accounting, insurance, incident response, monitoring, and support

10. Data Retention

Kotuvium retains personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain account and transaction records, comply with law, resolve disputes, enforce agreements, prevent fraud, maintain security, and complete backup cycles.

Retention depends on the type and sensitivity of information, customer instructions, account status, legal limitation periods, contractual requirements, technical constraints, and whether information is needed for a legal hold. Kotuvium may de-identify information instead of deleting it where permitted by law.

Termination of service does not necessarily cause immediate deletion from backups, logs, security records, or legally required archives. Beta Program Terms may permit earlier deletion, reset, or loss of beta data.

11. Security

Kotuvium uses administrative, technical, and organizational measures intended to protect information against unauthorized access, acquisition, use, alteration, and disclosure. Measures may include access controls, private storage configurations, encryption in transit, provider security controls, logging, least-privilege practices, and incident-response procedures, as appropriate to the Services.

NO SECURITY CONTROL, TRANSMISSION, STORAGE SYSTEM, OR AUTHENTICATION METHOD IS COMPLETELY SECURE. KOTUVIUM CANNOT GUARANTEE THAT INFORMATION WILL NEVER BE ACCESSED, LOST, ALTERED, OR DISCLOSED WITHOUT AUTHORIZATION.

Customers are responsible for credential security, Authorized User permissions, lawful sharing, secure devices and networks, and avoiding sensitive information that the Services prohibit.

12. Security Incidents and Breach Notices

Kotuvium maintains procedures to investigate suspected security incidents. When applicable law requires notice, Kotuvium will provide notice to affected individuals, customers, regulators, or others within the required time and in the required form. A customer acting as controller may be responsible for notices concerning Customer Data, and Kotuvium will provide commercially reasonable assistance as required by law and contract.

13. Privacy Rights

Depending on residence, relationship, and applicable law, an individual may have rights to:

• confirm whether personal information is processed and obtain access or a copy;
• correct inaccuracies;
• delete personal information, subject to exceptions;
• obtain portable information in a usable format;
• opt out of sale, targeted advertising, or certain profiling, if those activities occur;
• withdraw consent for future processing where consent is the basis;
• appeal a refusal to act on a request; and
• not receive unlawful discriminatory treatment for exercising a privacy right.

13.1 How to Submit a Request

Submit a request to the email address displayed on the FightClear Support page at /support, using the subject Privacy Request. Include sufficient information to identify the relevant account or relationship and the right requested. Do not send copies of government identification unless Kotuvium asks for a secure verification method.

Kotuvium may verify identity and authority using account access, email confirmation, organization records, or other commercially reasonable methods. Authorized agents may be required to provide proof of authority. Kotuvium will respond within the time required by applicable law and may extend the period when law permits.

13.2 Appeals

If Kotuvium denies a request, the individual may appeal by replying to the decision or emailing the address displayed on the FightClear Support page with the subject "Privacy Appeal." Kotuvium will provide information about further complaint options when required by law.

14. Requests Concerning Customer-Controlled Data

If a promoter or other customer entered an individual’s information, the customer is usually the most appropriate point of contact because it controls the record and relationship. Kotuvium may forward a request to the customer, identify the customer, or ask the individual to contact it. Kotuvium will assist the customer and respond directly where applicable law requires Kotuvium to do so.

15. Sensitive Information

Kotuvium seeks to limit sensitive information to what is necessary for the requested Services. Customers must comply with the Sensitive and Regulated Data Restrictions in the Terms of Service and any Beta Program Terms.

Kotuvium does not intentionally infer diagnoses, medical conditions, race, religion, sexual orientation, citizenship, or other sensitive traits from operational data. Kotuvium does not use limited health-related information for advertising. Additional practices for consumer health data appear in Appendix A.

16. Children and Minors

FightClear accounts are for adults. Kotuvium does not knowingly collect personal information directly from children under thirteen (13). During beta, customers may not submit information about anyone under eighteen (18) unless Kotuvium expressly authorizes it in writing and the customer documents all required parental, guardian, organizational, and legal authorization. If Kotuvium learns that prohibited child data was submitted, it may restrict access and delete the data.

17. United States Processing; International Users

Kotuvium operates FightClear from the United States, and information may be processed and stored in the United States and other locations used by service providers. The Services are not currently marketed to or intended for use in the European Economic Area, United Kingdom, or Switzerland. A customer must not use the Services in a jurisdiction requiring additional terms or transfer mechanisms unless Kotuvium has agreed in writing.

18. Business Transfers

Kotuvium may disclose or transfer information in connection with an actual or proposed merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar transaction. A recipient will be subject to applicable law and the privacy commitments that apply to transferred information, unless a lawful change is disclosed.

19. Changes to This Policy

Kotuvium may update this Policy to reflect legal, technical, vendor, or business changes. The updated version will identify a new effective date. Kotuvium will provide additional notice or obtain consent when required by law, particularly before materially expanding the collection or use of sensitive or consumer health data.

20. Contact

Kotuvium, LLC owns and operates FightClear.

Privacy questions and requests may be submitted to the email address displayed on the FightClear Support page at /support.

FightClear℠ is an unregistered service mark of Kotuvium, LLC.

APPENDIX A - CONSUMER HEALTH DATA PRIVACY NOTICE

This Appendix supplements the FightClear Privacy Policy for information that may qualify as "consumer health data" under laws such as the Washington My Health My Data Act or Nevada consumer health data law. It applies only to the extent a law covers Kotuvium or the relevant processing. It does not state that Kotuvium is a healthcare provider or that all information described is legally regulated health data.

A1. Categories of Consumer Health Data

• current weight, contracted weight, weight history, weight-class information, and related timestamps;
• availability, injury indicator, physical-status indicator, training-status response, and related operational notes;
• physical-confirmation status, license status, expiration dates, and verification status;
• information in a customer-submitted check-in response or file that reveals or could reasonably be linked to physical condition, health status, or fitness to participate; and
• inferences necessarily generated to display an operational status from the foregoing information, while not constituting a diagnosis or medical determination.

FightClear is not designed to collect diagnoses, treatment history, laboratory data, prescriptions, genetic information, biometric identifiers, health-insurance information, or complete medical records. Those categories are prohibited unless separately authorized in writing.

A2. Sources

• the individual;
• a promoter, customer organization, or Authorized User;
• a secure fighter-update or check-in link used by the individual;
• documents or communications a customer submits; and
• service providers that transmit or store the information on Kotuvium’s behalf.

A3. Purposes of Collection and Use

• provide customer-requested fighter, bout, check-in, backup, licensing-status, and event-readiness workflows;
• display trends, reminders, operational alerts, and records to the customer organization;
• authenticate users, secure accounts, prevent misuse, and troubleshoot the Services;
• respond to support, privacy, legal, or security requests; and
• comply with law and enforce agreements.

KOTUVIUM DOES NOT USE CONSUMER HEALTH DATA TO DIAGNOSE, TREAT, DETERMINE MEDICAL FITNESS, MAKE AUTOMATED ELIGIBILITY DECISIONS, SELL ADVERTISING, OR BUILD CROSS-CONTEXT ADVERTISING PROFILES.

A4. Categories Shared and Recipients

Kotuvium may share the categories described in A1 only as necessary with:

• the customer organization that submitted or requested the information and its Authorized Users;
• hosting, database, authentication, storage, communications, security, and support providers acting under contract;
• an integration or recipient the customer or individual specifically directs;
• legal, regulatory, or safety recipients when disclosure is required or permitted by law; and
• a transaction successor subject to applicable legal obligations.

As of the Effective Date, Kotuvium has no affiliates with which it shares consumer health data. Kotuvium does not sell consumer health data. Kotuvium does not permit a third party to collect consumer health data over time across unrelated websites or services for advertising through FightClear.

A5. Consent and Customer Instructions

When Kotuvium directly requests covered consumer health data from an individual, Kotuvium will obtain affirmative consent where required unless the collection is necessary to provide a product or service the individual requested. A separate consent will be obtained for sharing when required by law.

When a customer collects or submits information, the customer is responsible for obtaining all consent and authorization required for Kotuvium to process and disclose the information to the customer and its users. Kotuvium processes such data under the customer’s instructions and contractual restrictions.

A6. Consumer Health Data Rights

Where applicable, a consumer may request to:

• confirm whether Kotuvium collects, shares, or sells consumer health data;
• access the data and, where required, receive a list of third parties or affiliates with whom it was shared;
• withdraw consent for future collection or sharing;
• delete the data, subject to legal exceptions and permitted backup timelines; and
• appeal Kotuvium’s refusal to act.

Submit requests to the email address displayed on the FightClear Support page at /support, using the subject Consumer Health Data Request. Kotuvium may need to coordinate with the customer organization that controls the record and verify identity before acting. Kotuvium will not unlawfully discriminate for exercising a right.

A7. Security and Access Limits

Kotuvium limits access to personnel and providers who need it for the disclosed purposes and uses security measures appropriate to the volume and nature of the information. No system can guarantee absolute security.

A8. Changes to Consumer Health Data Practices

Kotuvium will not collect, use, or share an additional category of consumer health data, or use existing consumer health data for an additional purpose, without first updating this notice and obtaining affirmative consent where applicable law requires it.

A9. Geofencing

Kotuvium does not use a geofence around healthcare facilities or other covered locations to identify, track, collect information from, or send messages or advertising to individuals related to consumer health data.

THIS PRIVACY POLICY IS PROVIDED AS NOTICE. WHERE KOTUVIUM REQUESTS CONSENT FOR A SPECIFIC DATA PRACTICE, THAT CONSENT WILL BE OBTAINED SEPARATELY AND WILL NOT BE INFERRED MERELY FROM ACCEPTANCE OF THE TERMS OF SERVICE.