Privacy Policy

1. Introduction

ARIA (“ARIA,” “we,” “us,” or “our”) provides technology designed to help student-athletes navigate the college recruiting process and help college coaches identify and evaluate prospective student-athletes.

This Privacy Policy explains what information ARIA collects and processes, how we use it, when it may be shared, how we retain and protect it, and the choices individuals may have regarding their information.

ARIA processes information about both individuals who create ARIA accounts and prospective student-athletes whose recruiting information may be obtained from public or external sources.

Athletes and parents also agree to the ARIA Terms of Use, and college coaches agree to the ARIA Coach Agreement. This Privacy Policy controls how personal information is handled under both.

2. Information You Provide to ARIA

When you create or use an ARIA account, you may provide information like:

Name and email address
Date of birth
Graduation year
Location
High school and club information
GPA
SAT or ACT scores
Coursework and academic information
Intended major and academic interests
Athletic information and manually entered performances
College preferences
Recruiting goals and priorities
Target college programs
Profile photograph
Calendar, roadmap, and task information
Messages submitted through ARIA’s AI features
Support requests and communications
Graduation-year verification documents, such as a high school transcript or other official document
Athletic index disputes and related information
Parent or guardian contact information and account links
Subscription and billing information, such as the purchaser’s name, billing email, billing address, plan, billing period, and payment history
Records of acceptance of the ARIA Terms of Use or Coach Agreement
Other information you choose to provide

The information collected depends on the ARIA features you use.

Payment Information

When an adult purchases ARIA Premium, or a coach or institution purchases a coach subscription, payment card details are entered directly with ARIA’s payment processor (see Section 14). ARIA does not collect or store full payment card numbers. ARIA receives limited information from the payment processor, such as the card type, last four digits, expiration date, billing postal code, and whether a payment succeeded.

3. Data Sources and ARIA’s Recruiting Analytics

ARIA uses publicly available swimming performance data from official meet results, governing-body databases, and collegiate athletics sources, together with information voluntarily provided by athletes and parents.

Performance data: Official meet results and governing-body performance databases, including USA Swimming Data Hub where applicable.
College data: Official college athletics team rosters and program information.
Athlete profile data: Information provided and shared by athletes or parents through ARIA.

Publicly available recruiting information may include:

Athlete name
Graduation year
Gender
High school
Club team
Hometown or general location
Swimming events and performances
Meet information
Rankings
Commitment information
Other recruiting-relevant athletic information

ARIA imports recruiting profiles only for athletes in high school. ARIA does not import swimming results dated before January 1 of the athlete’s graduation year minus five (for example, January 1, 2024 for the Class of 2029). Earlier results are not stored in ARIA’s recruiting database.

How ARIA’s Recruiting Analytics Work

Publicly available results remain publicly available information when ARIA analyzes them.

ARIA’s analytics follow this path:

Public swim result → ARIA obtains the time → ARIA calculates the Athletic Index → college coaches pay for ARIA’s analytics.

College coaches pay for ARIA’s analysis tools, such as the Athletic Index, roster-need projections, and program-fit analytics. They do not pay to buy athletes’ personal information, and ARIA does not sell personal information (see Section 15).

The Athletic Index is ARIA’s estimate of how an athlete’s swimming compares with a college program’s competitive level. ARIA calculates it from the athlete’s best verified individual times, compared with recent conference championship results, with small program-specific adjustments for relay needs, event versatility, and roster needs. Self-reported times are not used until they are verified. The Athletic Index is an estimate, not an official ranking, and does not guarantee recruitment, admission, or scholarships.

4. Athletes Without ARIA Accounts

An athlete may appear within ARIA’s recruiting database even if the athlete has never created an ARIA account.

ARIA limits these profiles to publicly available recruiting information, such as meet results, rankings, and commitments, and analytics derived from that information.

The presence of an athlete within ARIA does not mean that the athlete:

Created an ARIA account
Endorsed ARIA
Verified the information
Consented to ARIA’s services
Authorized ARIA to share private account information

If an athlete later creates an ARIA account and links or claims an existing recruiting profile, private information provided through the ARIA account will be treated separately from independently sourced recruiting information.

Recruiting profiles of athletes without ARIA accounts are visible only to verified college coaches and authorized ARIA personnel. They are not visible to other athletes, other ARIA users, parents of other athletes, or the public.

ARIA will provide a process through which individuals may request correction or removal of eligible information.

5. How ARIA Uses Information

ARIA may use information to:

Provide and operate ARIA
Personalize the recruiting experience
Generate recruiting roadmaps and recommendations
Analyze athletic performance and progression
Identify potentially relevant college programs
Help verified college coaches identify prospective student-athletes
Provide AI-powered recruiting assistance, as described in Section 13
Maintain athlete profiles
Manage recruiting tasks, calendars, and goals
Facilitate permitted athlete-to-coach information sharing
Send service and recruiting notifications
Provide customer support
Investigate technical problems
Protect ARIA and its users
Prevent misuse, fraud, and abuse
Comply with legal obligations
Process payments, manage subscriptions, send receipts and renewal reminders, and prevent payment fraud
Keep records of acceptance of the Terms of Use and Coach Agreement
Improve ARIA’s services and features
Verify graduation year and eligibility for coach-facing features
Verify college coach identity and affiliation
Review athletic index disputes
Send marketing communications to users who have opted in

6. De-identified and Aggregated Information

ARIA may create de-identified or aggregated information from the information it processes, such as average times of recruited athletes in a conference or benchmark ranges for an event.

ARIA uses de-identified and aggregated information only within ARIA, including to operate and improve the Service and to display benchmarks to users. ARIA does not currently publish or share it with third parties outside ARIA.

“De-identified” means information with names, contact details, photographs, and account identifiers removed. Swimming times and other results used this way are already publicly available.

ARIA will not attempt to re-identify de-identified information, except to test whether its de- identification is effective.

7. Information Available to College Coaches

ARIA distinguishes between recruiting information obtained from public or external sources and private information provided through an athlete’s ARIA account.

Verified college coaches may have access to recruiting-relevant public or imported information, including athletic identity information, swimming performances, and analytics derived from those performances.

Private academic information and college preferences are subject to additional sharing controls.

Academic Information and College Preferences

Eligible athletes must affirmatively share applicable academic or preference information before a verified coach can access it. Turning on sharing does not make the information public. It gives ARIA permission to disclose the specified information, and only that information, to the verified coaches the athlete has chosen. The athlete can see exactly what is covered before turning sharing on, and can turn it off at any time. A verified coach may share this information within the coach’s program coaching staff and institution’s athletics compliance office only as described in Section 8.

ARIA keeps a record of each sharing permission an athlete grants or withdraws, including the date, the information covered, and the version of this Privacy Policy in effect. An athlete may withdraw a sharing permission at any time; withdrawal stops future coach access but cannot recall information a coach already viewed.

Depending on what the athlete chooses to share, this may include:

GPA
SAT or ACT information
Intended academic interests
Academic rigor indicators
Geographic preferences
Campus or college-size preferences
Recruiting priorities and goals
Other applicable college preferences

8. College Coach Accounts

When a college coach creates an ARIA account, ARIA may collect the coach’s name, title, institution, sport, work email address, phone number, and information submitted to verify the coach’s identity and affiliation. If a coach or the coach’s institution purchases a paid plan, ARIA also collects billing information as described in Section 2.

Coach accounts are verified manually by authorized ARIA personnel before the coach can access athlete recruiting information. ARIA will revoke a coach’s access when the coach’s affiliation cannot be confirmed or ends, such as when the coach leaves the institution. A coach who loses access must stop using ARIA and delete athlete information obtained through ARIA, except information the coach’s institution must keep to meet NCAA, conference, institutional, or legal record-keeping requirements. Anything kept remains subject to the use restrictions below, which also continue to apply to anything the coach already viewed.

Verified coaches may use athlete information available through ARIA only for legitimate college recruiting purposes for their own institution. Coaches may share athlete information only with their program’s coaching staff and, to the extent needed to comply with NCAA or conference rules, their institution’s athletics compliance office. Coaches may not sell, publish, bulk-export, or share athlete information with anyone else, and must follow applicable NCAA and conference recruiting rules. These obligations are set out in the ARIA Coach Agreement.

ARIA records which coaches access athlete information and may audit that access.

9. Target Programs

Adding a college program to Target Programs is private by default. On or after the athlete’s Coach-Access Date (June 15 following the athlete’s sophomore year of high school, as described in Section 10), an athlete may turn on a separate “Share my interest” setting for each targeted program. When that setting is on, only verified coaches of that specific program will see that the athlete is interested in it. The athlete may turn the setting off at any time.

Men’s and women’s programs are separate programs, even at the same college. A coach of a college’s women’s team will not see an athlete’s interest in that college’s men’s team, and a coach of a college’s men’s team will not see an athlete’s interest in that college’s women’s team.

Each program is handled independently. A coach will not receive information about an athlete’s interest in any other program, including other programs at the coach’s own college.

For example, if an athlete targets the Columbia men’s, Harvard men’s, and Princeton men’s programs, a verified Columbia men’s coach may learn that the athlete is interested in the Columbia men’s program. That coach will not learn through this feature that the athlete has also targeted Harvard or Princeton, and Columbia women’s coaches will not see the athlete’s interest at all.

Target-program interest is not disclosed through this ARIA account feature before the athlete’s Coach-Access Date.

10. Minors, Age Requirements, and Coach-Access Date

ARIA accounts are only for individuals age 14 or older. If ARIA learns that an account belongs to someone under 14, ARIA will close the account and delete its private information.

ARIA applies additional privacy protections to athletes who have not yet reached their Coach-Access Date. An athlete’s “Coach-Access Date” is June 15 following the athlete’s sophomore year of high school, consistent with NCAA recruiting-contact timelines. ARIA determines this date from the athlete’s graduation year (June 15 of the graduation year minus two; for example, June 15, 2027 for the Class of 2029).

Before their Coach-Access Date, athletes may use ARIA and may appear to verified college coaches through recruiting information obtained from appropriate public or external sources.

However, private ARIA account-derived information is not intended to be disclosed to coaches before the athlete’s Coach-Access Date.

This includes restrictions on coach access to:

ARIA-uploaded profile photographs
Private academic information
Private college preferences
ARIA target-program interest
Other private ARIA account-derived coach disclosures

ARIA verifies an athlete’s graduation year before enabling coach-facing features. Verification requires the athlete or a parent or guardian to submit an official document that shows the athlete’s expected graduation year, such as a high school transcript, a school letter, or a note from the athlete’s school counselor. Athletes may redact everything on the document except their name, school, and graduation year. ARIA uses these documents only for verification, limits access to authorized personnel, and deletes the document within [30] days after verification is complete, keeping only the verification result. Where ARIA cannot establish an athlete’s graduation year or that the athlete has reached their Coach-Access Date, private coach-facing disclosures will remain unavailable.

For users under 18, ARIA:

uses personal information only to provide the features the user asks for, to run and secure the Service, and as required by law, or with the user’s consent (and a parent’s where the law requires it);
does not sell their personal information or use it for targeted advertising;
does not use their personal information or AI conversations to train AI models;
does not collect precise geolocation; and
applies the AI safety protections described in Section 13.

Additional safeguards may apply to minors as required by applicable law.

11. Parents and Guardians

A parent or legal guardian may link to an athlete’s ARIA account through ARIA’s parent pathway. Linking requires confirmation by the athlete.

A linked parent or guardian may view information in the athlete’s account, such as the athlete’s profile, swimming results, roadmap, tasks, calendar, target programs, and sharing settings. [TO BE CONFIRMED: whether parents can view AI conversations and whether parents can change sharing settings.]

ARIA collects the parent or guardian’s name, email address, relationship to the athlete, and account-link information.

Athletes control what they choose to share. For athletes under 18, a parent or guardian may also be involved in consent and account oversight. ARIA accounts are only for ages 14 and older, and ARIA closes any account it learns belongs to someone under 14 (see Section 10).

Only an adult, usually a parent or guardian, may purchase ARIA Premium for an athlete. The purchaser’s billing information is handled as described in Section 2.

For athletes ages 14 to 17, sharing information with coaches and the Athletic Index features described in Section 12 require the athlete’s own consent, together with acknowledgment from a linked parent or guardian where one is linked. An athlete’s “No” always overrides a parent’s “Yes”: a parent or guardian cannot turn on sharing or profiling that the athlete has declined. A verified parent or guardian may request deletion of the athlete’s account.

A parent or legal guardian of an athlete under 18 may also submit other privacy requests on the athlete’s behalf, subject to identity and relationship verification.

12. Swimming Results and Verification

ARIA distinguishes between swimming results obtained from external sources and results manually entered by athletes.

A manually entered swimming result is considered self-reported unless ARIA independently verifies it.

ARIA uses the following categories:

Imported or Verified Result: A result obtained from or independently matched to an accepted source.

Verified Manual Result: A result originally submitted by an athlete that ARIA subsequently verifies using acceptable independent evidence.

Self-Reported Result: A result entered by an athlete that has not been independently verified.

Self-reported results are visible only to the athlete (and a linked parent or guardian). College coaches do not see self-reported results. Once ARIA verifies a self-reported result, it becomes a regular result and is treated the same as an imported result, including being visible to coaches.

If information underlying a verified manually entered performance is materially changed, its verified status is removed until the result is verified again.

Athletic Index and Disputes

ARIA calculates an Athletic Index and related recruiting analytics from swimming results, as described in Section 3. These are ARIA’s estimates, not official rankings, and do not guarantee recruitment, admission, or scholarships.

ARIA treats the Athletic Index as automated profiling of minors. For athletes under 18 with ARIA accounts, ARIA shows the athlete’s Athletic Index and related analysis to coaches only with the athlete’s explicit consent (see Section 11). ARIA maintains a documented risk and impact assessment of the Athletic Index and reviews it whenever the calculation method changes.

An athlete (or a linked parent or guardian) may ask ARIA how their Athletic Index was calculated, including the results it used and the main factors that affected it, and may submit a dispute about their Athletic Index or the results used to calculate it. Disputes are reviewed by a person: authorized ARIA personnel, who may correct underlying data, recalculate the index, or explain the result. ARIA keeps a record of disputes and their outcome.

13. Artificial Intelligence

ARIA uses artificial intelligence (“AI”) to provide personalized recruiting assistance, such as answering recruiting questions, helping plan roadmaps and tasks, and explaining an athlete’s results and analytics.

You Are Talking to AI

ARIA’s assistant is an AI system, not a person. ARIA tells users this at the start of every AI conversation. AI responses are generated automatically, may be inaccurate, and are not reviewed by a person before they are shown.

AI Does Not Make Decisions About You

ARIA does not use AI to make decisions about athletes. The Athletic Index, program-fit analytics, and other scores are calculated by fixed formulas from swimming results (see Sections 3 and 12), not by an AI model. ARIA’s AI may explain these results but does not calculate, change, or override them. ARIA does not use AI to score, rank, or recommend athletes to college coaches, or to decide any recruiting, admission, eligibility, or scholarship outcome. Colleges and coaches make their own decisions.

Who Processes AI Requests

ARIA processes AI requests through Amazon Bedrock, a service of Amazon Web Services, Inc. (“AWS”), in the United States. Through Amazon Bedrock, ARIA currently uses Anthropic’s Claude models to generate responses and Amazon’s Titan models to search ARIA’s own reference material. Under AWS’s terms for Amazon Bedrock:

AWS does not store the content of ARIA’s AI requests or the responses, except as described below for abuse detection.
AWS does not use them to train AI models.
AWS does not share them with the companies that make the models. Anthropic does not receive ARIA’s AI requests, responses, or user information.
AWS runs automated checks to detect abuse of its services. AWS states that these checks do not involve human access to request or response content. AWS automatically blocks and may report suspected child sexual abuse material as required by law.

Before ARIA uses an AI model or provider whose terms allow request content to be kept, reviewed by people, or used for training, ARIA will update this section and give notice before the change takes effect.

What Information Is Sent to AI

To answer a request, ARIA sends the AI model only the information that feature needs. Depending on the feature, this may include the athlete’s graduation year, age range, swimming events and results, Athletic Index and related analytics, academic information the athlete entered, target programs, tasks and calendar items, earlier messages in the same conversation, and ARIA reference material, such as NCAA rules and recruiting dates.

ARIA does not include names, email addresses, exact dates of birth, profile photographs, phone numbers, or account identifiers in AI context unless a feature requires them. Government ID numbers, payment information, and graduation-year verification documents are never sent to AI.

When a verified college coach completes a Program Profile, ARIA may use the recruit-facing answers to help the AI describe that program’s recruiting to athletes. ARIA rewords these answers and does not quote them. Answers a coach marks as internal are never sent to AI or shown to athletes.

Information that users type into an AI conversation is processed as written. Do not type passwords, government ID numbers, financial account numbers, health information, or other people’s private information into an AI conversation.

Safety Protections

Because many ARIA users are under 18, ARIA applies safety instructions and automated content filters to every AI conversation. These are designed to keep conversations on recruiting, academics, and training; to block sexual, violent, hateful, or otherwise harmful content; and to point users to a trusted adult or emergency services if they describe a crisis. ARIA’s AI does not provide legal, financial, medical, or mental-health advice. No filter is perfect, and ARIA may review and improve these protections at any time.

AI Model Training

ARIA does not use user information, AI conversations, or athlete data to train or fine-tune AI models, and its AI providers do not use ARIA’s requests to train their models.

ARIA may in the future use de-identified information (as defined in Section 6), such as public swimming times with names removed, to improve its AI features, including training or fine-tuning models. ARIA will not use information that identifies a user, information from a user’s private account, or AI conversations for this purpose. If ARIA ever wants to use account information or AI conversations to train AI models, it will ask for separate, opt-in consent first and will use only information provided after that consent. ARIA will update this Privacy Policy and give notice before beginning any such use.

AI Chat Retention

ARIA currently retains AI conversation content while the associated ARIA account remains active. ARIA does not currently apply an automatic deletion period to AI conversations.

This includes:

User AI messages
AI responses
Stored conversation context
Stored AI prompt or context snapshots containing private user information

When an account is deleted, its private AI conversation information is deleted as part of account deletion. Copies may remain in database backups and infrastructure logs until those backups and logs expire under their own retention periods.

ARIA personnel do not read AI conversations except as described in Section 17, such as when a user asks for help with a specific conversation, or to investigate a documented safety, abuse, or security issue.

14. Service Providers

ARIA uses service providers and cloud infrastructure to operate the Service.

Current providers and services may include:

Amazon Cognito
Amazon RDS
Amazon S3
AWS Lambda
Amazon API Gateway
AWS Amplify
Amazon Bedrock, including the Anthropic Claude and Amazon Titan models it runs, for AI features (see Section 13)
Amazon SES
Amazon SQS
Amazon CloudWatch
Amazon EventBridge
[PAYMENT PROCESSOR — TO BE SELECTED], for payment processing

ARIA’s payment processor collects and stores payment card information under its own privacy policy and the Payment Card Industry Data Security Standard (PCI DSS). ARIA does not receive full payment card numbers.

15. How ARIA Shares Information

ARIA shares information only as described in this Privacy Policy:

With verified college coaches, including coaches who use ARIA’s paid recruiting tools, as described in Section 7 and Section 9
With a linked parent or guardian, as described in Section 11
With ARIA’s payment processor, to process payments and prevent fraud
With service providers that process information on ARIA’s behalf under contractual confidentiality and security obligations
When required by law, subpoena, court order, or other legal process, or to respond to lawful requests from public authorities
When reasonably necessary to protect the safety, rights, or property of ARIA, its users, or others, or to investigate fraud, abuse, or security incidents
In connection with a merger, acquisition, financing, reorganization, or sale of all or part of ARIA’s business, in which case information will remain subject to this Privacy Policy or be handled with notice to users
With the user’s direction or consent

ARIA offers paid recruiting analytics to verified college coaches. Coaches pay for ARIA’s analysis (such as the Athletic Index), not for personal information. Through those tools, coaches see only publicly available recruiting information, such as swimming results, and private information an athlete has given ARIA permission to disclose to them. ARIA does not sell personal information to advertisers, data brokers, or other third parties, never provides private account information an athlete has not chosen to share, and does not share personal information for targeted advertising.

16. Communications

ARIA may send transactional and service-related communications concerning accounts, recruiting activity, roadmaps, security, tasks, billing (such as receipts, renewal reminders, and failed-payment notices), and other ARIA features.

ARIA sends marketing communications, such as newsletters, product updates, and recruiting tips, only to users who opt in. Opt-in is a separate, unchecked checkbox and is never required to create an account. Every marketing email includes an unsubscribe link, and ARIA honors unsubscribe requests promptly. ARIA keeps a record of when and how each user opted in.

Users may be able to control certain categories of communications through notification preferences.

Some communications may remain necessary for account operation, security, or other essential service functions.

17. Internal Access to Private Information

ARIA personnel do not access a user’s private information merely because they have an administrative, engineering, or employee role.

For customer-support situations, access to private user information requires a support request or ticket created by the user.

Any such access will:

Be connected to the specific support request
Be limited to information reasonably necessary to investigate or resolve the request
Be available only to appropriately authorized personnel
Be recorded in an audit log

For example, a support request concerning an athlete’s GPA does not authorize an employee to browse the athlete’s AI conversations, college preferences, or unrelated private information.

ARIA permits narrowly scoped access without a user-created support request only when necessary for a documented security incident, abuse or fraud investigation, protection of ARIA or its users, or a valid legal obligation.

Exceptional access is authorized, limited, documented, and audited.

Engineering or administrator status alone does not provide access to private production user information.

18. Data Retention

ARIA retains personal information only for as long as necessary for the purposes for which it is processed.

Information associated with an active account may be retained while necessary to provide ARIA’s services.

AI conversation information is retained as described in Section 13 (AI Chat Retention).

Graduation-year verification documents are deleted within [30] days after verification, as described in Section 10. Coach verification information is retained while the coach account is active. Billing and transaction records are retained for as long as required for tax, accounting, and legal purposes [PERIOD — TO BE CONFIRMED, e.g., 7 years], including after an account is deleted. Records of acceptance of the Terms of Use, Coach Agreement, and sharing permissions are retained as long as needed to show consent.

Operational and security logs may have separate retention periods.

Recruiting information that ARIA obtains from external sources is always publicly available information, such as meet results, rankings, and commitments. ARIA may keep this public information, and aggregated statistics built from it, for recruiting research, benchmarks, and analytics. Only public information is kept for this purpose. Private information provided through an ARIA account is never kept for research after the account is deleted and is never used to build research benchmarks that identify an athlete. Individuals may request correction or removal of eligible public information as described in Section 21.

19. Account Deletion

ARIA provides users with a method to delete or request deletion of their ARIA account.

When an ARIA account is deleted, ARIA deletes the private information associated with that account unless retention is required by law.

When a coach deletes their account, ARIA removes the coach’s login immediately and keeps the coach’s recruiting board, shortlists, and notes for 30 days, then permanently deletes them. Public staff information, such as a coach’s name and title, is not deleted.

Depending on the account, this may include:

Private account information
ARIA profile photograph
Academic information provided through ARIA
Private college preferences and recruiting goals
Target-program relationships
AI conversations and private AI context
Roadmap and calendar information
Notifications
Sharing permissions
Unverified self-reported performances

ARIA may keep billing and transaction records and consent records after account deletion, as described in Section 18.

Deleting an ARIA account does not require deletion of publicly available recruiting information that ARIA obtained independently and maintains separately from the account.

For example, publicly available swimming results may continue to exist within ARIA’s recruiting database after an ARIA account is deleted.

After account deletion, ARIA will not represent the recruiting profile as belonging to an ARIA user. Only publicly available recruiting information remains.

An athlete-submitted performance independently verified by ARIA may be retained as recruiting information only where ARIA retains appropriate independent verification or provenance supporting the result.

20. Security

ARIA uses technical and organizational safeguards intended to protect information against unauthorized access, disclosure, alteration, loss, or misuse.

These measures may include authentication, authorization controls, access restrictions, auditing, monitoring, encryption of information in transit and at rest, and cloud infrastructure security controls. Users are responsible for keeping their account passwords confidential.

Access to production systems and private user information follows least-privilege principles.

If ARIA becomes aware of a security incident that compromises personal information, ARIA will investigate, take steps to contain it, and notify affected individuals (and a parent or guardian where appropriate) and regulators as required by applicable law.

No internet service or information system can guarantee absolute security.

21. Privacy Choices and Requests

ARIA provides mechanisms through which individuals may request:

Access to eligible personal information, including the categories of information collected, where it came from, why it is used, and who receives it
Correction of inaccurate or incomplete information
Deletion of eligible information
Restriction of, or objection to, certain processing
A portable copy of their information
Withdrawal or modification of applicable sharing permissions
Correction or removal of eligible non-user recruiting information
An explanation of how the Athletic Index was calculated, including the results it used, and a review of it by a person
Opting out of marketing communications

ARIA will not discriminate against anyone for exercising these rights, such as by denying service or changing the quality of the Service.

ARIA will confirm receipt of a privacy request within 10 business days and respond within 45 days. If more time is reasonably needed, ARIA may extend the response period once by up to 45 additional days and will explain why. Individuals in the European Union or United Kingdom will receive a response within one month.

ARIA may need to verify a requester’s identity before fulfilling a privacy request to protect against unauthorized access, modification, or deletion. An authorized agent may submit a request with the individual’s written permission. ARIA does not charge a fee unless a request is clearly unfounded, excessive, or repetitive, and may limit the same person to two access requests in a 12-month period.

Some information may not be deleted where retention is required by law or needed for security, fraud prevention, or legal claims. Publicly available recruiting information is handled as described in Sections 18 and 19.

The specific privacy rights available to an individual depend on where the individual resides and applicable law, including the laws of California and other U.S. states with consumer privacy laws.

22. International Data Processing

ARIA may be used by individuals located in multiple countries.

ARIA’s servers are located in the United States. By using ARIA from outside the United States, individuals understand that their information will be transferred to, stored, and processed in the United States, where it may be subject to lawful requests from U.S. courts and authorities.

Additional information for users in Canada and Korea appears in Sections 27 and 28.

23. Cookies, Browser Storage, and Similar Technologies

ARIA may use browser storage and similar technologies necessary for authentication, security, preferences, and operation of the Service.

ARIA does not use cross-site tracking or targeted advertising, so there is nothing for a Do Not Track signal to switch off. Where required by law, ARIA will treat a Global Privacy Control signal as a valid opt-out request.

24. Advertising and Sale of Personal Information

ARIA does not operate an advertising business and does not sell personal information to advertisers.

ARIA offers paid recruiting tools to verified college coaches. Those tools cover only publicly available recruiting information and private information an athlete has chosen to share, as described in Section 15.

25. Changes to This Privacy Policy

ARIA may update this Privacy Policy as its services, technology, business practices, and legal obligations evolve.

ARIA will post any changes on this page and update the “Last Updated” date. If a change materially affects how ARIA uses information it already holds, ARIA will notify affected users before the change takes effect and give them the opportunity to opt out of the new use.

Continued use of ARIA after a change takes effect means the user accepts the updated Privacy Policy.

26. Third-Party Links

ARIA may link to third-party websites, such as college athletics and admissions pages. ARIA is not responsible for the privacy practices or content of those websites, and this Privacy Policy does not apply to them.

27. Additional Privacy Information for Canadian Users

This section applies to users located in Canada and supplements the rest of this Privacy Policy.

Applicable laws. ARIA handles personal information of users in Canada in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, provincial private-sector privacy laws, including Quebec’s Act respecting the protection of personal information in the private sector.
Consent. ARIA relies on meaningful consent explained in plain language suited to the user’s age. Users may withdraw consent at any time, subject to legal or contractual restrictions, and ARIA will explain the effect of withdrawing.
Public recruiting profiles. [TO BE CONFIRMED: whether ARIA includes recruiting profiles built from public sources for athletes located in Canada, or only for athletes who create an account.]
Transfers outside Canada. Information is stored and processed in the United States by ARIA and its service providers and may be accessible to U.S. courts and authorities under U.S. law.
Quebec. ARIA publishes the name and contact information of its Privacy Officer. ARIA informs individuals when a decision about them is based exclusively on automated processing, such as the Athletic Index, and allows them to submit observations for review. ARIA assesses privacy risks before transferring personal information outside Quebec, and reports confidentiality incidents that present a risk of serious injury to the Commission d’accès à l’information and to affected individuals.
Breaches. ARIA reports breaches of security safeguards that create a real risk of significant harm to the Office of the Privacy Commissioner of Canada and notifies affected individuals.
Rights and complaints. Users may request access to and correction of their personal information as described in Section 21. Users may also contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy regulator.

28. Additional Privacy Information for Users in Korea

This section applies to users located in the Republic of Korea and supplements the rest of this Privacy Policy. ARIA will provide a Korean-language version before offering the Service in Korea.

Items, purposes and retention. [TO BE COMPLETED: a table listing each item collected, the purpose, and the retention period for that item.]
Separate consent. ARIA obtains separate consent for collection and use of personal information, for disclosure to college coaches, and for transfer of personal information outside Korea.
Transfer outside Korea. Items: the account and profile information described in Section 2. Destination: United States. Recipients: Amazon Web Services, Inc. (hosting, storage and AI processing) and [PAYMENT PROCESSOR — TO BE SELECTED] (payment processing, for purchasers only). Timing and method: transmitted over the network when the user uses the Service. Retention: as described in Section 18. Users may refuse this transfer, but the Service cannot be provided without it.
Generative AI. ARIA’s assistant uses generative AI (see Section 13). ARIA tells users before they use it, and AI-generated responses are labeled as AI-generated.
Children under 14. ARIA accounts are for ages 14 and older. ARIA does not knowingly collect personal information from children under 14 and closes any account it learns belongs to a child under 14.
Rights. Users may request access, correction, deletion, or suspension of processing, and may withdraw consent, as described in Section 21.
Destruction. ARIA destroys personal information without delay once its retention period ends or its purpose is achieved; electronic files are deleted in a way that cannot be restored.
Chief Privacy Officer and domestic representative. Chief Privacy Officer: [TO BE NAMED]. Domestic representative in Korea: [TO BE DESIGNATED if required].
Complaints. Users may contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, dial 118) or the Personal Information Dispute Mediation Committee.

29. Contact Us

ARIA is operated by [LEGAL ENTITY NAME — TO BE INCORPORATED]. ARIA has designated a Privacy Officer responsible for its privacy practices. Questions or requests concerning this Privacy Policy or ARIA’s privacy practices may be directed to:

ARIA
Privacy Email: privacy@ariarecruiting.com
Support Email: support@ariarecruiting.com
Website: ariarecruiting.com
Mailing Address: [TO BE DETERMINED]
Privacy Officer: [TO BE NAMED]