1.  WHO WE ARE AND HOW TO CONTACT US

INCISIV Ltd (“INCISIV”, “we”, “us”, “our”) is a company incorporated in Northern Ireland (Company No. NI640586) with registered address at 18 Ormeau Avenue, Belfast, BT2 8HS, United Kingdom. INCISIV is the data controller for personal data processed under this policy, except where noted in Section 4 (Academy Owners and Authorised Users).

‍

Data enquiries and rights requests:  support@incisiv.tech

Post:  INCISIV Ltd, 18 Ormeau Avenue, Belfast, BT2 8HS, United Kingdom

Supervisory Authority:  The Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, SK9 5AF. Website: ico.org.uk. You have the right to lodge a complaint with the ICO at any time, though we would appreciate the opportunity to address your concerns first.

‍

2.  SCOPE OF THIS POLICY

This policy applies to personal data collected and processed in connection with:

• our virtual reality training applications (including CleanSheet Pro, CleanSheet Soccer, CleanSheet 2, NeuroFit Labs, and NeuroFitXR);
• our mobile companion applications;
• our websites, including incisiv.tech;
• our affiliate partner programme;
• customer support, email and other communications with us.

This policy applies to all users of our Services, including individual Consumers, Academy Owners, Authorised Users (players and staff accessing the Service under an Academy Licence), Affiliate Partners, and visitors to our websites.

‍

3.  INFORMATION WE COLLECT

3.1  Information You Provide

‍

3.2  Information We Collect Automatically

• Performance data: when you use our VR applications we generate data about your in-app performance including reaction times, movement metrics, task accuracy, drill completion rates, GKIQ scores and career mode progress. This data is linked to your username.
• Usage and device data: IP address, device type, operating system, application version, unique device identifiers, session duration, features accessed, crash reports and technical interaction metadata.
• Subscription status data: subscription tier, start and renewal dates, cancellation events and payment status, used to manage your access to the Service.

3.3  Cookies and Tracking Technologies

Our website (incisiv.tech) uses cookies and similar tracking technologies. We use:

• Strictly necessary cookies: required for the website to function (e.g. session management, security). These cannot be disabled.
• Analytics cookies: we use Google Analytics to understand how visitors use our website (pages visited, time on site, referral sources). This data is aggregated and does not identify you personally. Analytics cookies are set only with your consent where required by applicable law.
• Preference cookies: to remember your settings and choices.

You can manage cookie preferences through your browser settings or our cookie consent tool on the website. Disabling analytics cookies does not affect your ability to use the Service.

3.4  Information from Third Parties

• Application Stores: when you download or purchase through the Meta Quest Store, PlayStation Store or PICO Store, those platforms may share limited transaction or device data with us in accordance with their own policies. We do not control what those platforms collect.
• Affiliate tracking: we track affiliate referrals internally using unique promo codes issued through Stripe. When a purchase is completed using an affiliate promo code, Stripe records the transaction and associates it with the relevant code, allowing us to calculate commissions.
• Payment processors: Stripe provides us with transaction confirmation and billing status data for Direct Purchases. Stripe processes payment card data directly and is subject to its own privacy policy.
• ‍

4.  ACADEMY OWNERS AND AUTHORISED USERS

This section is important if you are a player, athlete or coach who has been given access to the Service by a school, university, academy, club or camp operator (an “Academy Owner”). In this situation, your Academy Owner is the data controller for your personal data and INCISIV processes it on their behalf.

4.1  Where you access the Service as an Authorised User under an Academy Licence, the Academy Owner is the data controller for your personal data. INCISIV acts as a data processor on the Academy Owner’s behalf, processing your data only as instructed by the Academy Owner and as necessary to provide the Service.

4.2  Your performance data — including but not limited to reaction times, drill scores and GKIQ results — will be visible to the Academy Owner and authorised coaching staff through the companion application and any reporting tools provided as part of the Academy Licence. You should direct questions about how your Academy Owner uses your data to the Academy Owner directly.

4.3  The Academy Owner is responsible for: (a) obtaining all necessary consents from Authorised Users (and, where Authorised Users are Minors, from their parents or guardians) before granting access to the Service; (b) providing Authorised Users with notice of this Privacy Policy; and (c) ensuring that data sharing within their organisation complies with applicable data protection law. INCISIV’s obligations to Academy Owners in respect of data processing are set out in our Data Processing Agreement, available on request.

4.4  If you are an Authorised User and wish to exercise your data rights (see Section 9), you should contact your Academy Owner in the first instance. Where INCISIV receives a data rights request from an Authorised User, we will notify the Academy Owner and process the request in accordance with applicable law and the Academy Owner’s instructions, except where we are required by law to respond directly.

‍

5.  HOW WE USE YOUR INFORMATION

‍

6.  HOW WE SHARE YOUR INFORMATION

We do not sell your personal data. We may share information in the following circumstances:

• With other app users: your username and performance scores may appear on leaderboards within the companion application, visible to other users.
• With Application Store platforms: when you use the Service on Meta Quest, PlayStation or PICO, those platforms may operate their own leaderboard and social features (such as displaying your gamertag on a Meta global leaderboard) governed by their own privacy policies.
• With Academy Owners: if you are an Authorised User, your performance data is accessible to your Academy Owner and its authorised coaching staff as described in Section 4.
• With service providers: we use carefully selected third-party providers to deliver the Service, including Google Firebase (cloud hosting and database), Stripe (payment processing and affiliate commission tracking), HubSpot (CRM and email communications) and Google Analytics (website analytics). Each provider is bound by a data processing agreement and may only use your data to provide services to INCISIV.
• With Affiliate Partners: we may share anonymised or aggregated conversion data with Affiliate Partners to enable commission calculation. We do not share personally identifiable subscriber data with Affiliate Partners.
• During a business transfer: if INCISIV undergoes a merger, acquisition, sale of assets or similar transaction, personal data may be transferred to the acquiring entity subject to appropriate confidentiality arrangements. We will notify you of any such transfer that materially affects your data.
• For legal reasons: we may disclose personal data if required to do so by law, court order or regulatory authority, or where we reasonably believe disclosure is necessary to protect the rights, property or safety of INCISIV, our users or others.
• Aggregated or de-identified data: we may share aggregated, anonymised data (such as aggregate performance benchmarks across the user base) for research, marketing or product development purposes. This data cannot reasonably be used to identify you.
• ‍

7.  CHILDREN’S PRIVACY

7.1  The minimum age to use our Services is 10 years old, in line with Meta's published guidelines for VR headset usage. We do not knowingly collect personal data from children under 10 without verifiable parental or guardian consent.

7.2  We are aware that users aged 10 to 17 may use our Services, often through parent-managed accounts on platforms such as Meta Quest, or through an Academy Licence administered by a school, academy or camp. Where a parent, guardian or Academy Owner permits a child under 18 to use the Service, they confirm that they have obtained the necessary consent and accept responsibility for that child’s use as described in our Terms of Service.

7.3  United States — COPPA: where INCISIV determines that a user is under 13 and located in the United States, the Children’s Online Privacy Protection Act (“COPPA”) applies. In those circumstances INCISIV will not collect personal information from that child without first obtaining verifiable parental consent. Academy Owners in the United States who grant access to children under 13 are responsible for ensuring COPPA-compliant consent has been obtained before access is granted. If you believe we have inadvertently collected data from a child under 13 without consent, please contact us immediately at support@incisiv.tech and we will delete that data promptly.

7.4  Parents and guardians may request access to, correction of or deletion of a child’s personal data at any time by contacting support@incisiv.tech. We will respond within a reasonable time frame in accordance with applicable law.

7.5  We retain personal data of users under 18 only for as long as necessary to provide the Service or as required by law. See the retention table in Section 8 for details.

‍

8.  DATA RETENTION

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with legal obligations. The table below sets out our standard retention periods. Where a legal obligation requires longer retention, we will retain data for that period instead.

When data is no longer required, it is securely deleted or anonymised. Anonymised data that cannot be used to identify you may be retained indefinitely for product research and improvement purposes.

‍

9.  YOUR RIGHTS

We respect the privacy rights of all users. Depending on where you are located, you may have some or all of the following rights:

• Access: to request a copy of the personal data we hold about you.
• Rectification: to request correction of inaccurate or incomplete data.
• Erasure: to request deletion of your personal data, subject to certain legal exceptions (for example, where we are required to retain billing records).
• Restriction: to request that we restrict processing of your data in certain circumstances.
• Portability: to receive a copy of certain personal data you have provided to us in a structured, machine-readable format.
• Objection: to object to processing based on our legitimate interests. We will stop processing unless we have compelling legitimate grounds that override your interests.
• Withdrawal of consent: where processing is based on consent (such as marketing emails), you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Complaint: to lodge a complaint with the ICO (UK) or your local supervisory authority. Details for the ICO are in Section 1.

To exercise any of these rights, contact us at support@incisiv.tech. We will respond within 30 days. We may need to verify your identity before processing your request. There is no charge for exercising your rights, though we may charge a reasonable fee for manifestly unfounded or excessive requests.

If you are an Authorised User accessing the Service through an Academy Owner, please contact your Academy Owner in the first instance, as they are the data controller for your data. See Section 4.4.

‍

10.  INTERNATIONAL DATA TRANSFERS

10.1  INCISIV is based in the United Kingdom. Your data may be transferred to, stored in and processed in countries outside the UK and European Economic Area (“EEA”), including the United States, where our service providers (including Google Firebase, Stripe and HubSpot) operate.

10.2  When we transfer personal data from the UK or EEA to a third country, we use legally recognised transfer mechanisms to ensure your data receives an adequate level of protection, including: (a) the UK’s International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses for transfers from the UK; and (b) the EU Standard Contractual Clauses for transfers from the EEA. Copies of these mechanisms are available on request from support@incisiv.tech.

10.3  Application Store platforms (Meta, Sony, ByteDance) operate their own international data transfer frameworks governed by their respective privacy policies. INCISIV is not responsible for those transfers.

‍

11.  SECURITY

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include encrypted data transmission, access controls, regular security reviews and use of reputable cloud infrastructure providers.

No method of electronic transmission or storage is completely secure. While we take data security seriously, we cannot guarantee absolute security. If you become aware of any actual or suspected security breach involving your data, please notify us immediately at support@incisiv.tech.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and in accordance with our obligations under applicable law.

‍

12.  THIRD-PARTY LINKS AND PLATFORMS

The Service may contain links to third-party websites and services that are not operated by INCISIV. We have no control over the content, privacy practices or terms of those third-party services and are not responsible for them. We recommend you review the privacy policy of any third-party service you visit.

Application Store platforms (Meta, Sony, PICO) operate independently of INCISIV. Your use of those platforms — including any data those platforms collect when you download or launch our applications — is governed by their own privacy policies.

‍

13.  CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, the Services we offer, or applicable law. We will post the updated policy at incisiv.tech/privacy with the revised effective date. For material changes, we will provide at least 30 days’ prior notice by email to your registered address (for active subscribers) and/or by a prominent notice on our website. Your continued use of the Service after the effective date of any change constitutes acceptance of the updated policy.

Previous versions of this policy are available on request from support@incisiv.tech.

‍

14.  CONTACT US

For any questions, concerns or requests relating to this Privacy Policy or your personal data:

INCISIV Ltd

18 Ormeau Avenue, Belfast, BT2 8HS, United Kingdom

Email: support@incisiv.tech

Website: www.incisiv.tech

‍

Document version: 1 March 2026. Replaces all previous versions. Previous versions available on request.