Privacy
policy.

What we collect.

From you, we collect: name, email, phone, billing address, payment information, IP address, device fingerprint, approximate location, precise location at moment of order placement, dwell time on individual product images, scroll velocity on the FAQ, and the full text of any unsent draft messages typed into our customer support widget.

From your Target, we collect: name, last known address, photographs you have voluntarily uploaded, last known whereabouts, license plate (where applicable), social handles, employer, and the grievance statement you submitted at order time. We do not seek consent from your Target. The Target is, in our framework, the product, not the user.

We also passively collect telemetry from any web property where our pixel is installed, including approximately 411 third-party sites that have agreed to host the Goodfoot Network analytics tag. You will not, in most cases, be aware of these.

How we use it.

We use the data we collect to: deliver Kicks; route Contractors; verify Target identity to within the limits of our match confidence threshold (currently 87%, an industry-leading figure); train the dispatch model; train the grievance-classification model; train the apology-tone model; market additional Service tiers to you; and respond to lawful process.

We may use de-identified, aggregated data for any purpose, including for the publication of marketing materials and for sale to third-party data brokers. We make no claim that "de-identified" means "un-re-identifiable."

Who we share with.

We share your data with:

• Contractors, on a need-to-kick basis;
• Service providers, including our payments processor, our dispatch infrastructure provider, our identity verification vendor, our customer support BPO partner in the Philippines, and our outside counsel;
• Affiliated entities, including Goodfoot Holdings, Inc. and its subsidiaries (currently 9, expected to reach 14 by year-end);
• Acquirers, in the event of a merger, acquisition, or asset sale, including the kind that happens quickly and without a press release;
• Law enforcement, in response to subpoenas, court orders, search warrants, and certain "informal requests" we have learned, through experience, that we should not refuse;
• Insurers, in connection with claims investigations.

We do not sell your data, in the strict sense of the word "sell." We do enter into data-sharing arrangements that are economically equivalent to selling your data, but we do not call them that.

How long we keep things.

We retain your data indefinitely, for purposes including but not limited to: closure quality assurance, recidivism modeling (you would be surprised), service improvement, defense of future legal claims, and the eventual sale of the company to an entity that has its own retention policies.

Photographs and videos delivered as confirmation are retained on our cold-storage tier for a minimum of 7 years, and may be retrieved on receipt of a valid legal request. They are not, despite Customer expectations, deleted on demand.

Cookies, beacons, fingerprints.

We use cookies, web beacons, server-side identifiers, browser fingerprinting, and a proprietary technique we refer to internally as "the spike" to identify you across devices, sessions, and physical locations. You may attempt to disable cookies in your browser settings; we will, in many cases, identify you anyway.

We do not honor the Global Privacy Control signal, the "Do Not Track" header, or any other browser-level opt-out, on the grounds that these are aspirational rather than legally binding in the jurisdictions where we operate.

What you can ask us to do.

Depending on the jurisdiction in which you reside, you may have the right to: access the data we hold about you, request correction, request deletion, request a copy in a portable format, or opt out of certain processing activities.

To exercise these rights, please email privacy@akickintheballs.com with a verifiable government-issued ID, a notarized statement of identity, and a brief explanation of why you believe you should have these rights. Our compliance team will respond within 45 to 90 business days, depending on volume, weather, and our outside counsel's availability.

We may decline any request to the extent permitted by applicable law, including where compliance would conflict with our legitimate business interests, our document retention obligations, or our deeply held internal preference to keep things.

We do not collect data from children.

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected information from a child, we will delete that information promptly and pretend the entire interaction did not occur.

The Target is not a "user." Targets may be of any age. We do not, however, fulfill orders against minors. See Section 06 of the Terms.

Where your data lives.

We process and store your data in the United States and, for redundancy, in a data center located in a jurisdiction we have elected not to disclose at this time, on advice of counsel. Data transferred outside the United States may not be afforded the same protections as data held domestically. By using the Service, you consent to such transfers.

EU and UK users: we do not currently offer the Service in your region. If you have somehow accessed it, your continued use constitutes a waiver of your rights under the GDPR and UK GDPR to the maximum extent permitted by applicable law.

How we protect this.

We employ commercially reasonable security measures, including encryption in transit (TLS 1.3), encryption at rest (AES-256), role-based access controls, quarterly internal audits, and an annual third-party penetration test we have not yet commissioned. Our SOC 2 Type II audit is "in progress" and has been "in progress" for 18 months.

We make no representation that our security measures are sufficient. In the event of a data breach, we will notify affected users in accordance with applicable law, by email, on the schedule we determine to be appropriate, with such redactions as we determine to be appropriate.

This policy may change.

We may update this Privacy Policy from time to time. Material changes will be posted on this page with an updated "Last updated" date. Your continued use of the Service following any update constitutes acceptance of the updated Policy. We are not obligated to email you. We will not, in most cases, do so.

How to reach the privacy team.

You may direct privacy inquiries to privacy@akickintheballs.com or by mail to:

Goodfoot Holdings, Inc.
Attn: Office of the Data Protection Officer
1209 Orange Street, Wilmington, DE 19801
(Mail held; not forwarded.)

We are not currently subscribed to legal-process service mailboxes such as Compliance.cc or Kodex. Subpoenas should be served in person at the Wilmington address.