Privacy policy

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY ACCESSING OR USING THE SERVICES IN ANY MANNER, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THIS POLICY. IF YOU DO NOT AGREE, DO NOT ACCESS OR USE THE SERVICES.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

INTRODUCTION AND SCOPE

This Privacy Policy ("Policy") is issued by WITFL Holdings, Inc., a Wyoming corporation, operating under the TrackFIT brand ("TrackFIT," "WITFL Holdings," "Company," "we," "us," or "our"), and governs the collection, use, processing, storage, disclosure, transfer, and protection of personal information across all Company operations, including but not limited to:

• areyoutrackfit.com and all associated subdomains
• World Indoor Track & Field League (WITFL) platform infrastructure
• TrackFIT 3D Intelligence™ performance analysis systems
• Motion DNA™ Signature Tracking technology
• All live and digital TrackFIT Challenge events and Intelligence Sessions
• Mobile applications, registration portals, coach certification systems, and related digital touchpoints
• Email, SMS, and other direct communication channels operated by the Company

This Policy applies to all users, including athletes, coaches, parents, guardians, event spectators, website visitors, certification candidates, and any other individual who interacts with the Services in any capacity ("you," "your," "User").

This Policy does not govern information that has been fully de-identified or aggregated in a manner that cannot reasonably be re-linked to any individual.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 1 — INFORMATION WE COLLECT

We collect personal information from multiple sources and in multiple formats. The categories below reflect the full scope of data collection across the Services.

1.1 IDENTITY AND CONTACT INFORMATION
• Full legal name
• Preferred name or athlete handle
• Email address (personal and institutional)
• Phone number
• Mailing address, city, state, ZIP, and country
• Date of birth and age
• Gender identity and/or biological sex (as provided for classification purposes)
• Emergency contact information

1.2 ATHLETE AND PARTICIPANT DATA
• School affiliation, club, or organization
• Academic graduation year and division classification
• Athletic event(s) entered
• Belt classification and TrackFIT Score history
• Competition bracket, wave assignment, and heat placement
• Coach relationships and team affiliations
• Signed waivers and consent documentation

1.3 PERFORMANCE AND BIOMETRIC DATA
This category includes data derived from the Company's proprietary AI-powered systems, including TrackFIT 3D Intelligence™ and Motion DNA™ Signature Tracking:

• Ground contact time and force output metrics
• Stride frequency, stride length, and cadence
• Bilateral asymmetry and compensatory movement patterns
• Acceleration, top-end velocity, and deceleration profiles
• Pound-for-Pound efficiency indices
• TrackFIT Score (composite 0–100 across Performance, Execution, and Pound-for-Pound dimensions)
• Historical and longitudinal performance records
• Motion capture-derived data and AI-generated performance classifications
• Video footage captured during Intelligence Sessions and Challenge events, where applicable

You acknowledge that performance and movement data constitute sensitive personal information and consent to its collection as a condition of participation in the Services.

1.4 TRANSACTION AND FINANCIAL DATA
• Event registration records and confirmation numbers
• Purchase history (registrations, apparel, certification programs)
• Payment method type (processed exclusively by PCI-compliant third-party processors; full card numbers are never stored by the Company)
• Refund and adjustment history

1.5 ACCOUNT AND PROFILE DATA
• Login credentials and account preferences
• Communication and notification settings
• Saved reports and performance documents

1.6 COMMUNICATIONS DATA
• Inquiries submitted via contact forms or email
• Support correspondence and help desk records
• Survey responses and feedback submissions
• Social media interactions with Company-operated accounts

1.7 DEVICE, TECHNICAL, AND USAGE DATA
Collected automatically through cookies, pixels, and similar tracking technologies:

• IP address and approximate geolocation
• Device type, operating system, and browser
• Session data, referral URLs, and pages visited
• Click behavior, scroll depth, and feature engagement
• Timestamps of access and interaction

For information on managing cookies and tracking preferences, see Section 8 (Cookies and Tracking Technologies).

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 2 — SOURCES OF PERSONAL INFORMATION

We receive personal information from the following sources:

a) Directly from you through registration forms, waiver submissions, coach certification applications, purchases, or direct communications
b) Your parent or legal guardian, for participants under 18 years of age
c) Coaches, athletic directors, and affiliated organizations facilitating registrations on your behalf
d) TrackFIT event operations and timing infrastructure
e) Automated platform technologies, including AI-driven performance capture systems
f) Third-party service providers supporting platform delivery
g) Publicly available or commercially available data, where applicable and legally permissible

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 3 — HOW WE USE PERSONAL INFORMATION

We process personal information under one or more of the following lawful bases: performance of a contract, legitimate business interest, compliance with legal obligations, and/or consent where explicitly obtained.

3.1 SERVICE DELIVERY AND EVENT OPERATIONS
To register participants, manage event logistics, assign wave placements and bracket positions, process transactions, and deliver TrackFIT results, reports, and rankings.

3.2 AI-DRIVEN PERFORMANCE ANALYSIS
To operate TrackFIT 3D Intelligence™ and Motion DNA™ Signature Tracking systems; to generate individual TrackFIT Scores, belt classifications, and longitudinal performance profiles; and to produce AI-generated recommendations and developmental insights.

3.3 COACH AND CERTIFICATION PROGRAM ADMINISTRATION
To manage Green Belt, Blue Belt, Purple Belt, Black Belt, and Orange Elite certification pathways; track athlete production metrics attributable to certified coaches; and administer related communications and credential issuance.

3.4 RANKINGS, LEADERBOARDS, AND PUBLIC RESULTS
Performance data including names, results, scores, and rankings may be published publicly. Participants acknowledge and consent to such publication as a condition of participation.

3.5 COMMUNICATIONS
To transmit event confirmations, results, performance reports, certification updates, platform announcements, and marketing communications where consent has been provided or where otherwise permitted by applicable law. To opt out of marketing communications, see Section 9 (Your Rights and Choices).

3.6 PLATFORM IMPROVEMENT AND MODEL TRAINING
To improve the accuracy, integrity, and predictive capability of AI performance systems using de-identified and/or aggregated data. Individual personally identifiable information will not be sold for model training by third parties.

3.7 SAFETY, SECURITY, AND FRAUD PREVENTION
To detect, investigate, and mitigate unauthorized access, fraudulent activity, or abuse of the Services.

3.8 LEGAL COMPLIANCE AND ENFORCEMENT
To comply with applicable federal, state, and local laws; respond to valid legal process; protect the rights, safety, and property of the Company, Users, and the public; and enforce applicable terms and agreements.

3.9 CORPORATE AND FINANCING ACTIVITIES
In connection with investor relations, regulatory filings, due diligence processes, and corporate transactions, as may be required under applicable securities law.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 4 — DISCLOSURE OF PERSONAL INFORMATION

We do not sell your personal information to third parties for their own marketing purposes. We may disclose personal information in the following circumstances:

4.1 SERVICE PROVIDERS AND VENDORS
With third-party processors engaged to support payment processing, hosting and cloud infrastructure, email and SMS delivery, analytics, customer support, and event operations. All service providers are contractually bound to use personal information only as directed by the Company and in compliance with applicable law.

4.2 EVENT AND COMPETITION PARTNERS
With sanctioned event venues, affiliated timing systems, host institutions, and league operators who are operationally necessary to deliver TrackFIT Challenge events and Intelligence Sessions.

4.3 COACHES AND AUTHORIZED INSTITUTIONAL CONTACTS
Coaches who have facilitated an athlete's registration may access that athlete's results and performance data in connection with their coaching relationship and certification program obligations.

4.4 WITFL AND AFFILIATED ENTITIES
Within WITFL Holdings, Inc., Z Athlete Group, Inc., and affiliated subsidiaries and operating entities where necessary for business operations.

4.5 LEGAL PROCESS AND COMPLIANCE
When required by applicable law, regulation, court order, subpoena, or governmental authority. We will endeavor to notify affected Users where legally permissible and practicable.

4.6 PROTECTION OF RIGHTS
Where disclosure is necessary to prevent fraud, enforce agreements, protect the safety of any individual, or protect Company rights and property.

4.7 CORPORATE TRANSACTIONS
In connection with any merger, acquisition, asset sale, financing event, restructuring, or similar corporate transaction, subject to confidentiality obligations and applicable law.

4.8 WITH YOUR CONSENT
Where you have expressly consented to a specific disclosure.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 5 — ARTIFICIAL INTELLIGENCE, BIOMETRIC DATA, AND SPECIAL CATEGORIES

5.1 AI-DRIVEN SYSTEMS
TrackFIT 3D Intelligence™ and Motion DNA™ Signature Tracking constitute proprietary artificial intelligence systems that analyze human movement and generate performance intelligence. Data processed through these systems may include:

• Real-time biometric and kinematic outputs
• Comparative population-level performance benchmarks
• Predictive performance classifications

By participating in any TrackFIT Intelligence Session or Challenge event, you expressly acknowledge and consent to the collection and AI-driven processing of your movement and performance data.

5.2 BIOMETRIC INFORMATION
To the extent performance data collected through the Services constitutes "biometric information" or "biometric identifiers" under applicable state law (including but not limited to Illinois BIPA, Texas CUBI, Washington My Health MY Data Act, or equivalent statutes), the Company:

a) Collects such data only for lawful purposes related to performance analysis and competition
b) Does not sell biometric data
c) Retains biometric data only as long as necessary for the stated purposes or as required by law
d) Maintains reasonable security standards commensurate with the sensitivity of such data

Participants in jurisdictions with specific biometric consent requirements may be asked to execute a separate biometric consent addendum.

5.3 MINOR ATHLETES
For athletes under 18, the Company requires verifiable parental or guardian consent prior to collecting biometric or performance data. Consent is obtained through the registration and waiver process. See Section 7 (Children's Privacy) for full detail.

5.4 DATA NOT SOLD
The Company does not sell personally identifiable athlete performance data, biometric data, or individually attributed AI-generated performance outputs to any third party.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 6 — DATA RETENTION

We retain personal information for as long as necessary to:

• Maintain active athlete and coach accounts and profiles
• Preserve historical performance records, rankings, and longitudinal data integrity
• Fulfill contractual and legal obligations
• Resolve disputes, enforce agreements, and respond to legal process
• Comply with applicable record-keeping requirements under federal, state, or local law

Upon request for deletion, the Company will evaluate and process such requests in accordance with applicable law. Certain data categories — including performance records integrated into competitive rankings and legal records — may be retained in de-identified form even following a deletion request where full deletion is not legally required or operationally feasible.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 7 — CHILDREN'S PRIVACY

The Company recognizes the heightened sensitivity of personal information belonging to minor athletes and takes compliance with applicable children's privacy laws seriously.

7.1 COPPA COMPLIANCE
The Services are not directed to children under the age of 13 without verifiable parental consent as required under the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq. (https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa). For participants under 13, the Company requires a parent or guardian to complete the registration and consent process on behalf of the minor.

7.2 MINOR ATHLETE REGISTRATIONS (AGES 13–17)
For athletes ages 13–17, registration must be completed by or with the authorization of a parent or legal guardian. By completing registration on behalf of a minor, the adult confirms they have the authority to provide consent for the collection and processing of the minor's personal, performance, and biometric data as described in this Policy.

7.3 REMOVAL OF UNAUTHORIZED DATA
If the Company becomes aware that personal information has been collected from a minor without required parental or guardian consent, it will take prompt steps to delete such information from its records.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 8 — COOKIES AND TRACKING TECHNOLOGIES

The Company and its service providers use cookies, web beacons, pixels, and similar tracking technologies to operate and improve the Services.

8.1 TYPES OF COOKIES
• Essential / Functional Cookies: Required for platform operation, session management, and security
• Analytics Cookies: Used to measure traffic, usage patterns, and feature engagement
• Marketing / Preference Cookies: Used to personalize communications and track campaign performance

8.2 MANAGING COOKIES
You may manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Services. For more information on managing cookies, visit:

• https://www.allaboutcookies.org
• https://optout.aboutads.info
• https://optout.networkadvertising.org

8.3 DO NOT TRACK
The Company does not currently respond to "Do Not Track" signals transmitted by web browsers. If this changes, this Policy will be updated accordingly.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 9 — YOUR RIGHTS AND CHOICES

Depending on your jurisdiction of residence, you may have the following rights with respect to your personal information:

9.1 UNIVERSAL RIGHTS (ALL USERS)
• Right to Know: Request confirmation of whether we process your personal information and obtain a summary of what we hold
• Right to Correct: Request correction of inaccurate or outdated information
• Right to Delete: Request deletion of your personal information, subject to legal and operational retention requirements
• Right to Data Portability: Request a copy of your data in a structured, commonly used format
• Right to Opt Out of Marketing: Opt out of marketing and promotional communications at any time

To unsubscribe from email communications, use the unsubscribe link in any marketing email or contact us directly at support@worlditfl.com.

9.2 CALIFORNIA RESIDENTS — CPRA / CCPA
California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (Cal. Civ. Code § 1798.100 et seq.) (https://cppa.ca.gov/regulations/):

• Right to Know (categories and specific pieces)
• Right to Delete
• Right to Correct
• Right to Opt Out of Sale or Sharing of Personal Information (we do not sell personal information)
• Right to Limit Use of Sensitive Personal Information
• Right to Non-Discrimination for exercising privacy rights

To submit a California privacy request, contact us at: support@worlditfl.com with subject line "California Privacy Request."
Response will be provided within 45 days, extendable by an additional 45 days where reasonably necessary.

9.3 NEVADA RESIDENTS
Nevada residents may opt out of the sale of personal information under NRS Chapter 603A (https://www.leg.state.nv.us/nrs/NRS-603A.html). We do not currently sell personal information. Requests may be submitted to: support@worlditfl.com.

9.4 VIRGINIA, COLORADO, CONNECTICUT, AND OTHER STATE RESIDENTS
Residents of states with comprehensive consumer privacy laws enacted as of the effective date of this Policy may have rights to access, correct, delete, and/or opt out of certain processing activities. Contact us to submit a request.

9.5 SUBMITTING A RIGHTS REQUEST
All privacy rights requests should be submitted to:

Email: support@worlditfl.com
Subject Line: "Privacy Rights Request – [Your State]"

We may require verification of your identity before processing your request. We will not discriminate against you for exercising your rights under applicable law.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 10 — SECURITY

The Company employs commercially reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include, but are not limited to, encrypted data transmission (TLS), access controls, and vendor security requirements.

HOWEVER, NO METHOD OF TRANSMISSION OVER THE INTERNET OR ELECTRONIC STORAGE IS COMPLETELY SECURE. THE COMPANY CANNOT GUARANTEE ABSOLUTE SECURITY AND SHALL NOT BE LIABLE FOR UNAUTHORIZED ACCESS THAT IS BEYOND OUR REASONABLE CONTROL.

In the event of a security incident involving your personal information, the Company will notify affected individuals and relevant authorities as required by applicable breach notification laws, including but not limited to applicable state breach notification statutes (e.g., https://oag.ca.gov/privacy/databreach/reporting).

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 11 — THIRD-PARTY PLATFORMS AND LINKS

The Services may contain links to or integrations with third-party websites, platforms, or services, including but not limited to payment processors, social media platforms, and event partners. The Company is not responsible for the privacy practices, data handling, or content of any third party. Users are encouraged to review the privacy policies of any third-party platforms they access.

Third-party services that may process your data in connection with the Services include:

• Payment processing: Subject to the applicable processor's PCI-DSS compliance policies
• Email delivery infrastructure: Subject to applicable vendor data processing agreements
• Analytics providers: Subject to applicable opt-out tools listed in Section 8

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 12 — INTERNATIONAL DATA TRANSFERS

The Company is headquartered in the United States. Personal information collected through the Services is processed and stored in the United States. If you access the Services from outside the United States, you acknowledge that your information will be transferred to, processed, and stored in the United States, where data protection laws may differ from those in your jurisdiction.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 13 — CHANGES TO THIS PRIVACY POLICY

The Company reserves the right to modify this Privacy Policy at any time. When material changes are made, we will update the "Last Updated" date at the top of this Policy and, where required by applicable law, provide direct notice to affected Users via email or prominent platform notice.

Your continued use of the Services following the posting of a revised Policy constitutes your acceptance of the updated terms. If you do not agree to the revised Policy, you must discontinue use of the Services.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 14 — DISPUTE RESOLUTION AND GOVERNING LAW

This Policy shall be governed by and construed in accordance with the laws of the State of Wyoming, without regard to its conflict of law provisions. Any dispute arising out of or related to this Policy or your use of the Services shall be subject to binding arbitration or litigation in Wyoming, as applicable under the Terms of Service.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SECTION 15 — CONTACT AND DATA CONTROLLER INFORMATION

WITFL Holdings, Inc., a Wyoming corporation, is the data controller for personal information processed through the Services.

For questions, concerns, or requests related to this Privacy Policy or your personal information:

Email: support@worlditfl.com
Website: https://www.areyoutrackfit.com
Entity: WITFL Holdings, Inc.
State of Incorporation: Wyoming

For investor or securities-related inquiries, contact through authorized channels only.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

© 2026 WITFL Holdings, Inc. All rights reserved. TrackFIT®, TrackFIT 3D Intelligence™, and Motion DNA™ Signature Tracking are proprietary systems of Z Athlete Group, Inc. Unauthorized reproduction or use of these marks or any content herein is prohibited.