Privacy Policy
Effective Date: April 1, 2026
1. Introduction
Optima Performance Science ("Company," "we," "us," or "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy describes how we collect, use, disclose, retain, and safeguard information when you access or use the Optima Performance Science platform, including all associated websites, applications, and services (collectively, the "Platform").
This Privacy Policy applies to all users of the Platform, regardless of geographic location. Where applicable, this policy is designed to comply with the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and other applicable data protection legislation.
2. Data Controller
For the purposes of applicable data protection law, Optima Performance Science is the data controller responsible for your personal data. For inquiries regarding data processing, please contact us through our Contact page.
3. Categories of Personal Data We Collect
We collect the following categories of personal data:
| Category | Specific Data Elements | Collection Method |
|---|---|---|
| Identity Data | Full name, email address, user role | Provided during account registration |
| Authentication Data | Cryptographically hashed password, login method (email or third-party OAuth), session tokens | Generated during registration and login |
| Transaction Data | Stripe customer identifier, purchase records, bundle purchase status | Generated during payment processing |
| Usage Data | Service execution records, service favorites, and analytical inputs and outputs | Generated through Platform usage |
| Technical Data | IP address, browser type and version, device type, operating system, referral URLs, page view data | Collected automatically via analytics and server logs |
4. Legal Basis for Processing (GDPR)
Where the GDPR applies, we process your personal data under the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Account creation and authentication | Performance of contract (Art. 6(1)(b)) |
| Service execution and delivery of analytical outputs | Performance of contract (Art. 6(1)(b)) |
| Payment processing through Stripe | Performance of contract (Art. 6(1)(b)) |
| Platform analytics and performance monitoring | Legitimate interest (Art. 6(1)(f)) |
| Security monitoring and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Non-essential cookies and tracking | Consent (Art. 6(1)(a)) |
5. How We Use Your Data
We use the personal data we collect for the following purposes:
- To create and manage your user account, authenticate your identity, and maintain session security.
- To execute analytical services you request and deliver the resulting Output.
- To process payments for Service Bundle purchases through our payment processor.
- To maintain records of your service execution history, favorites, and preferences.
- To monitor, analyze, and improve the performance, security, and reliability of the Platform.
- To detect, prevent, and respond to fraud, unauthorized access, and other security incidents.
- To comply with applicable legal obligations, including responding to lawful requests from public authorities.
- To enforce our Terms of Service and protect the rights, property, and safety of the Company and its users.
6. Data Sharing and Disclosure
We do not sell your personal data. We share personal data only in the following circumstances:
- Payment Processing: Transaction-related data is shared with Stripe, Inc. to facilitate payment processing. Stripe operates as an independent data controller for payment data.
- Third-Party Analytical Services: When you use analytical services that rely on external processing, your inputs may be transmitted to third-party processing services. These services process data solely on our behalf and under contractual obligations to protect your data.
- Authentication Providers: If you choose to authenticate through a third-party provider, limited identity data is exchanged with that provider in accordance with the OAuth protocol.
- Legal Requirements: We may disclose personal data when required by law, regulation, legal process, or governmental request, or when disclosure is necessary to protect the rights, property, or safety of the Company, its users, or the public.
- Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your personal data may be transferred to the successor entity, subject to the same privacy protections described in this policy.
7. Data Retention
We retain personal data for the following periods:
| Data Category | Retention Period |
|---|---|
| Account and identity data | Duration of account existence plus 30 days after deletion request |
| Authentication data (hashed passwords, session tokens) | Duration of account existence; session tokens expire after 7 days |
| Transaction and payment records | 7 years (to comply with financial record-keeping requirements) |
| Service execution and usage data | Duration of account existence plus 90 days after deletion |
| Password reset tokens | 1 hour from generation (automatically expired) |
| Technical and analytics data | 26 months from collection |
Upon expiration of the applicable retention period, personal data is securely deleted or anonymized. Anonymized data, which cannot be used to identify any individual, may be retained indefinitely for statistical and analytical purposes.
8. Data Security
We implement technical and organizational measures designed to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Passwords are stored using bcrypt cryptographic hashing with per-user salts. Plaintext passwords are never stored or logged.
- Session authentication is managed through JSON Web Tokens (JWT) signed with HS256, transmitted exclusively over HTTPS via secure, HttpOnly cookies.
- All data in transit is encrypted using TLS 1.2 or higher.
- Database access is restricted through role-based access controls and encrypted connections.
- Payment data is processed exclusively by PCI DSS-compliant third-party processors; the Company does not store, process, or have access to full payment card numbers.
No method of electronic transmission or storage is completely secure. While we strive to protect your personal data, we cannot guarantee absolute security. In the event of a data breach affecting your personal data, we will notify affected users and relevant supervisory authorities in accordance with applicable law.
9. Cookies and Tracking Technologies
The Platform uses cookies and similar tracking technologies to provide core functionality and to analyze usage patterns. For a detailed description of the cookies we use, their purposes, and how to manage your cookie preferences, please refer to our Cookie Policy.
10. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
Under the GDPR (European Economic Area, United Kingdom, Switzerland)
- Right of Access: You may request a copy of the personal data we hold about you.
- Right to Rectification: You may request correction of inaccurate or incomplete personal data.
- Right to Erasure: You may request deletion of your personal data, subject to legal retention obligations.
- Right to Restriction: You may request that we restrict processing of your personal data in certain circumstances.
- Right to Data Portability: You may request a machine-readable copy of your personal data for transfer to another service.
- Right to Object: You may object to processing based on legitimate interests.
- Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.
- Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority in your jurisdiction.
Under the CCPA/CPRA (California Residents)
- Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
- Right to Delete: You may request deletion of your personal information, subject to statutory exceptions.
- Right to Correct: You may request correction of inaccurate personal information.
- Right to Opt Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
To exercise any of these rights, please submit a request through our Contact page. We will respond to verified requests within thirty (30) days, or within the timeframe required by applicable law.
11. International Data Transfers
Your personal data may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from those in your jurisdiction. Where we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place, including standard contractual clauses approved by the European Commission or other legally recognized transfer mechanisms.
12. Children's Privacy
The Platform is not directed to children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without verifiable parental consent, we will take steps to delete that information promptly. If you believe that a child under 16 has provided personal data to us, please contact us through our Contact page.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or operational needs. When material changes are made, we will update the "Effective Date" at the top of this document. We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after the posting of changes constitutes your acceptance of the updated Privacy Policy.
14. Contact Information
For questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please submit an inquiry through our Contact page. We will make reasonable efforts to respond to all privacy-related inquiries within ten (10) business days.