⚠ Attorney Review Note: This document has been prepared for pre-deployment review and is subject to revision by qualified legal counsel before execution with any Institution. CCPA, GDPR, SOPIPA, and FERPA provisions should be reviewed by counsel familiar with applicable data protection law and Massachusetts commercial law.
This Privacy Policy describes how Epicentra LLC ("Epicentra," "we," "us," or "our") collects, uses, stores, and protects information in connection with: (a) your use of the Rah-AI: Vantage website at www.epicentrallc.com and associated landing pages (the "Website"), and (b) your use of the Rah-AI: Vantage software platform (the "Platform"). By using the Website or the Platform, you agree to the practices described in this Policy.
This Policy is organized in two sections. Part A covers information collected through the Website (applicable to all visitors). Part B covers information collected through the Platform (applicable to subscribing Institutions and their Authorized Users). Certain sections in Part C apply to both.
Epicentra LLC is a Massachusetts limited liability company that operates Rah-AI: Vantage, an AI-native statistical profile evaluation platform for college athletic departments and sports organizations. Epicentra is the data controller for information collected through the Website and the data processor for User Data processed through the Platform on behalf of subscribing Institutions.
Our primary contact for all privacy matters is support@epicentra-llc.com.
When you visit the Website or submit a demo or contact request, we may collect:
We do not collect payment information, government IDs, or any sensitive personal data through the Website.
Information submitted through the Website is used solely to:
We do not sell, rent, or share Website visitor information with third parties for marketing or advertising purposes.
The Website does not use advertising cookies, retargeting pixels, or third-party behavioral tracking. We do not run advertising or retargeting campaigns that track Website visitors across other websites. Basic session and performance data may be collected by our hosting infrastructure (Vercel) solely for availability and performance purposes. We do not use Google Analytics or similar third-party analytics services on the Website.
Demo and contact request submissions are stored securely within Epicentra's administrative systems. We retain this data for up to twenty-four (24) months from the date of submission, or until you request deletion, whichever comes first.
When an Institution is granted access to the Platform, we collect for each Authorized User: username, program name, user role, and login timestamps. We do not collect billing or payment information directly through the Platform — institutional subscription agreements are managed separately.
We collect data that Authorized Users actively create within the Platform, including:
The Platform indexes publicly available statistical data about collegiate athletes, including game statistics, school and conference affiliation, eligibility year, and position. This data is sourced exclusively from publicly available sources. We do not collect private medical, financial, academic, or personal communications data about student-athletes. See Section 5 for our full student-athlete privacy commitment.
We automatically collect the following data for platform security, debugging, and performance monitoring:
This data is used solely for operating and improving the Platform and is never shared with third parties for marketing purposes.
We record each Authorized User's acceptance of the Platform Terms of Service, including: username, Terms version accepted, timestamp, IP address, and browser user agent. These records constitute an immutable legal audit trail and are retained for the duration of the Institution's subscription plus five (5) years.
The Platform logs all Output Document generation events, including username, institution, profile evaluated, timestamp, and output parameters. These logs are retained for not less than three (3) years and may be used to investigate misuse of Platform outputs or breaches of the Terms of Service.
Platform data is used to:
We do not sell, rent, or share Platform data with third parties for marketing or advertising purposes. We do not use Player Profile Data to train AI models for sale to third parties.
Each Institution's User Data is strictly isolated. Rosters, notes, watchlists, and budget preferences are accessible only to authenticated Authorized Users within that Institution's account. No cross-Institution data access is permitted at any level of the system. Database-level row isolation by Institution is enforced in all production environments.
The provisions in Sections 5 through 14 apply to both Website visitors and Platform users unless otherwise specified.
Epicentra is committed to the responsible use of collegiate athlete data. Our commitments are:
The Platform does not receive student education records from subscribing Institutions and is not a "school official" as defined under the Family Educational Rights and Privacy Act (FERPA). Institutions must not transmit, upload, or otherwise provide FERPA-protected student records to the Platform. Epicentra is not responsible for FERPA compliance obligations arising from an Institution's unauthorized transmission of student education records.
The Platform is designed to operate using only publicly available data and does not collect student personal information as defined under the California Student Online Personal Information Protection Act (SOPIPA) or New York Education Law § 2-d. Institutions that require a Data Processing Addendum (DPA) for applicable state law compliance may request one at support@epicentra-llc.com.
The Platform uses the following third-party infrastructure providers. Each is bound by its own privacy and security policies. All data is stored in U.S.-based infrastructure.
| Sub-Processor | Purpose | Data Location |
|---|---|---|
| Railway (railway.app) | Cloud hosting and PostgreSQL database infrastructure | United States |
| Vercel (vercel.com) | Frontend hosting and content delivery | United States |
| Google Workspace | Internal communications and administrative data storage | United States |
We do not integrate with any NIL marketplace, NCAA clearinghouse, CSC reporting platform, or athlete data broker. Epicentra will update this sub-processor list and notify affected Institutions of any material changes at least thirty (30) days in advance.
| Data Type | Retention Period |
|---|---|
| Website visitor and demo request data | 24 months from submission, or until deletion request |
| Platform User Data (active subscription) | Duration of authorized access |
| Platform User Data (post-termination) | 90 days in secure backup, then permanently deleted |
| Consent and ToS acceptance records | Subscription term plus 5 years |
| Output audit logs | Minimum 3 years |
| Aggregated, anonymized usage analytics | Indefinitely (no personal data) |
You may request deletion of your data at any time by contacting support@epicentra-llc.com. We will respond within thirty (30) days. Note that certain data may be retained longer where required by applicable law or for legitimate legal or audit purposes.
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with the following rights with respect to your personal information:
To exercise any of these rights, contact us at support@epicentra-llc.com with the subject line "California Privacy Request." We will verify your identity and respond within forty-five (45) days, with a possible extension of an additional forty-five (45) days where reasonably necessary.
For Platform users, California institutions may also request a Data Processing Addendum that addresses CPRA obligations applicable to business-to-business data processing.
Rah-AI: Vantage is primarily designed for use by U.S.-based college athletic programs. However, Epicentra is building toward multi-sport applicability including international leagues and organizations. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following applies:
[Attorney review note: If and when Epicentra formally enters the EEA market (e.g., IPL, European football), a full GDPR compliance review and appointment of an EU representative under Article 27 GDPR will be required.]
The Website and Platform are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18 without verifiable parental consent, we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a minor, contact us at support@epicentra-llc.com.
Regardless of your location, all users have the following rights with respect to their personal information:
To exercise any of these rights, contact support@epicentra-llc.com. We will respond within thirty (30) days.
Epicentra implements technical and organizational security measures appropriate to the nature of the data we process, including:
Epicentra is not currently SOC 2 Type II certified. We will notify affected Institutions and, where required by law, affected individuals, in the event of a data breach affecting personal information, in accordance with applicable breach notification laws.
We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or applicable law. For material changes, we will provide at least fourteen (14) days' notice to Platform users via email or in-platform notice before the changes take effect. Website visitors will be notified via an updated date on this page. The version history of this Policy is maintained and available upon request at support@epicentra-llc.com.
For all privacy inquiries, data subject requests, Data Processing Addendum requests, or general questions about this Policy, contact Epicentra LLC at support@epicentra-llc.com.
Our Terms of Service are available at epicentrallc.com/legal/tos.html.