Privacy and your data

Updated 19 September 2026. This notice describes the current norclap website and connected apps during preparation for launch.

Who is responsible

The current operator and data controller is Tommaso Vidossich, acting personally. Contact aivexstartup@gmail.com for privacy questions, access requests, corrections, deletion or security concerns. A company has not yet taken over this role.

A short explanation for young athletes

Your profile and training are private account data. Joining a team lets its leader and approved coaches see the training information needed to work with you. Approved coaches and your team leader can also see your athlete report and training notes. Your address is private; teammates do not receive your report or notes. You can leave a team, change your profile, download your records and delete your account. Ask us if you are unsure about anything. Never put passwords, medical records or sensitive family details in a training note.

What we use and why

• Account identity and contact details support registration, sign-in and account security. Passwords are stored as salted, computationally expensive hashes; they are never stored as readable passwords.
• Profile details, including an athlete's date of birth and competition category, support age grouping, federation links and your workspace. Approved coaches and your team leader can see your athlete profile, including your date of birth; teammate views exclude it.
• Training records, timing summaries, calendar entries, coaching feedback and optional portraits provide the features you choose. Optional reports help personalize your workspace and inform your approved coaches and team leader. Avoid submitting health or other sensitive information.
• Session records, network address and limited request metadata help prevent abuse and keep accounts secure. The website does not use advertising or analytics trackers. See the cookie policy.

Providing the core service relies on the steps you request to create/use an account and the applicable service agreement. Security processing relies on protecting accounts and the service. Optional uses requiring consent must remain optional. The specific legal basis and guardian arrangements for each launch country must be settled before opening that market.

Who can see your data

Team access is checked by the server. Pending membership does not grant access. Approved coaches are limited to their assigned category, and team leaders manage their own team. Teammate sharing requires a specific permission and ends when membership ends. Approved coaches and your team leader can view your athlete report and notes; other athletes cannot. Your address remains private. norclap does not publish a public directory of athlete profiles.

The current service uses Sites and Cloudflare infrastructure. Federation lookups query public FIS/FISI sources using the identifiers or searches you request; these are external organizations. If payment or account-email delivery is enabled, the relevant payment/email provider receives the information needed for that operation. We do not claim these providers have approved or certified norclap.

Storage and retention

Saved training and profile records remain available while you keep your account. Removing an account deletes its application records and revokes sign-in sessions; deleting a team preserves its members' personal accounts and training. Some payment providers may retain transaction records to meet their own legal duties. Provider backups and lawful record-retention obligations can delay removal of residual copies.

Unremembered sign-in uses a browser-session cookie with up to 24 hours of server validity. Remembered sign-in lasts up to seven days. Expired authentication/rate-limit records are cleaned during account activity. iOS offline records are encrypted on the device; remembered sessions use the operating system's protected credential storage. Downloaded exports are ordinary files under your control, so keep them private.

Your choices and rights

Use your profile to correct information, change your password, download an account export or delete your account. A portrait can be downloaded separately from your account. Contact the operator for any remaining records, restriction, objection, portability or withdrawal of consent where applicable. We may need proportionate proof of identity, but will never ask you to email a password. You can complain to the Italian Garante or your local data protection authority. EU requests normally receive a response within one month, with any lawful extension explained.

Children and international availability

norclap’s intended audience is ages 10 and older, including athletes in the United States and other countries. Registration is not available for children under 10. For ages 10–12, registration requires verified parent or guardian consent. A verified guardian registration process is not yet available, so those athletes cannot currently create a new self-service account. The signup form checks eligibility alongside the account details before allowing registration to continue or sending those details; the server also rejects ineligible registration requests.

This new-registration safeguard does not delete existing accounts or prevent their owners from signing in, exporting their data or requesting deletion. It does not establish age verification, guardian consent or approval to offer the service to every age group in every country. Coach age and the date of birth of the person creating a team account are screened too. The team operator’s date of birth is used for the registration check and is not saved as the team’s profile date of birth. We do not impose a blanket parental-control requirement on everyone under 18. Where applicable law requires parental authorization, that authorization must be verified before the relevant processing begins.

International launch, including younger athletes, remains subject to country-specific legal review, proportionate age assurance, any guardian permissions required by applicable law, and provider contract/transfer safeguards. Those requirements and the final retention schedule must be completed before broader launch. Training summaries are decision support, not medical advice or decisions with legal effect.