🛡️ Compliance Overview
Where AceSense stands under privacy, accessibility, platform, and AI regulations.
🎯 TL;DR
| Regime | Applicable because | Status |
|---|---|---|
| GDPR / UK-GDPR / FADP | Any EU/UK/CH user signs up | 🟡 Product controls implemented; DPA and representative actions remain open |
| US state privacy laws (CA/VA/CO/CT/UT/TX/OR/FL/MT/IA/DE/NH/NJ/MD) | US user base | 🟡 Product controls documented; state-by-state applicability and legal verification pending |
| LGPD (Brazil) | Brazilian users | 🟡 Product controls documented; applicability and legal verification pending |
| PIPEDA (Canada), Privacy Act (AU), APPI (JP), PDPA (SG/TH/MY), POPIA (ZA), PDPL (UAE), DPDP (IN) | Global user base | 🟡 High-level inventory only; local applicability, notices, and legal verification pending |
| PIPL (China) | Currently geo-blocked at registration | 🟡 Advised: block at App Store + Firebase level |
| COPPA (US), GDPR-K (EU), UK AoD Code, DPDP India minors | Any minor could sign up | 🟡 Sign-up age attestation wired; DOB verification not collected |
| Illinois BIPA / Texas CUBI / Washington MHMDA — biometric | Pose keypoints derived from video | 🟡 First-upload AI / biometric-adjacent consent wired; legal sign-off pending |
| EU AI Act (2024–2026) | EU users interact with AI | 🟡 Preliminary minimal-risk assessment and transparency controls; legal classification not approved |
| WCAG 2.1 AA / EAA 2025 / Section 508 / ADA | Public-facing web + mobile | 🟡 Self-assessed; third-party audit pending |
| Apple App Store + Google Play | Consumer mobile app | 🟡 Release and store-policy status require operator verification |
| HIPAA | N/A — fitness/coaching, not healthcare | ⚪ |
| PCI DSS | Stripe-hosted Checkout is integrated in test mode | 🟡 Hosted collection reduces card-data scope; merchant PCI scope and attestation are not yet verified |
Implementation controls were re-audited on 2026-07-23. Sign-up age attestation, first-upload AI / biometric-adjacent consent, and hosted test billing are wired. Legal sign-off, DPA records, representative appointments, production payment activation, and PCI validation remain open.
🔍 What changed on 2026-06-21 (the "fix-all" pass)
| Fix | Where | Regimes addressed |
|---|---|---|
| First-upload AI consent — video upload is blocked until the signed-in user accepts AI analysis | acesense-frontend/lib/features/flows/app_flows.dart, acesense-frontend/lib/services/ai_consent_service.dart | Apple 5.1.1(i), AI transparency, biometric-adjacent disclosure |
| Biometric-adjacent data disclosure — pose keypoints, ball/racket tracking explicitly named; never for identification | Flutter first-upload consent prompt, Privacy policy + landing | BIPA (IL), CUBI (TX), MHMDA (WA), GDPR Art 9 |
| Sign-up age attestation — users must confirm they are 16+, or 18+ in India, before account creation | acesense-frontend/lib/features/auth/sign_up_screen.dart, acesense-frontend/lib/services/firestore_service.dart | COPPA, GDPR-K, UK AoD Code, DPDP minors |
| Sub-processor list — Firebase, RunPod, Resend, Apple, Google Play, and Stripe declared with roles | Public landing and in-app notices updated; legal approval, field inventory, and app-store submissions remain open | GDPR Art 28, CCPA/CPRA, LGPD |
| Regional rights section — EEA/UK, US states, LGPD/PIPEDA/etc. spelled out | Privacy policy + landing | All tier-1 regimes |
| Do Not Sell or Share footer link + anchor | Landing footer → /privacy#do-not-sell | CCPA/CPRA + other US states |
| Accessibility statement | New acesense-landing/public/accessibility.html + footer link | EAA 2025, Section 508, ADA, UK Equality Act |
📋 Remaining items
| Item | Doc | Status | Next step |
|---|---|---|---|
| Sub-processor DPAs | dpas/ | 🟡 Drafts ready | Ops dispatches request emails; accepts Firebase DPA in console |
| Stripe production readiness | dpas/stripe-dpa.md | 🟡 Test integration and notice code implemented | Verify applicable DPA/transfer terms, approve the disclosure, complete the field inventory, production account controls, and PCI responsibilities before live mode |
| EU + UK representative | eu-uk-representative.md | 🟡 Provider shortlist ready | Ops picks one (Prighter recommended), signs up |
| DPIA for AI + biometric processing | dpia.md | 🟢 Drafted | DPO countersigns |
| WCAG 2.1 AA third-party audit | wcag-audit-rfp.md | 🟡 RFP drafted | Eng Lead + Finance approve, then dispatch |
| SOC 2 Type I | soc2-readiness.md | 🟡 Gap analysis done | Decision: start when a B2B sale requires it |
| Breach response runbook | breach-response.md | 🟢 In force | Run quarterly drills; first drill log |
| AI model + data card | ai-model-card.md | 🟢 Published | Review annually or on pipeline change |
| DOB / region verification | acesense-frontend | 🟡 Basic attestation wired | Decide whether to collect DOB/country/state before claiming verified minor or jurisdiction-specific compliance |
| Geo-block China + Russia | overview.md §China | 🔴 Not done | Apple App Store region settings + Firebase hosting IP rule (App-Store-Connect side) |
This inventory records product controls and open actions; it is not a legal certification. Any jurisdictional classification or 🟡 legal item requires the named operator, DPO, or counsel verification before AceSense claims compliance publicly. Do not claim fully verified minor/BIPA/MHMDA compliance until counsel approves the attestation + consent wording.
🧭 By regime
GDPR / UK-GDPR / EEA
- Lawful bases declared: contract (service delivery), consent (AI + notifications), legitimate interest (fraud prevention).
- Subject rights implemented:
exportUserData(portability + access),requestAccountDeletion(erasure), in-app settings for rectification. - Retention: videos 30 days on server; analysis + profile until account deletion. Documented in zip README and privacy policy.
- Sub-processors / recipients: Firebase (europe-west1), RunPod, Resend, Apple, Google Play, and Stripe. Stripe is currently connected only in test mode.
- DPO contact:
dpo@acesense.io. - Representative: not yet designated — pending Ops.
- Cross-border transfers: vendor mechanisms and account-specific applicability must be recorded before claiming complete coverage; see the DPA tracker.
- Breach notification: 72h target — runbook in force and exercised in the 2026-Q2 drill.
US state privacy (CCPA/CPRA + 14 other states)
- "Do Not Sell or Share My Info" link live at landing footer.
- No sale or sharing occurs; privacy policy states this.
- Global Privacy Control honouring declared.
- Sensitive data handling (biometric-adjacent) disclosed.
- Right to limit / correct / delete implemented via in-app flows.
COPPA / GDPR-K / UK AoD / DPDP minors
- Sign-up requires users to attest they are at least 16, or 18 if they live in India.
- DOB is not currently collected in the Flutter v1 route, so this is an attestation rather than verified age proof.
- No behavioural advertising; no profiling of minors.
- "Ask a parent or coach to set up an account" messaging replaces usage for blocked users.
Biometric (BIPA / CUBI / MHMDA)
- First-upload AI consent is required before video leaves the app for analysis.
- Pose keypoints explicitly disclosed as derived data.
- Never used for identification.
- No facial biometric extraction.
- Not matched across users.
- Deletable via account deletion.
- Universal consent wording covers biometric-adjacent processing notices before upload; no state/region branching is used in-app today.
EU AI Act
- Classification: minimal risk (no biometric identification, no employment/credit scoring, not manipulating behaviour, not generating deepfakes of identifiable persons).
- Users are informed they are interacting with AI (consent dialog, privacy policy).
- Planned: published model/data card describing the pipeline (TrackNet, MediaPipe, CatBoost).
Accessibility
- Self-assessed WCAG 2.1 AA partial conformance.
- Accessibility statement published at
/accessibility. - Known limitations documented (Flutter canvas SR coverage, lack of video captions, interactive chart drill-down).
Platform
- Apple App Store: base AI-consent controls are implemented; current release state, agreement acceptance, and App Privacy labels require operator verification.
- Google Play: Data Safety form and current release state require operator verification.
- Sign in with Apple available (required parity with any third-party sign-in).
📎 File map
| What | Where |
|---|---|
| Age attestation | acesense-frontend/lib/features/auth/sign_up_screen.dart, acesense-frontend/lib/services/firestore_service.dart |
| AI consent (biometric-aware) | acesense-frontend/lib/features/flows/app_flows.dart, acesense-frontend/lib/services/ai_consent_service.dart |
| App privacy policy | acesense-frontend/lib/features/legal/legal_screen.dart |
| App terms of service | acesense-frontend/lib/features/legal/legal_screen.dart |
| Landing privacy | acesense-landing/public/privacy.html |
| Landing terms | acesense-landing/public/terms.html |
| Landing accessibility statement | acesense-landing/public/accessibility.html |
| Cookie consent banner | acesense-landing/src/components/CookieConsent.tsx |
| GDPR callables (export + delete) | acesense-auth-function/user/data.ts |
| Email templates (export + deletion confirmation) | acesense-auth-function/shared/email-templates.ts |
📞 Contacts
- General privacy:
privacy@acesense.io - DPO:
dpo@acesense.io - Accessibility:
accessibility@acesense.io - EU rep (TBD)
- UK rep (TBD)
Was this page helpful?