ArmourID Privacy Notice

ArmourID LLC (“ArmourID,” “we,” “us,” or “our”) provides technology tools that support identity verification, document management, eligibility workflows, regulatory or participation-related requirements, and controlled data sharing among authorized users and organizations.

This General Privacy Notice (this “Notice”) explains how ArmourID collects, uses, discloses, and protects personal information when individuals and organizations use our website, platform, account features, mobile and web interfaces, APIs, and related services (the “Services”).

Because some information processed through the Services may include health-related information, biometric information, or information about minor athletes, this Notice also includes additional disclosures for certain laws and data types, including consumer health data and biometric information. This Notice should be read together with the ArmourID Terms of Service and any consent, authorization, or disclosure form presented through the Services.

“Personal information” means any information related to an identified or identifiable natural person, subject to applicable data protection laws. We may collect the following categories of personal information, depending on the nature of your interactions with us. Note that the specific personal information we collect about you may not include all the examples listed:

• Account and Contact Information: Name, email address, phone number, mailing address, username, password, account settings, and communication preferences.
• Identity Verification Information: Date of birth, government-issued identification documents, ID numbers, document images, photographs, liveness-check results, facial comparison data, and related verification records. See Section 9 (Biometric and Identity Verification Information) and Exhibit A (Biometric Data Retention and Destruction Policy) of this Notice for additional disclosures about biometric and identity verification data.
• Fighter, Athlete, or Profile Information: Name, ring name, discipline, weight class, height, fight record, gym or team affiliation, region, licensing status, eligibility status, suspension status, combat sports license numbers, state or jurisdiction of licensure, discipline, event participation history, and other information used to support fighter identity, readiness, matchmaking, roster management, event planning, or regulatory workflows. Depending on the information you provide or the features used, this may also include demographic or profile details such as date of birth, gender, nationality, country of citizenship, or similar information relevant to identity verification, eligibility, licensing, or regulatory requirements.
• Medical and Health-Related Information: Bloodwork status, lab results, medical exams, physicals, imaging records, ophthalmological or neurological records, vaccination or immunization records, physician letters, medical clearance documents, injury records, suspension-related medical records, drug testing or anti-doping status where provided by testing authorities or authorized organizations, medical expiration dates, and similar health-related documentation or status information. See Part II (Consumer Health Data Privacy Notice) for additional disclosures about consumer health data.
• Eligibility, Compliance, and Regulatory Workflow Information: Documentation status, missing or expired requirement flags, commission or sanctioning body requirements, event packets, bout lineups, event submissions, approval workflows, licensing or clearance status, suspension information, audit logs, status updates, and other information generated or used to support eligibility, participation, medical clearance, event planning, regulatory review, or compliance workflows.
• Organization and Partner Information: Business contact information and account information for promotions, gyms, training facilities, commissions, sanctioning bodies, brands, sponsors, and other organizations that use or interact with the Services. This may include organization name, legal entity name, jurisdiction of formation, business address, primary contacts, titles, email addresses, phone numbers, role-based account permissions, event records, roster information, billing information, and related account administration information.
• Communications Information: Messages, support inquiries, emails, text messages, platform notifications, in-platform messages, message metadata, recipient information, communication preferences, and records of communications with us or through the Services.
• Device, Usage, and Technical Information: IP address, device type, browser type, operating system, approximate location, unique device identifiers, log data, session information, pages or screens viewed, features used, documents uploaded or viewed, verification requests initiated, API call logs, endpoint activity, response status, error logs, crash reports, role-based access logs, and similar analytics, security, diagnostic, and platform interaction information.
• Payment or Billing Information: Billing contact details, where applicable. Payment card information is processed by a third-party payment provider and is not stored by ArmourID.

We may collect the personal information identified above from the following sources:

• Directly From You. We collect information that you provide when you create an account, complete a profile, upload documents, submit intake forms, respond to prompts within the platform, make a payment, or contact us for support. This is the primary source of medical, eligibility, and identity information on the platform.
• Automatically. When you use the Services, we automatically collect device and usage data such as IP address, browser type, device type, operating system, pages visited, features used, session duration, and log data. This information is collected through cookies, log files, and similar technologies. See Section 10 (Cookies and Tracking Technologies) for more detail on cookies.
• From Third Parties. We may receive information about you from third-party identity verification providers (for example, liveness check or document scan results), from athletic commissions or sanctioning bodies in connection with a regulatory workflow, and from organizations such as gyms or promotions that use the platform and submit information on your behalf. We only accept third-party submissions for your account where you have authorized the relevant organization to act on your behalf, or where we are required or permitted by law to receive the information.
• Created By Us. We collect information about you that we create, such as credentials for access to the Services, or inferences generated from other information we collect.
• Service Providers. We collect information about you from certain service providers that provide information to help us provide the Services and run our business.
• Affiliates. We receive information from the companies within our family of companies and affiliates as a normal part of conducting business and performing the Services.

Some information we collect is classified as “sensitive personal information” (“SPI”) under California law (California Consumer Privacy Act (CCPA), as amended) and analogous state laws.

We use and disclose sensitive personal information only for purposes permitted by law, including to provide, operate, and maintain the Services; verify identity; assess eligibility; support regulatory and compliance workflows; prevent fraud; maintain account and platform security; authenticate users; process transactions; provide customer support; comply with legal obligations; and support our ordinary business operations.

We do not use or disclose sensitive personal information for targeted advertising, cross-context behavioral advertising, to build advertising profiles, or for the purpose of inferring characteristics about individuals.

California law provides residents with the right to limit certain uses and disclosures of sensitive personal information. However, based on our current practices, ArmourID does not use or disclose sensitive personal information in a way that is subject to this right. Specifically, ArmourID uses and discloses sensitive personal information only for the limited purposes described above and otherwise permitted by California law. Therefore, ArmourID does not currently offer a separate “Limit the Use of My Sensitive Personal Information” right or link.

If our practices change and we use or disclose sensitive personal information for purposes that are subject to the California right to limit, we will update this Notice and provide a method for California residents to exercise that right as required by law.

In accordance with applicable law, we may use personal information for the following purposes:

• Business Operations and Service Improvement. To operate, evaluate, maintain, and improve our Services, systems, workflows, user experience, internal processes, and business operations.
• Account, Profile, and Platform Administration. To create, verify, maintain, secure, and administer your account, profile, and use of the Services.
• Identity Verification and Fraud Prevention. To verify your identity, authenticate users, prevent fraud, detect impersonation, and support the integrity and security of the Services.
• Eligibility and Regulatory Workflows. To store, organize, review, and process documents, medical records, health-related information, consent forms, eligibility steps, and other information needed to support eligibility, licensing, regulatory, compliance, or similar workflows.
• Documentation and Recordkeeping. To generate, store, and maintain reports, disclosures, documentation alerts, expiration notices, forms, summaries, and other records related to your account, participation, eligibility, compliance status, or use of the Services.
• Third-Party Integrations and Authorized Recipients. To allow you or authorized users to share information with athletic commissions, promotions, gyms, sanctioning bodies, regulators, service providers, teams, or other authorized recipients as part of the Services. ArmourID does not use medical documentation, consumer health data, biometric information, government identification documents, account credentials, or other highly sensitive personal information for sponsor, brand, or commercial partner purposes unless you have provided specific, documented authorization and the use is permitted by applicable law.
• Service Delivery and Support. To provide, operate, maintain, improve, troubleshoot, and support the Services, including responding to inquiries, providing customer support, and communicating with you about your account or use of the Services.
• Communications. To send service-related emails, texts, messages, alerts, reminders, platform notices, and other communications related to your account, profile, eligibility, documentation, payments, events, or use of the Services.
• Payments and Transactions. To process payments, transactions, subscriptions, fees, refunds, credits, and related billing, accounting, tax, and financial administration.
• Security, Monitoring, and Abuse Prevention. To monitor use of the Services; detect, investigate, and prevent fraud, misuse, security incidents, technical issues, policy violations, and violations of the ArmourID Terms of Service or other applicable terms.
• Legal, Regulatory, and Contractual Compliance. To comply with applicable laws, regulations, legal process, regulatory obligations, contractual obligations, law enforcement requests, and internal compliance requirements.
• Corporate Restructuring. We may use your personal information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
• With Notice or Consent. For other purposes disclosed to you when we collect your personal information or with your consent.

ArmourID does not “sell” personal information or “share” personal information for cross-context behavioral advertising, as those terms are defined under the CCPA and similar state privacy laws. We also do not use or disclose personal information for targeted advertising or to build advertising profiles.

We may disclose personal information in the limited circumstances described below. These disclosures are made to provide, operate, secure, and improve the Services; support eligibility, documentation, and regulatory workflows; comply with legal obligations; complete transactions; or as otherwise directed or authorized by you.

The Services allow you to authorize ArmourID to share specific information with specific recipients. An authorization will identify: (1) the recipient; (2) the type of information to be shared; (3) the purpose of the sharing; and (4) any applicable expiration date or revocation process.

You may revoke an authorization through the platform where available, or by emailing us at info@armour-id.com. We will process revocation requests within 10 business days. Revocation applies prospectively — it does not affect disclosures that occurred before we received and processed your revocation request.

Some regulatory authorizations may be required by an athletic commission or sanctioning body as a condition of competition or licensure. ArmourID does not control those external requirements, but we will only share information to the extent of your documented authorization or as required by applicable law.

ArmourID may use automated tools or software features to help provide and administer the Services. For example, these tools may help compare document dates against event or eligibility requirements, flag records that appear incomplete or inconsistent, generate alerts or reminders, organize information, route records for review, or support administrative workflows.

These tools are designed to support ArmourID’s Services and assist human review. They do not make final eligibility, medical clearance, licensing, participation, event approval, account status, or other similar decisions about you. Those decisions are made by ArmourID, athletic commissions, regulatory bodies, promotions, organizations, medical providers, or other authorized recipients, as applicable, based on their own review, requirements, and decision-making processes.

ArmourID does not use automated tools or artificial intelligence to make decisions that produce legal or similarly significant effects about you, and ArmourID does not use automated tools or artificial intelligence to replace or substantially replace human decision-making in connection with eligibility, medical clearance, licensing, participation, or similar determinations.

Because ArmourID does not currently use automated decision-making technology in a way that is subject to California or similar state automated decision-making opt-out rights, ArmourID does not currently offer a separate automated decision-making opt-out. If our practices change and we use automated decision-making technology in a way that is subject to these rights, we will update this Notice and provide any required notices, explanations, and rights as required by applicable law.

Some features of the Services use identity verification tools that involve government identification documents, photographs, liveness checks, facial comparison, or similar verification processes. These features may be provided by ArmourID or by a third-party identity verification provider.

• Transparency and Consent. Before collecting or obtaining biometric identifiers or biometric information, ArmourID will: (1) inform you in writing that biometric data is being collected or stored; (2) inform you in writing of the specific purpose and length of time for which the biometric data is being collected, stored, and used; and (3) obtain your written release, which may include an electronic signature or other legally valid electronic consent.
• Retention and Destruction — Illinois BIPA. See Exhibit A (Biometric Data Retention and Destruction Policy) for the complete publicly available retention schedule and destruction guidelines required by Illinois BIPA §15(a). In summary: biometric identifiers and biometric information are destroyed no later than the earlier of (1) three years from your last interaction with ArmourID, or (2) when the initial purpose for collection has been satisfied.
• No Profit from Biometric Data. ArmourID will not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information. Biometric data will not be disclosed except as described in this Notice, as authorized by you, or as required by law.
• Third-Party Verification Providers. If a third-party identity verification provider collects or processes biometric information on our behalf, that provider is required to protect the information in accordance with applicable law and this Notice, and is prohibited from using it for any purpose other than providing identity verification services to ArmourID.

We use cookies, pixels, logs, software development kits, APIs, and similar technologies to operate, secure, maintain, and improve the Services; remember your preferences; understand how users interact with the Services; troubleshoot technical issues; support integrations; detect and prevent fraud or misuse; and measure performance.

These technologies may collect information such as IP address, device type, browser type, operating system, device identifiers, pages or screens viewed, referring URLs, access dates and times, interactions with features or content, error logs, and other usage or technical information. We may use the following types of cookies and similar technologies:

• Essential and Security Technologies. These technologies are necessary to operate the Services, authenticate users, maintain account security, prevent fraud, remember privacy choices, enable core platform functionality, and support legal or compliance requirements. These technologies cannot generally be disabled through our preference tools.
• Preference and Functionality Technologies. These technologies help us remember your settings and preferences, such as login status, language, saved choices, or other platform settings.
• Analytics and Performance Technologies. These technologies help us understand how the Services are used, identify performance issues, improve functionality, and support internal analytics and reporting. For example, we may use analytics tools to understand page views, navigation paths, feature usage, technical errors, and general usage trends.
• Integration and Service Technologies. Some features of the Services may rely on third-party tools, APIs, or integrations, such as identity verification, communications, payment processing, scheduling, document management, storage, security, analytics, or other service-related functionality. These third parties may collect or receive information as needed to provide their services to ArmourID or to you.
• Session Replay and Similar Technologies. We may use session replay or similar analytics tools to understand how users interact with the Services, diagnose technical issues, improve usability, and maintain platform functionality. These tools may record interactions such as clicks, taps, scrolling, navigation paths, page performance, and error events. Where we use these tools, we implement reasonable measures designed to prevent the capture of passwords, payment details, and other sensitive information entered into forms. ArmourID does not knowingly use session replay or analytics tools to capture medical documents, government identification documents, biometric information, payment card information, passwords, or other sensitive form-field content.

Where required by applicable law, ArmourID will obtain consent before using non-essential cookies, analytics, session replay, SDKs, or similar technologies.

The Services may contain links to, integrate with, or allow you to interact with third-party websites, applications, platforms, tools, APIs, or services that ArmourID does not own or control. These may include, for example, identity verification providers, payment processors, communications providers, analytics tools, document or storage providers, scheduling tools, regulatory or commission systems, or other operational integrations.

When you use a third-party service or integration, that third party may collect, receive, or process personal information in accordance with its own privacy notice, terms, and practices. ArmourID is not responsible for the privacy, security, or data practices of third-party services that are not acting on ArmourID’s behalf. We encourage you to review the applicable third party’s privacy notice before using those services.

Where a third-party provider processes personal information on ArmourID’s behalf, we use reasonable measures designed to limit that provider’s use of personal information to providing services to ArmourID or as otherwise permitted by law.

Depending on your state of residence, you may have some or all of the rights listed below. Rights vary by state.

Rights That May Not Apply Based on Our Current Practices. Some privacy laws provide additional rights in specific circumstances, such as the right to opt out of the sale of personal information, sharing for cross-context behavioral advertising, targeted advertising, certain profiling, or certain automated decision-making activities. Based on ArmourID’s current practices:

• ArmourID does not sell personal information.
• ArmourID does not share personal information for cross-context behavioral advertising.
• ArmourID does not process personal information for targeted advertising.
• ArmourID does not use automated decision-making technology to make decisions that produce legal or similarly significant effects.
• ArmourID uses and discloses sensitive personal information only for purposes permitted by law, such as providing the Services, identity verification, eligibility and regulatory workflows, fraud prevention, security, legal compliance, customer support, and ordinary business operations.

Because ArmourID does not currently engage in these activities, we do not currently offer separate opt-out rights for sale, sharing, targeted advertising, qualifying profiling, automated decision-making, or a separate “Limit the Use of My Sensitive Personal Information” link. If our practices change and we engage in activities that trigger these rights, we will update this Notice and provide any required privacy choices.

We retain personal information for as long as needed to provide the Services, support regulatory workflows, comply with legal obligations, resolve disputes, and maintain security. When information is no longer needed, we delete, deidentify, or aggregate it in accordance with applicable law.

Retention periods may vary by data type, user role, applicable athletic commission or sanctioning body requirements, legal or contractual recordkeeping obligations, active disputes, safety or eligibility needs, and the status of your account or authorization. Biometric information is retained and destroyed as described in Exhibit A (Biometric Data Retention and Destruction Policy).

ArmourID uses reasonable technical, administrative, and organizational safeguards designed to protect your personal information against unauthorized access, disclosure, alteration, or loss. These safeguards include encryption of data in transit and at rest, access controls, authentication requirements, and security monitoring.

No system is completely secure. If we become aware of a security incident involving personal information, we will investigate, contain, and remediate the incident and provide notifications as required by applicable law.

ArmourID may send you service-related communications, including account alerts, document expiration notices, eligibility status updates, and platform notifications, by email, SMS, or in-platform notification.

ArmourID is not a healthcare provider, health plan, or healthcare clearinghouse. In most use cases involving fighters, athletes, promotions, gyms, athletic commissions, and sanctioning bodies, ArmourID is not acting as a HIPAA covered entity or business associate simply by providing the Services. However, this determination depends on the specific nature of each relationship. If ArmourID is engaged by an entity that is itself a HIPAA covered entity, and ArmourID receives or handles protected health information (PHI) on that entity’s behalf, a Business Associate Agreement (BAA) may be required. In those circumstances, that specific processing will be governed by the applicable BAA and HIPAA requirements.

The Services are intended for users who are 18 years of age or older. Individuals under 18 may not create an account or use the Services directly unless expressly permitted by ArmourID and supported by any required parent, guardian, organizational, or regulatory authorization.

ArmourID does not knowingly collect personal information online directly from children under 13 without verifiable parental consent where required by the Children’s Online Privacy Protection Act (“COPPA”). If we learn that we have collected personal information online directly from a child under 13 without required consent, we will take reasonable steps to delete the information or obtain appropriate consent, as required by law.

In some cases, personal information about minor athletes may be submitted to the Services by a parent or guardian, athletic commission, promotion, gym, sanctioning body, organization, or other authorized representative. This information may include profile information, eligibility information, identity information, participation records, consent documentation, medical or health-related documentation, and other information needed to support eligibility, licensing, medical clearance, compliance, event participation, or regulatory workflows.

ArmourID uses minor athlete information only for the purposes described in this Notice, including to provide and operate the Services, support eligibility and regulatory workflows, maintain documentation, verify identity or authorization, communicate with authorized parties, prevent fraud, maintain security, and comply with legal, contractual, or regulatory obligations.

ArmourID does not sell personal information of minors, share personal information of minors for cross-context behavioral advertising, or process minor personal information for targeted advertising.

Parents or guardians may contact us to request access to, correction of, or deletion of personal information about their minor child, or to request that ArmourID stop future use or disclosure of that information, subject to applicable legal, regulatory, contractual, documentation, safety, eligibility, and recordkeeping exceptions. To submit a request, contact us at info@armour-id.com. We may need to verify your identity and authority to act on behalf of the minor before processing the request.

Where an organization, commission, promotion, gym, sanctioning body, or other representative submits minor athlete information to the Services, that organization or representative is responsible for obtaining any required parent, guardian, athlete, regulatory, or other authorization before submitting the information to ArmourID.

ArmourID may require the submitting organization or representative to provide evidence of the required consent, authorization, or legal authority before enabling access to, use of, or disclosure of minor athlete information.

ArmourID may restrict or suspend access to minor athlete features if we determine that required authorizations, notices, or approvals have not been obtained.

ArmourID is based in the United States, and the Services are designed for use in the United States. If you access the Services from outside the United States, your information may be processed and stored in the United States, where privacy laws may differ from those in your home jurisdiction. By using the Services from outside the United States, you acknowledge that your information will be transferred to and processed in the United States. International users who have questions about data transfers should contact info@armour-id.com.

We may update this Privacy Notice from time to time. The effective date at the top of the document will reflect any changes. If we make material changes — including changes to how we process sensitive personal information, consumer health data, or biometric data — we will provide notice through the platform, by email, or by other reasonable means before the changes take effect, and will obtain new consent where required by law.

Questions, requests, or concerns regarding this Privacy Notice should be directed to:

For ArmourID, consumer health data may include medical and health-related information used to support eligibility, medical clearance, documentation, participation, compliance, or regulatory workflows, including:

• Medical examination records, physicals, and medical clearances
• Bloodwork or lab results
• Vaccination or immunization records
• Imaging records and physician letters
• Injury records and suspension-related medical records
• Medical expiration dates and documentation status information
• Biometric or liveness information, to the extent used in connection with health-related eligibility, identity verification, or regulatory workflows

Depending on where you live and subject to applicable legal exceptions, you may have the right to confirm whether ArmourID collects, shares, or sells consumer health data about you; access your consumer health data; receive information about the third parties or affiliates with whom ArmourID has shared or sold your consumer health data; withdraw consent for future collection or sharing of consumer health data; request correction of inaccurate consumer health data, where required by applicable law; request deletion of consumer health data subject to exceptions; and appeal a denied request. ArmourID does not sell consumer health data, share consumer health data with data brokers, or use consumer health data for targeted advertising or advertising profiles, so ArmourID does not offer a separate opt-out right for those activities.

To submit such a request, contact ArmourID using the process described in Section 12 (Your Privacy Rights) of the ArmourID Privacy Notice, and include “Consumer Health Data Request” in the subject line. We may verify your identity and authority before processing your request.

Effective Date: May 29, 2026

ArmourID maintains this Biometric Data Retention and Destruction Policy under the Illinois Biometric Information Privacy Act, 740 ILCS 14/15(a).

ArmourID may collect or possess biometric identifiers or biometric information, including face geometry data, in connection with identity verification.

ArmourID retains biometric identifiers and biometric information only for as long as needed to complete the purpose for which they were collected. ArmourID will permanently destroy biometric identifiers and biometric information when the initial purpose for collection has been satisfied or within three years of the individual’s last interaction with ArmourID, whichever occurs first, unless retention is required by a valid warrant, subpoena, or other legal obligation.

Permanent destruction means deletion or destruction in a manner designed to make the biometric identifiers or biometric information no longer retrievable or usable by ArmourID.

ArmourID will apply this policy to biometric identifiers and biometric information in ArmourID’s possession, whether collected directly by ArmourID or collected by a third-party identity verification provider on ArmourID’s behalf.

Questions about this policy may be directed to: info@armour-id.com.