Introduction
This Privacy Policy explains how Surplex, Co. (“Surplex,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects personal information through its Striv™-branded smart insoles, mobile applications, websites, AI-assisted features, customer support, and related services (collectively, the “Services”). Striv is a Surplex product and service brand, not a separate legal entity.
Surplex is the controller of personal information covered by this Policy unless a separate written agreement says otherwise. This Policy does not apply to information processed solely on behalf of an enterprise, research, clinical, or other institutional customer where that customer controls the processing.
Surplex currently directs its consumer Services primarily to customers in the United States. This Policy describes our baseline practices wherever the Services are accessed and does not limit mandatory rights under the law where you live. Availability of a website or App in a region does not mean every Product or Service is offered there. Before formally launching or actively marketing the consumer Services in the European Economic Area or United Kingdom, Surplex will update its notices and implement region-appropriate cookie and consent controls.
The Services are consumer fitness and general-wellness services. Surplex is not a healthcare provider, and the Services are not intended to receive protected health information on behalf of a HIPAA-covered entity unless Surplex has signed an applicable business associate agreement.
Information We Collect
Depending on how you interact with the Services, we may collect:
Account, Contact, and Profile Information
Name, email address, account credentials, age or eligibility confirmation, shipping and billing address, shoe size, training goals, experience, preferences, and information you provide in forms or surveys.
Movement, Fitness, and Activity Information
Sensor and activity data such as plantar pressure, motion, gait-cycle timing, steps, cadence, speed, distance, load, impact-related metrics, left-right comparisons, routes, workouts, training history, subjective feedback, and related biomechanical or fitness insights. Depending on your jurisdiction and how the information is used, some of this information may be considered sensitive or health-related data.
Device & App Usage Data
Product identifiers, firmware and App version, device type, operating system, Bluetooth and sync status, IP address, approximate location derived from IP, App interactions, feature use, session duration, crash reports, diagnostics, logs, and security events.
Location Data
With the permission required by your device and applicable law, we may collect precise GPS location to record routes, calculate activity metrics, map sessions, and provide location-based features. You can disable location access in your device settings, but route and related features may not work.
Orders, Payments, and Support
Products ordered, subscription choices, prices, transaction and payment status, delivery details, return or warranty records, communications, support requests, and any photos, receipts, or files you submit. Payment card information is generally collected directly by our payment processor; Surplex receives transaction details rather than full card numbers.
Website, Analytics, and Advertising Information
Cookie identifiers, browser and device information, referral URLs, campaign and ad identifiers, pages viewed, clicks, form interactions, attribution data, and email or other identifiers submitted through lead or checkout forms. Some advertising providers may receive a hashed or otherwise transformed identifier; transformed identifiers can still be personal information.
We collect information directly from you, automatically from Products and Services, from devices or services you choose to connect, and from vendors that help us operate, secure, analyze, market, and support the Services.
How We Use Your Data
We use personal information to:
- create and administer accounts; pair Products; record, sync, and display activities; calculate metrics; provide AI-assisted feedback; establish personal baselines; recognize patterns and changes over time; and personalize features, coaching, models, or parameters for you;
- process orders, payments, deliveries, subscriptions, returns, repairs, warranty claims, and customer support;
- maintain, troubleshoot, secure, develop, test, evaluate, and improve the Services and Surplex's own algorithms, machine-learning models, and AI-powered features, including debugging, quality assurance, fraud prevention, and safety monitoring;
- send transactional messages, security alerts, product notices, policy updates, and, where permitted, marketing communications;
- measure product and campaign performance and understand how people find and use our websites and Services;
- create aggregated or de-identified information and use it for analytics, research, product development, and model evaluation or improvement; and
- comply with law, enforce agreements, establish or defend legal claims, and protect users, Surplex, and others.
AI Features and Model Improvement
Personalized Striv Experience
Surplex may associate movement, fitness, activity, and interaction information with your account or a pseudonymous internal identifier to establish your personal baselines, recognize patterns and changes over time, personalize coaching and insights, and adapt models or parameters used to provide your Striv experience. A random or pseudonymous identifier does not make the information anonymous when it can still be linked to your account or used to recognize you over time, so we continue to treat this information as personal information under this Policy.
Improving Surplex Products and Models
Surplex may also use personal information, including information associated with pseudonymous identifiers, to develop, test, evaluate, validate, and improve Surplex's own products, analytics, algorithms, machine-learning models, and AI-powered features. These improvements may benefit you and other Striv users. We use safeguards appropriate to the information and purpose, such as data minimization, pseudonymization, aggregation or de-identification where practical, access controls, and retention limits. Where applicable law requires consent for sensitive or health-related information or a particular model-improvement use, we will request that consent.
Surplex may use aggregated or de-identified information that cannot reasonably be linked to you for analytics, research, product development, and model improvement. We take reasonable measures designed to prevent de-identified information from being associated with an individual and do not attempt to re-identify it except to test whether our de-identification safeguards are effective or as permitted by law.
Contracted AI Service Providers
When you use an AI-assisted feature, we may send information reasonably needed to generate the requested response—such as movement metrics, activity context, goals, prompts, and prior relevant interactions—to contracted AI service providers. Depending on the feature and system configuration, these providers may include OpenAI or Anthropic. We seek to minimize direct identifiers in these requests where practical, but the information is not necessarily anonymous.
This processing is used to provide the feature you requested, monitor quality and safety, prevent abuse, and troubleshoot the Services. We do not sell Striv customer data to AI service providers or authorize them to use it to train their own general-purpose models.
How We Disclose Personal Information
We may disclose personal information to the following recipients for the purposes described in this Policy:
- Infrastructure and operations providers that host data, deliver content, monitor reliability, provide communications, or support security and customer service.
- AI service providers, which may include OpenAI or Anthropic, when needed to provide requested AI-assisted features.
- Payment, commerce, and fulfillment providers, such as payment processors, carriers, and return or repair partners.
- Analytics and advertising providers, such as PostHog, Google Analytics where configured, and Meta, to measure usage, attribution, leads, and campaign performance.
- Connected services when you direct us to connect or disclose information to another app, wearable, coach, professional, or service.
- Professional advisers and authorities when reasonably necessary for legal, accounting, insurance, compliance, safety, or fraud-prevention purposes, or when required by law.
- Transaction counterparties in connection with a financing, merger, acquisition, reorganization, bankruptcy, sale of assets, or similar corporate transaction, subject to appropriate safeguards.
We require service providers that process personal information on our behalf to use it only for the limited purposes authorized by Surplex or otherwise permitted by law, to protect it appropriately, and not to use it for their own independent purposes except as disclosed to you.
We do not sell personal information for money. However, disclosures of identifiers or internet activity to advertising providers may be considered a “sale,” “sharing,” or targeted advertising under some U.S. state privacy laws even when no money changes hands. Where applicable, you may request to opt out as described below.
Data Retention
We retain personal information for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain appropriate business and transaction records, meet legal obligations, resolve disputes, enforce agreements, and protect the Services. Retention depends on the data type, sensitivity, account status, legal requirements, and operational need.
- Account, movement, activity, and precise location information is generally retained while your account is active and then deleted or de-identified after a valid deletion request, subject to backups and permitted exceptions.
- Support, security, fraud-prevention, consent, and transaction records may be retained after account deletion when reasonably needed to document transactions, protect users, comply with law, or establish or defend legal claims.
- Payment and tax records may be retained for up to seven years or another period required by applicable law.
- Aggregated or de-identified information may be retained for longer where permitted by law because it no longer reasonably identifies an individual.
Deletion from active systems may not immediately remove information from encrypted backups, disaster-recovery systems, or records we must retain. We isolate or protect retained information and delete it in accordance with applicable retention cycles. To request deletion, use available in-App controls or contact info@striv.run.
Legal Bases and International Processing
Where a legal basis is required, we process personal information as necessary to perform our contract with you; based on our legitimate interests in operating, securing, developing, improving, and supporting the Services; to comply with legal obligations; to protect vital interests where applicable; and with consent where we request it or applicable law requires it, including for precise location, certain sensitive or health-related information, or particular model-improvement uses. Our current website analytics and advertising practices and available choices are described in the “Cookies, Analytics, and Advertising” section above.
Surplex is based in the United States, and we and our providers may process information in the United States and other countries. Those countries may have privacy laws different from those where you live. Where required, we use recognized transfer mechanisms and supplementary safeguards for international transfers.
You may withdraw consent at any time, but withdrawal does not affect processing already carried out lawfully. Some features cannot function without the information needed to provide them.
Your Rights and Choices
Depending on where you live, you may have the right to:
- access, know about, or receive a copy of your personal information;
- correct inaccurate personal information;
- delete personal information, subject to lawful exceptions;
- receive portable data or request transfer where technically feasible;
- object to or restrict certain processing;
- withdraw consent and manage device permissions;
- opt out of targeted advertising or processing treated as a sale or sharing under applicable U.S. state law;
- limit certain uses of sensitive personal information where applicable;
- appeal our response to a privacy request; and
- complain to your local data-protection authority.
Use available account or device controls, or email info@striv.run with the subject “Privacy Request.” We may verify your identity and authority before completing a request. An authorized agent may submit a request where permitted by law. We will not discriminate against you for exercising applicable privacy rights.
Marketing emails include an unsubscribe method. Transactional and security messages may continue while you maintain an account or transaction with us.
Data Security
We use administrative, technical, and physical safeguards designed to protect personal information, such as access controls, encryption in transit, secure infrastructure, monitoring, and incident-response procedures. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
If you believe your account or information may be at risk, contact us promptly. Where required, Surplex will provide notices concerning qualifying breaches of personal information, including health-related information covered by applicable breach-notification laws.
Children's Privacy
The Services are intended only for people age 18 or older. We do not knowingly permit minors to create consumer accounts. If you believe a minor has provided personal information through the Services, contact us so we can investigate and take appropriate action.
Policy Updates
We may update this Policy as our Services or legal obligations change. We will post the current version at https://a.striv.run/privacy.html and revise the “Last Updated” date. If a change materially affects how we handle personal information, we will provide additional notice and obtain consent where required.
Contact Us
For questions or privacy-related concerns:
📍 Surplex, Co.
68 Harrison Avenue
Suite 605, PMB 50833
Boston, Massachusetts 02111
United States