Privacy Policy

Last Updated: 2026-09-23

This Privacy Policy describes how Mettle Labs LLC, a Texas limited liability company ("Mettle", "we", "us", or "our"), collects, uses, shares, and protects personal information when you visit withmettle.com, use our software platform (the "Services"), or otherwise interact with us.

If you have questions about this Policy, email [email protected] with "Privacy" in the subject line.

1. Two Important Things to Know Up Front

(a) Who our customers are. Mettle is a business-to-business platform. Our direct customers are the businesses ("Customers") that use our Services to manage their members, run billing, and operate their business. If you are an owner, employee, or staff member of a Customer with a Mettle account, you are our customer and we are the controller of your personal information.

(b) If you are a member or client of a Customer. If you receive services from a business that uses Mettle — for example, you bought a membership, signed a waiver, or made a payment through that business — then your personal information is held in Mettle's systems on behalf of that business. We process your information as a service provider to the business, not as our own customer. The business is responsible for how your information is collected, used, and shared.

If you are a member of one of our Customers and want to access, correct, or delete your personal information, please contact that business directly. They control your account. We will help the business respond to your request, but we cannot act on it without their instruction, except where applicable law requires us to respond directly.

This distinction matters legally — it's the difference between "controller" and "processor" under GDPR and CCPA — and practically: the business knows your situation; we don't.

2. Information We Collect

2.1 From Owners and Staff of Customers (You Are Our Customer)

When an owner or staff member of a Customer signs up for Mettle and uses our Services, we collect:

• Account information: name, email address, password (hashed; we never see it in plain text), and optionally a phone number and profile photo.
• Business information: business name, business address, business contact information, country, currency, and operational settings you configure.
• Authentication data: session cookies, sign-in timestamps, the device and browser you signed in from, and IP address. Sessions are stored in our database and expire on inactivity or sign-out.
• Billing information for your Mettle subscription: we use Stripe to bill Customers for their Mettle subscription. We store the Stripe customer identifier; we do not store your payment card number, CVV, or expiration date. Card data is collected directly by Stripe.
• Support communications: if you email us at support or otherwise contact us, we retain the message and our response. If you submit the Request Access form on our website (your name and email address), the submission is stored and also sent by email to Mettle's support inbox so we can reply.

2.2 From Members (Information We Hold on Behalf of Customers)

Customers use Mettle to manage their members. The Customer decides what to collect and enters it into our Services (or invites the member to enter it through a signup form). This typically includes:

• Identity and contact: name, email, phone, date of birth, gender, and address.
• Emergency contact: the name, phone, and relationship of a person to contact in an emergency.
• Membership agreement records: the text of the Customer's member agreement, signing identity, and signing metadata (timestamp, IP address, user agent).
• Member photo: a profile photo (roster avatar) if the Customer collects one, so its staff can put a face to a name — not identity verification, and never facially processed. Kept while the person is a member; deleted when they leave the Customer or the Customer offboards.
• Group relationships: how members are grouped and each member's relationship to the group head.
• Payment instrument identifier: the Customer's payment processor (Stripe Connect) stores the member's payment card on the Customer's behalf. Mettle stores only an identifier issued by the connected Stripe account; we do not store card numbers, CVVs, or expiration dates.
• Membership and transaction records: offerings purchased, session selections, enrollment date, referral source, and payment records.
• Notes and preferences: free-text notes the Customer records about the member, and the member's communication preferences.

The Customer determines what to collect. Mettle provides the fields; the Customer chooses which to use. If you are a member and have questions about what is collected or why, contact the Customer directly.

2.3 Information We Collect Automatically

When you visit our website or use our Services, we automatically collect:

• Log data: IP address, browser type, operating system, referring URL, pages visited, and timestamps.
• Device information: the type of device and screen size used.
• Bot-protection data: when you submit certain forms (such as signup), we use a third-party bot-protection service to verify you're a human, not a bot. The service may collect IP address and device characteristics for this check.

We do not use third-party advertising trackers, analytics pixels (such as Google Analytics, Meta Pixel, or similar), or behavioral profiling cookies on our application. We use Sentry for error monitoring on our website and Services. An error report can include the page address or endpoint involved (which may contain an internal record identifier), browser and device details, and technical details of the error. We configure Sentry not to attach full IP addresses, email addresses, cookies, request bodies, or the identity of the signed-in user or member; security events (such as a refused sign-in or a rate-limit hit) may carry a truncated IP address or a one-way coded tag in place of an email address. Error reports never include payment card data or document contents. On our staff and member apps, Sentry also records performance timings for a sample of page loads. If we add product-analytics tools in the future, we will update this Policy first.

3. How We Use Information

We use personal information to:

• Provide the Services — create and maintain accounts, authenticate users, deliver the features Customers pay for, and process payments through Stripe.
• Communicate with you — send transactional emails (signup confirmations, password resets, billing notices, one-time sign-in codes) through a third-party email delivery provider. We do not currently send marketing email from our application.
• Maintain security — detect, prevent, and respond to fraud, abuse, account takeover, and other security incidents.
• Improve the Services — understand how the platform is used (in aggregate) and fix problems. We use server-side logs and error monitoring (see Section 2.3) for this, not advertising or analytics trackers.
• Comply with law — meet our tax, accounting, and legal obligations, including responding to lawful requests from public authorities.

We do not sell personal information for monetary or other valuable consideration. We do not share personal information with third parties for their own advertising purposes.

4. How We Share Information

We share personal information only as described below.

4.1 Service Providers

We use third-party service providers (subprocessors) under written contract to operate our Services. Each is contractually required to protect the information they handle and to use it only as needed to provide the service to us. We do not authorize service providers to use Customer Data or Member Data for their own purposes.

Our current subprocessors are:

• Stripe — payment processing for Mettle subscriptions and Member payments.
• Cloudflare — object storage (Cloudflare R2) for uploaded files, including member photos, plus network and security services.
• MongoDB Atlas — hosting for our primary database.
• Transactional email provider — delivery of transactional email (signup confirmations, password resets, one-time sign-in codes).
• Bot-protection provider — abuse and bot detection on public forms such as signup.
• Sentry — error monitoring for our website and Services.

We update this list when our subprocessors change.

4.2 With the Customer (If You Are a Member)

If you are a member of a Customer, that Customer sees and controls all of the information in your member profile. They use it to run their business — that's the whole point of the platform.

4.3 Within the Customer (If You Are a Staff Member)

Other authorized staff at the Customer can see member information based on the role the Customer assigns you.

4.4 Legal Compliance and Safety

We may share information when we believe in good faith it is necessary to:

• comply with a subpoena, court order, or other legal process;
• enforce our Customer Agreement or Cookie Notice;
• protect the rights, property, or safety of Mettle, our customers, or others; or
• investigate suspected fraud, security incidents, or violations of our policies.

We do not provide bulk customer data to law enforcement absent valid legal process.

4.5 Business Transfers

If Mettle is acquired, merges with another company, or sells substantially all of its assets, personal information may be transferred as part of the transaction. We will notify Customers before any transfer that would change how their members' information is handled.

5. Cookies and Similar Technologies

We use a small number of cookies, all functional:

• Session cookie — set by our authentication system so you stay signed in. HTTP-only and Secure. Expires when your session expires or you sign out.
• Bot-protection cookie — set by our third-party bot-protection service during checks on signup forms.

We do not set advertising, analytics, or cross-site tracking cookies. There is no third-party advertising on our Services.

Most browsers let you block or delete cookies. Blocking the session cookie will prevent you from signing in.

6. Data Security

We protect personal information with administrative, technical, and physical safeguards, including:

• Encryption in transit — all traffic to our Services is encrypted in transit using TLS.
• Encryption at rest — our database and file storage encrypt data at rest.
• Password hashing — passwords are stored as one-way hashes using industry-standard algorithms. We never store, log, or transmit plaintext passwords.
• Tokenized payments — payment cards are collected and stored by Stripe. Mettle never sees or stores raw card data.
• Role-based access — staff see only the information their Customer's role assignment permits.
• Access controls — production system access is limited to authorized Mettle personnel, authenticated with strong credentials and multi-factor authentication. As Mettle's team grows, we will implement formal access-review and least-privilege controls.

No system is perfectly secure. If we discover a breach affecting your personal information, we will notify affected Customers and individuals as required by applicable law.

7. Data Retention

We retain personal information as long as needed to provide the Services, meet our legal and tax obligations, resolve disputes, and enforce our agreements. Data deleted from our primary systems may persist in routine backups until those backups are overwritten on our standard schedule.

Member photos are retained only while the person is a member: we delete a member's photo from storage when the member leaves the Customer or when the Customer offboards from Mettle. To change or remove a photo, a member asks their Customer (the business); the Customer's staff carry out the request using their staff tools.

8. Your Rights

Depending on where you live, you may have the right to:

• Access — get a copy of the personal information we hold about you.
• Correct — fix inaccuracies in your personal information.
• Delete — ask us to delete your personal information.
• Portability — receive a copy in a portable format.
• Object or restrict — object to or limit how we use your information.
• Withdraw consent — withdraw consent for processing that depends on consent.

How to make a request:

• If you are a member of a Customer: contact the Customer first — they hold the relationship with you and can act on most requests directly. If they cannot or will not respond, email us at [email protected] and we will help.
• If you are an owner or staff of a Customer: email [email protected] from the email address on your account. We may ask you to verify your identity.

We respond to verifiable requests within 30 days. Requests are free; we may charge a reasonable fee for excessive or repetitive ones where law permits.

Residents of California, Colorado, Connecticut, Utah, and Virginia have additional rights under their state's comprehensive privacy law. See Section 14 below.

9. Account Deletion

You can request deletion of your account at any time by emailing [email protected].

• If you are a member of a Customer: contact the Customer first. They administer your account. If you want Mettle to delete records the Customer cannot access, contact us directly.
• If you are an owner of a Customer: deleting the Customer's account deletes its member records and other Customer Data. This action affects everyone at the business. Coordinate with your team before requesting deletion.

We process deletion requests within a reasonable time after verification. Some information is retained after deletion:

• Anonymized or aggregated information that no longer identifies you.
• Information we are legally required to keep (for example, tax records of past transactions).
• Information needed to resolve disputes, enforce our agreements, or maintain security.
• Information in routine backups until those backups are overwritten.

Records held on the Customer's connected Stripe account (such as a member's payment history) remain with Stripe per Stripe's retention policies; we cannot delete them for Stripe.

10. Children's Privacy

Mettle's Services are designed for use by adults (people 18 years of age or older).

For Customers that serve minors, the Customer is responsible for obtaining all parental consents required by applicable law, including the Children's Online Privacy Protection Act (COPPA) where it applies. The group head (an adult, typically a parent or guardian) creates the account, signs agreements, makes payments, and may enter information about a minor child as part of the Customer's records.

Mettle does not knowingly collect personal information directly from children under 13. We do not market our Services to children. If you believe a child has given us personal information directly (not a parent entering it on the child's behalf), email [email protected] and we will delete it.

11. International Data Transfers

Mettle is based in the United States, and our infrastructure is hosted in the United States.

If you access our Services from outside the United States, your personal information will be transferred to and processed in the United States, which may not provide the same level of data protection as your home country. By using our Services, you consent to this transfer.

We do not currently offer the Services to users in the European Economic Area, the United Kingdom, or Switzerland, and do not target those markets. If you access the Services from those regions, you do so on your own initiative.

We do not currently offer Services or hosting in regions other than the United States. Multi-country support is planned but not yet available.

12. Third-Party Links

Our website and Services may contain links to third-party sites we do not control (for example, a Customer's website, Stripe's customer portal, or a social media page). This Privacy Policy does not apply to those sites. We encourage you to read the privacy policies of any third-party site you visit.

13. Changes to This Policy

We can update this Privacy Policy. When we do, we will update the "Last Updated" date at the top. For material changes, we will notify Customer account holders by email and, where law requires, obtain consent before the changes take effect.

Your continued use of the Services after a change takes effect means you accept the updated Policy. If you do not accept the change, stop using the Services and contact us to close your account.

14. State-Specific Privacy Rights

This Section applies if you are a resident of California, Colorado, Connecticut, Utah, or Virginia and adds to the rights described in Section 8. If you are a resident of another state, Section 8 still applies; the rights below may not.

If you are a member of a Customer, the Customer is the "business" (under CCPA) or "controller" (under other state laws) of your personal information; Mettle acts as the Customer's service provider or processor. Direct rights requests to the Customer. Mettle will assist the Customer in responding but cannot act on requests without their instruction, except where applicable law requires us to respond directly.

14.1 What We Process and Why

In the categories used by California law, we process:

• Identifiers — name, email, phone, IP address, Stripe customer identifier.
• Personal information described in California Civil Code § 1798.80(e) — name, address, telephone number, financial-account-related identifiers.
• Characteristics of protected classifications — gender, date of birth.
• Commercial information — subscription and payment records.
• Internet or other electronic network activity information — server logs, session timestamps.
• Geolocation data — IP-based approximate location; no precise geolocation.
• Professional or employment-related information — for staff of Customers: role, employment status.
• Sensitive personal information — date of birth.

We process this information to provide and maintain the Services, communicate transactional matters, prevent fraud and protect security, comply with law, and improve the Services. We do not sell or share personal information for cross-context behavioral advertising, engage in targeted advertising, or profile in ways that produce legal or similarly significant effects.

14.2 Your Rights

Subject to verification and applicable exceptions, you have the right to:

• Access the categories and specific pieces of personal information we hold about you.
• Correct inaccurate personal information.
• Delete personal information we collected from you.
• Receive a portable copy of your personal information.
• Opt out of sale or sharing for cross-context behavioral advertising — we do not do this; nothing to opt out of.
• Opt out of targeted advertising — we do not do this; nothing to opt out of.
• Limit our use of sensitive personal information — we already limit it to providing the Services, preventing fraud, and ensuring security.
• Non-discrimination — we will not deny Services, charge a different price, or provide a different level of service because you exercised a privacy right.
• Appeal (Colorado, Connecticut, Virginia only) — if we deny your request, reply to our denial email or write to [email protected] with "Privacy Rights Appeal" in the subject line. We respond to appeals within 45 days. Utah does not provide an appeal right.

14.3 How to Submit a Request

Email [email protected] with your name, the email address on your account (or the Customer you are a member of), the state you reside in, and the right you are exercising. We will verify your identity before responding and respond within the timeframes required by your state's law (generally 45 days, extendable by 45 more days where allowed).

You may designate an authorized agent. We require written authorization signed by you, plus verification of the agent's identity separately from yours. For deletion requests, we additionally require direct confirmation from you.

14.4 California Notices

"Shine the Light" (Civil Code § 1798.83). We do not share personal information with third parties for their direct-marketing purposes.

Financial incentives. We do not offer financial incentives in exchange for personal information.

Children under 16. We do not sell or share the personal information of consumers under 16.

Metrics. Mettle does not currently meet the thresholds (e.g., processing personal information of 10 million or more California consumers) that require publication of metrics under California Code of Regulations Title 11, § 7102. In the 12 months preceding the Last Updated date above, we received zero rights requests.

14.5 State Attorney General Contacts

If we deny your appeal and you wish to file a complaint:

• California — oag.ca.gov/privacy
• Colorado — coag.gov
• Connecticut — portal.ct.gov/AG
• Utah — attorneygeneral.utah.gov
• Virginia — oag.state.va.us

15. Contact Us

For questions about this Privacy Policy, to exercise your rights, or to report a concern:

Mettle Labs LLC 5900 Balcones Drive, Ste 100 Austin, TX 78731 Email: [email protected]

For faster routing, please include "Privacy", "Legal", or "Security" in the subject line of your email.

If you are not satisfied with our response, you may have the right to lodge a complaint with the data protection authority in your country or state.