Student data deserves a clear agreement.

What the service processes

Depending on which features a team enables: roster names, email addresses, membership and group assignments, schedules, workouts, results, personal records, attendance and practice completion, coaching notes, athlete-reported wellness and exertion, parent links, optional imported run data, and service/account logs. A coach can manage an athlete on a roster without giving them an account. We do not need Social Security numbers, student grades, medical diagnoses or government IDs; do not enter them into free-text fields.

Purpose and restrictions

We process team data to deliver and secure the training, scheduling, performance, communication, support, and account functions chosen by the program. We do not sell identifiable athlete or student data, serve behavioral advertisements to athletes, or use identifiable student records to market unrelated products. Data access depends on team membership and assigned role. We do not authorize using student records to profile individuals outside the legitimate team or school purpose.

Age and consent

Children under 13 may not create or activate their own Pace Command accounts. Coach-managed rosters can contain younger athletes only when the school or organization has the appropriate lawful authority and BP Labs has reviewed the intended arrangement, including any required parent notice, consent, or student-data agreement. A parent account is not a substitute for any legally required consent. Schools cannot simply transfer the operator's COPPA obligations to themselves. If you run a program for under-13 athletes, contact BP Labs before uploading identifying information.

School control, parent rights, and requests

Schools and authorized programs should identify their data controller or records custodian. Where records are maintained on behalf of a school, appropriate school officials coordinate parental access, corrections, record transfers and deletion according to the applicable law and the signed contract. A coach deleting an individual login is not the same as erasing school records. School head coaches can submit these requests through the authenticated Team data & privacy settings screen. Requests may also be submitted to accounts@bplabsllc.com and may require identity and school authority verification. We do not disclose another student's private records in response to an unverified request.

Security and service providers

Service protection includes authenticated sessions, role-based access controls, HTTPS transport, restricted team access, rate limiting and audit records for selected actions. Floot provides the managed application and database infrastructure. We also use providers for transactional email and device notifications; Stripe processes checkout and recurring billing information. Providers may process limited data needed for those functions. These statements are descriptions of the system, not a claim of SOC 2 certification, a completed independent penetration test or a district-specific security approval.

District IT teams can request details about hosting, encryption, authorized subprocessors, data location, access control, incident reporting, disaster recovery and security questionnaires. Some details require confirmation from infrastructure vendors before a contractual assurance can be made.

Retention, export and deletion

Schools may request a program-level export or return of data and a contractual deletion schedule. Account deletion removes the individual login and certain associated data; shared program records can remain under school control and must be handled through a verified organization request. Backup copies may persist temporarily according to hosting and legal requirements. We will not promise a fixed deletion window or guaranteed backup destruction without verifying the specific systems and agreement.

Our account deletion information explains the in-app and web process for individuals.

Contracts for school use

Public schools and districts may require a data processing or student-data privacy agreement before uploading protected student records. That agreement should identify approved purposes, data categories, security responsibilities, subcontractors, breach reporting, retention and return or deletion, access and correction, school audit rights where required, and state-specific addenda. A general subscription checkout does not replace these documents.

When requesting a quote, select Student data privacy agreement and identify the school district and state. We'll review required terms rather than representing an unsigned template as an executed contract. Request a school quote and documents.

Where to report an incident

For suspected unauthorized data access, disclosure, security vulnerability, or compromised school account, contact accounts@bplabsllc.com promptly and label your message Security or student data incident. Do not send passwords or student records in the initial email. We will assess the report and coordinate notices as required by law and any signed school agreement.