Privacy Policy

Effective date: October 16, 2026. Version: 2026-10-16.

1. Who is responsible for your information

Cage & Caliber LLC d/b/a Lost Soul MMA ("we", "us") is responsible for personal information collected through our main website, our membership and booking systems, and our affiliate program at affiliates.lostsoulaffiliate.com. Our address is 3948 24th Ave, Port Huron, MI 48060. You can reach us at lostsoulmixedmartialarts@gmail.com or 810-434-1302.

Stripe and other service providers process some information under their own privacy terms, as described in section 5.

2. What we collect

Members and visitors: name, email address, phone number, date of birth, emergency contact, waivers and consent records, membership plan, class bookings and attendance, purchases and payment status, and communications with us. We do not store full payment card numbers. Stripe holds payment card details; we see the card brand, the last four digits, and payment status.

Youth participants: information a parent or guardian provides for enrolment, including health and safety details and emergency contacts. See section 10.

Affiliates: name, email address, date of birth, a photo ID file (see the Affiliate Data and Identity Policy), a password stored only as a hash, an authenticator setup stored in encrypted form, email verification status, referral codes and their history, consent records, and the commission, reversal and payout history. Stripe holds the affiliate's bank account and tax identification details. We do not store Social Security numbers, EINs or full bank account numbers.

Staff: name, email address, a password stored only as a hash, an encrypted authenticator setup, role, and a record of what each staff member views or changes.

Automatically: IP address, browser type and device details, and security events such as failed sign-in attempts, which are used to protect accounts from guessing. Failed attempts are kept for 24 hours.

3. Why we use it

• To provide memberships, classes, bookings, and the affiliate program.
• To charge members, make payouts, and keep the tax and accounting records the law requires.
• To verify that an affiliate is 18 or older and is the person they say they are, and to prevent fraud and duplicate accounts.
• To send account, security, billing and legal notices.
• To keep our systems secure and investigate misuse.
• To send marketing messages only where you have agreed, with an option to stop at any time.

4. Cookies and similar technology

• Sign-in cookies (ls_session for affiliates, session_token for members, ls_staff for staff): HttpOnly, SameSite=Strict, Secure on the live site, and deleted when you sign out. They keep you signed in and are needed for the service to work.
• Referral cookie (ls_ref, set by the membership site): stores a valid affiliate code for up to 30 days, so a sign-up can be credited to the right affiliate. See the Cookie Notice.
• Analytics and advertising: neither the affiliate system nor the membership website currently uses analytics or advertising tracking. The membership website has tracking code for Google Analytics, Google Ads and Meta Pixel, but no tracking IDs are set, so none of it loads. If any of these is switched on later, this policy and the Cookie Notice must be updated first.

5. Who we share information with

We share information only as needed to run the service:

Each provider processes information under applicable third-party agreements. We may disclose information to professional advisers, insurers, or government authorities where the law requires it or it is necessary to protect people or our rights.

We do not sell personal information. No comprehensive Michigan consumer privacy law currently applies to us. We follow Michigan's security breach notification law (MCL 445.72) and the Michigan Social Security number privacy act (MCL 445.81 et seq.). Our affiliate system does not collect Social Security numbers. If a state privacy law that gives you additional rights applies to you, contact us to exercise them.

6. How long we keep it

These are the periods we apply:

When these periods end, information is deleted or de-identified, including from backups on their normal rotation. We may keep information longer where a legal hold, a dispute or a legal duty requires it.

7. How we protect it

• Passwords are stored with Argon2id, a memory-hard hashing method. Passwords must be at least 12 characters and must not appear in a known data breach.
• Staff and affiliates must use two-step sign-in with an authenticator app (TOTP, RFC 6238). Recovery codes are single-use and stored only as hashes.
• Sign-in sessions use random tokens. Only a SHA-256 hash of each token is stored.
• Authenticator secrets and photo ID files are encrypted with AES-256-GCM before storage, using separate keys.
• Photo ID files are kept in a private storage bucket with no public access, and each file's integrity is checked when it is viewed.
• Staff access to personal records is limited by role, requires password and authenticator sign-in, and is recorded in an audit log.
• Records that must not be changed, such as the ledger, the audit log and consent records, are protected by database rules that block updates and deletes.
• Sign-in and password-related requests are rate limited.
• Responses carry security headers, including a Content Security Policy and HTTP Strict Transport Security.
• We review our systems for security weaknesses and act on the findings.

No system is completely secure. If you believe your account is at risk, contact us straight away.

8. Your choices and rights

You may ask us to:

• tell you what personal information we hold about you;
• correct information that is wrong;
• delete information where the law allows, recognising that tax, payout, fraud-prevention and legal-dispute records may need to be kept.

Affiliates can see their name, email, date of birth, code and ID on their account page, and can view their own ID file there. To make a request, email lostsoulmixedmartialarts@gmail.com or call 810-434-1302. We will confirm your identity before we disclose sensitive information, and we will respond within 30 days, unless the law sets a different period.

You can stop marketing messages at any time using the link in them or by contacting us. Essential account, billing, security and legal messages continue.

You may also contact the Consumer Protection Division of the Michigan Attorney General's office, or another regulator where the law gives you that right.

9. Security incidents

If we learn of unauthorised access to or disclosure of personal information, we will act promptly to contain it, investigate, and notify affected people and regulators as the law requires, including under Michigan's security breach notification law (Identity Theft Protection Act, MCL 445.72).

10. Children

The affiliate program is for adults aged 18 or older, and must not be used by minors. The youth program is enrolled by a parent or guardian, who provides the information needed for safe participation and should not provide more about the child than is requested. For the youth program, the parent or guardian provides the child's information and receives these privacy terms when they enrol. We do not knowingly collect personal information from children under 13 directly.

11. International visitors

Our services are offered in the United States and are governed by Michigan law and applicable federal law.

12. Changes and contact

We may update this policy. We will show a new effective date and version, and tell you about material changes as the law requires. The current version is always available from the footer of our websites.

Cage & Caliber LLC d/b/a Lost Soul MMA, 3948 24th Ave, Port Huron, MI 48060 · lostsoulmixedmartialarts@gmail.com · 810-434-1302.