WaviTrack Dataset Access Agreement Version: v1.0 Effective date: 3 October 2026 Provider and licensor: Franklin Wu, project lead of the WaviTrack Team ("Provider", "I" or "me"). Contact: admin@wavitrack.com Project website: https://wavitrack.com/ This Agreement governs applications and approved personal access. Publishing it does not open Dataset access or approve an application. 1. What you are agreeing to This Agreement is between you, the individual applicant, and the Provider. "WaviTrack Team" describes the project team; it is not a separate contracting party. Your institution is not made a party merely because you enter its name. The WaviTrack Dataset Research and Education Licence with the same version identifier forms part of this Agreement and must be available to read and save before you accept. It defines the Dataset, Approved Purpose, Derived Data and Research Outputs and states the full conditions for using the files. For an approved application, the Provider supplies conditional access without a licence fee in return for your undertakings in these documents. No Dataset permission begins until the application is approved and the required account activation and acceptance steps are completed. A summary, checkbox or email cannot enlarge the permission in the full Licence. 2. Application, email verification and review Give your genuine name, an email address you control, your current affiliation and an accurate description of the intended research or educational use. Disclose relevant commercial sponsorship, partners and intended beneficiaries. Do not submit another person's address, impersonate anyone or omit a commercial purpose. Institutional or educational email addresses are strongly preferred, but an email domain alone neither establishes eligibility nor guarantees approval. Verify your email before the application is submitted for human review. Verification proves control of an address; it is not approval or proof of all other application details. The Provider may request relevant clarification, approve or decline the application, and limit approval to a particular project or release. Do not send identity documents or unrelated personal information unless specifically requested through an appropriate secure process. Tell the Provider if your affiliation or purpose materially changes and obtain renewed approval before proceeding with the changed use. 3. Your principal undertakings You agree to: (a) use the Dataset and Derived Data only for the Approved Purpose: non-commercial academic research or education; (b) make only the working and backup copies needed for that purpose; (c) refrain from all commercial or industrial use, including analysis, benchmarking, model training, fine-tuning, evaluation, consulting and product or service development; (d) refrain from commercial exploitation of models and other data-dependent artefacts developed using the Dataset, as specified in the Licence; (e) not redistribute, mirror, publish, sell or share the Dataset, its subsets or Derived Data, including through repositories or supplementary files; (f) not share your account, access credentials or access-granting download links; (g) not attempt participant identification, re-identification, identity linkage or contact, and not use the data for prohibited surveillance, sensitive profiling or harmful decisions; (h) use appropriate security measures, report incidents without undue delay and comply with applicable law; and (i) preserve notices, cite the specified paper and follow the Licence's conditions for publishing Research Outputs. These undertakings are subject to the Licence's express permissions and to rights that cannot lawfully be excluded. Commercial use is prohibited even when performed without payment or at an academic institution. Academic publication itself is allowed within the Licence; redistribution of participant records is not. 4. Account security and service use Use a unique password and protect your email account and credentials. Notify the Provider promptly if you suspect compromise. You are responsible for your own authorised use and reasonable security precautions; this does not make you automatically liable for every event beyond your control. Do not bypass verification or approval, use another person's account, interfere with the service, or attempt to obtain unauthorised files. Do not use multiple identities or requests to evade restrictions. Access may be interrupted for maintenance, security, legal requirements or investigation of suspected misuse. The Provider does not promise uninterrupted service, permanent hosting, technical support or a particular release schedule. Suspension, termination, notices and deletion are governed by Licence section 9. 5. Publications, models and separate licences Permitted research publications and non-identifying aggregate results may be shared with the required acknowledgement. Trained weights may be shared only under the non-commercial downstream conditions and participant-protection requirements in Licence section 6. Do not publish recoverable Dataset records disguised as model outputs, examples or another file format. The paper's licence does not grant rights to the separately supplied Dataset. Code, hardware, separately released pretrained models and third-party body-model assets have their own applicable terms. This Agreement neither replaces those terms nor grants rights the Provider does not control. 6. Closing your account You may contact admin@wavitrack.com to withdraw an application, close your account or request erasure of personal information. If information needed to maintain a verified, approved account is erased, access ends and the Licence's termination and deletion provisions apply to Dataset copies. An erasure request is not misconduct. Necessary information may still be retained where lawful, for example to comply with a legal obligation or establish, exercise or defend a legal claim. The Provider will explain any applicable reason for retention. Do not assume that account closure requires withdrawal of already lawfully published findings; Licence section 9 explains the distinction. 7. Applicant and account privacy notice This section concerns information about applicants and account holders. It is not the participant consent notice or a statement that Dataset records can never identify someone. Reading this notice does not waive your rights or constitute blanket consent to processing. Controller and contact. For the application and account service described here, the controller is Franklin Wu, operating in the United Kingdom. Contact admin@wavitrack.com for account, privacy, permission and security requests. No university is the contracting party or controller for this service merely because it is credited on the project website. Information handled. This includes your name, email, affiliation, stated purpose, correspondence, email-verification and review status, approval decisions, account details, securely hashed password, agreement-acceptance information and download records. Security information may include IP addresses in server logs and hashed email/IP identifiers used for rate limiting. Necessary session and security cookies support sign-in and protect forms; they are not permission for advertising tracking. Purposes. Applicant details are used to verify and review access requests, administer approved access, communicate about the account, protect the service and participants, investigate misuse and meet applicable legal obligations. They are not used for marketing, sold, or made part of the research Dataset. "Verification only" would not accurately describe these necessary account and security operations. Lawful bases. Processing objectively necessary to assess the application you request and administer approved access is based on steps requested by you before entering this Agreement and performance of it (UK GDPR Article 6(1)(b)). Proportionate verification, abuse prevention, service and participant protection, and defence of legal rights rely on legitimate interests where those interests are not overridden by your rights (Article 6(1)(f)). A specific applicable legal obligation may require processing under Article 6(1)(c). Equivalent EU GDPR provisions apply only where that law applies. Agreement acceptance is not relied on as blanket data-protection consent. Who receives information. Access is limited to the Provider and authorised reviewers or administrators who need it, and infrastructure or email-delivery providers processing it for the service under appropriate arrangements. Application information may be included in reviewer notifications. Disclosure to advisers, regulators or authorities may occur where necessary and lawful. Reviewer access is not permission for unrelated reuse. Hosting and international processing. The application database and private downloads are hosted on Alibaba Cloud in its UK (London) region. Transactional and administrative email is handled by Resend (Plus Five Five, Inc.), which stores email data in the United States even when an EU sending region is selected. Its data-processing agreement incorporates Standard Contractual Clauses and the UK International Data Transfer Addendum for relevant transfers. Alibaba Cloud's data-processing terms also address international processing and the applicable transfer safeguards. This does not mean that provider support or all subprocessors operate only in London. Review notifications and messages to admin@wavitrack.com are delivered or forwarded to authorised reviewers' institutional mailboxes. Their email infrastructure may also involve international processing; access is restricted to service administration. Contact admin@wavitrack.com for details of the relevant recipients and transfer arrangements, or to request copies of the applicable safeguards, with unrelated confidential information redacted where necessary. Provider information is available at https://resend.com/legal/dpa and https://www.alibabacloud.com/help/en/legal/latest/fe2cxg. Retention. The ordinary retention period for transient or closed records is 30 days: (a) unverified or still-pending applications expire 30 days after submission; denied applications are removed 30 days after the decision; (b) approved application details, account details and the latest accepted version/time are retained while needed to maintain an active approved account, then removed within 30 days after account closure; unused invitations and inactive accounts that have never been activated expire after 30 days; (c) individual acceptance-event and download logs, and the website's administrative email records, are removed after 30 days; retaining the latest account acceptance does not mean retaining every historical personal event indefinitely; (d) operational logs and website backup copies are retained for no more than 30 days, with shorter operational periods possible. Deleted information may remain in an access-restricted backup until that backup expires, for up to a further 30 days, and is not used for ordinary operations; (e) verification-rate-limit identifiers use a rolling 24-hour window, and expired sign-in sessions are cleared regularly; (f) forwarded administrative correspondence is removed from reviewers' working mailboxes within 30 days after its administrative purpose ends. Resend's email/log storage follows its published retention rules, ordinarily 30 days on its standard plans, with separate restricted backup and legal-retention rules. The Provider requests earlier removal where appropriate rather than claiming to control all third-party backup copies. Copies of the legal documents without applicant information may be kept to identify releases and accepted versions. Limited personal records may be retained longer for a specific legal obligation, unresolved security incident or legal claim; any such hold must be necessary, documented, restricted and reviewed, and its reason explained where lawful. The 30-day policy does not automatically expire an actively approved user's access or waive your right to request earlier erasure. Your rights. Depending on the applicable law and circumstances, you may request access, correction, erasure, restriction or portability of your information, and object to processing based on legitimate interests. Contact admin@wavitrack.com. Proportionate identity verification may be needed before a request is acted on. Requests will be handled within applicable legal deadlines, ordinarily one month under the UK/EU GDPR subject to lawful extensions or other applicable provisions. You may complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ where it is the relevant authority, or to the competent authority in your jurisdiction, including an EEA authority where applicable. You do not have to waive that right or accept the Provider's answer as final. Providing the required identity, affiliation and purpose information is necessary to assess an application and administer personal access. Without it, an application cannot be approved or an account maintained. Access decisions are intended to be made by human reviewers; automated security controls can limit requests, but do not themselves grant approval. 8. Legal effect, updates and responsibility Applicable copyright and database rights support the Licence where their legal requirements are met. Your express contractual undertakings are distinct from those rights. The documents do not claim ownership of all raw facts, universal database protection or that every breach is a criminal offence. The Licence's provisions on research-material limitations, liability, mandatory rights, severability and governing law apply equally to this Agreement. This Agreement is governed by the law of England and Wales with non-exclusive jurisdiction there, without removing mandatory legal protections. The Provider must present a versioned final Agreement and Licence before acceptance. Material changes require notice and express acceptance before governing further access under the new version; a website edit alone does not retrospectively rewrite your agreement. A privacy-notice update must accurately explain processing, not disguise an unrelated new purpose. 9. Acceptance The registration checkbox reads: "I have read and agree to the WaviTrack Dataset Access Agreement and Dataset Licence, and I acknowledge the applicant privacy notice." By selecting that checkbox and submitting your request, you confirm that the information you give is accurate, you understand the personal, research-only and non-commercial nature of access, and you agree to the terms presented. You acknowledge the privacy information; this is not blanket consent or a waiver of data-protection rights. The Provider records the version and time of acceptance at application submission and account activation, keeps an archived copy of the terms, and asks for fresh acceptance before downloads under materially revised terms. Personal event records are subject to section 7's retention policy; the latest account acceptance is retained while needed to maintain approved access. Email verification and approval remain separate requirements. Questions about these terms, permissions, privacy or misuse should be sent to admin@wavitrack.com. The automated sender noreply@wavitrack.com is not a support or privacy-request inbox.