Privacy Policy

1. Information we collect

Account data: name, email, and authentication identifier (managed by Clerk). Profile data you choose to add, such as sports, certifications, and a bio.

Booking & payment data: the sessions you book, payment metadata processed by Stripe (we do not store your full card number), and transaction history. For Providers: payout and tax details as required.

Usage data: pages visited, device, approximate location, and analytics, collected only with your consent (see our Cookie Policy).

Gym data: facility information sourced from Google Places, used to populate listings. This is business data, not personal data about you.

2. How we use your data

To operate the marketplace: create and manage accounts, process bookings and payments, and enable communication between users and Providers.

To provide trust & safety: verify Providers, moderate content, prevent fraud, and investigate violations.

To improve and secure the Services: analytics (with consent), debugging, and security monitoring.

To communicate with you about your account, bookings, and policy updates. Marketing communications require your separate opt-in.

3. Legal basis (GDPR)

For users in the EEA/UK, we process personal data on the following bases: performance of our contract with you (bookings, payments), our legitimate interests (security, fraud prevention, service improvement), your consent (analytics, marketing), and compliance with legal obligations.

4. How we share data

With Providers: the information necessary to fulfill a booking you made.

With processors: Clerk (authentication), Stripe (payments), Cloudflare R2 (file storage), Google (Maps), Resend/Twilio (notifications), and our hosting and observability providers — each under contract and only to provide their service.

With authorities: where required by law or to protect rights, safety, or property. We do not sell your personal data.

5. Retention

We keep data only as long as needed for the purpose collected and to meet legal, tax, and accounting obligations. When you delete your account, we anonymize retained records (e.g., reviews) where needed for integrity, and delete or scrub personal data otherwise. Some records are kept as tombstones for referential integrity.

6. Security

We use TLS in transit, encrypted at rest where applicable, and never store full card data (Stripe does). Access is least-privilege and logged for sensitive actions. No method is perfectly secure, but we design for defense in depth.

7. Your rights (GDPR/UK GDPR)

You have the right to access, rectify, erase, restrict, port, and object to processing, and to withdraw consent at any time. You can export all your data or delete your account from your dashboard. To exercise these rights or to lodge a complaint, contact privacy@findacoach.io. You may also complain to your local data protection authority.

8. Your rights (CCPA/CPRA)

California residents may request disclosure, deletion, and correction of personal information, and may opt out of the "sale" or "sharing" of personal information. We do not sell personal information. Submit requests to privacy@findacoach.io. Authorized agents may submit on your behalf with proof of authorization.

We will not discriminate against you for exercising your CCPA rights.

9. Children's privacy

The Services are not directed to children under 13 (or the applicable age in your jurisdiction). We do not knowingly collect personal data from them. A parent or guardian may book sessions for a minor; we process only the data the adult provides. Contact privacy@findacoach.io to request removal of any data we may have collected from a child.

10. International transfers

Your data may be processed in countries other than your own. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses and only transfer data necessary to provide the Services.

11. Changes & contact

We will update this Policy on notice. The data controller is FindACoach.io, Inc., [Registered business address — to be inserted]. For privacy questions or requests, including data subject access requests, contact privacy@findacoach.io.