PrivacyPolicy

This Privacy Policy explains how CoachOne collects, uses, shares and protects personal data when you use the CoachOne app, website and related services (the "Platform"). It applies to Trainers and Clients.

1. Who Is Responsible for Your Data

Each company is an independent controller for the data listed next to it.

EU representative. Under Article 27 GDPR, 1723 Ventures L.L.C has appointed COACHONE WEBSERVICES S.R.L. as its representative in the EU. EU users and authorities can contact it at [email protected].

Trainers and Clients are responsible for any personal data they exchange with each other outside the Platform.

2. Data We Collect

All users

• Account data: name, email, phone number, profile photo
• Booking data: Sessions booked, schedules, attendance, cancellations
• Payment data: payment status, amounts, transaction IDs, last four card digits and card brand
• Fitness data you choose to log: training hours, streaks, attendance, badges
• Device data: IP address, device type, operating system, app version, crash and log data
• Support messages you send us

Trainers additionally

• Profile and business data: bio, prices, availability, client notes and tags you create
• Payout verification data: date of birth, nationality, residential address, identity document type, number and issuing country
• Identity document photos (for example Emirates ID) where required for payouts; last four digits of the Social Security Number for US Trainers
• Bank account details for payouts
• Tax identification number, only for Trainers resident in the EU
• Google Calendar connection, if you choose to connect it (see section 6)

Clients additionally

• Saved card references (tokens) created by our payment provider

3. Data We Do Not Collect

• Full card numbers or security codes. Card data is handled directly by Stripe.
• Medical records or diagnoses
• Biometric data

Identity documents are collected only when required for payouts and are transmitted to Stripe.

Do not enter health conditions in notes or messages unless needed for your Session. Trainers must not store Clients' health data in the app beyond what the Client has agreed to.

4. Why We Use Your Data

Some data is required to use the Platform. Without it, certain features, such as card payments or payouts, will not work.

5. Analytics and Tracking

We use PostHog for product analytics and the Meta SDK for advertising measurement.

On iOS, we only use tracking for advertising if you allow it through Apple's App Tracking Transparency prompt. Users in the EU and UK are asked for consent before advertising tracking starts. You can withdraw consent at any time in your device settings or in the app.

6. Google Account Data

Sign in with Google

If you sign in with Google, Google shares your name, email address and profile photo with us. We keep your email address and your Google account ID to create your account and sign you in. We use your name once, to tell your Trainer that you joined. We do not store your Google profile photo.

Google Calendar and Google Meet (Trainers)

Connecting Google Calendar is optional. If you connect it, CoachOne accesses:

We do not read, change or delete any other events in your calendar.

What this means for Clients

When you book an online Session with a Trainer who has connected Google Calendar, the Session is added to the Trainer's Google Calendar with your name, your email and the Google Meet link. Google may send you an invitation email for it. You do not need a Google account to book.

How we store it

We keep the access key Google gives us (a "token") encrypted on our servers in the UAE. For each online Session we keep the ID of its calendar event and its Google Meet link, so we can update or cancel it. We check your busy times when we show your free times, and we do not store them.

What we never do with Google data

• Sell it
• Use it for advertising, or pass it to PostHog, Meta or any other analytics or advertising provider
• Use it to train artificial intelligence or machine learning models
• Let people read it, except with your permission (for example, to help with a support request), for security, or where the law requires
• Share it with anyone else, except the hosting providers that store it for us, or where the law requires

Disconnecting

You can disconnect Google Calendar in the CoachOne app at any time, or remove CoachOne's access at myaccount.google.com/permissions. We then delete the access token straight away and stop changing your calendar. Sessions already added stay in your Google Calendar until you delete them. Deleting your CoachOne account also deletes the token.

CoachOne's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Who We Share Data With

• Stripe (payment processing, payouts, identity verification of Trainers). Stripe processes this data as an independent controller under its own privacy policy at stripe.com/privacy.
• Apple (App Store downloads, Apple Pay, push notifications)
• Google (Sign in with Google, and Google Calendar and Google Meet if a Trainer connects them)
• Hosting and infrastructure providers
• PostHog and Meta (analytics and advertising measurement, as described above)
• Between users: Trainers see the Client data needed for bookings; Clients see Trainer profile data
• Tax authorities: the Romanian tax authority (ANAF) for EU Trainers under DAC7, which may pass it to the Trainer's home tax authority
• Authorities and courts where the law requires, limited to what is required
• Each other: 1723 Ventures L.L.C and COACHONE WEBSERVICES S.R.L. share the data each needs to run its part of the service

We do not sell personal data.

8. International Transfers

Your data is stored on servers in the UAE and may be processed in the EU, the US and other countries where our providers operate.

For data from the EEA or UK sent to countries without an adequacy decision, we use the European Commission's Standard Contractual Clauses (and the UK addendum) or another lawful transfer mechanism.

Stripe processes data in the EU and the United States.

9. How Long We Keep Data

Aggregated or anonymised data that no longer identifies anyone may be kept indefinitely.

10. Your Rights

Depending on where you live, you may have the right to:

• Access your data and get a copy
• Correct inaccurate data
• Delete your data, unless we must keep it by law
• Restrict or object to processing
• Data portability
• Withdraw consent at any time
• Complain to your local data protection authority

Email [email protected]. We reply within one month, extendable where the law allows. We may need to verify your identity first.

11. Security

We use encryption in transit, access controls and trusted providers to protect your data. No system is fully secure. If a breach affects your rights, we will notify you and the authorities as the law requires.

12. Children

The Platform is not for anyone under 18. We do not knowingly collect their data and will delete it if we learn of it.

13. Changes

We will notify you in the app or by email before material changes take effect.

14. Governing Law

This Policy is governed by DIFC law. Where the GDPR, UK GDPR or another data protection law applies to you, it applies in full and nothing here limits your rights under it.

15. Contact

[email protected]

1723 Ventures L.L.C, Meydan Grandstand, 6th Floor, Meydan Street, Nad Al Sheba, Dubai, UAE

COACHONE WEBSERVICES S.R.L. (also EU representative), Sat Hărman, Comuna Hărman, Str. DE KM. 0+324, Județ Brașov, Romania, CUI 54536319