CoachLine — Privacy Policy
[DRAFT — for legal review before publishing. Not legal advice.]
Last updated: [date]
This Privacy Policy explains how CoachLine collects, uses, and protects personal data, in accordance with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.
1. Data Controller
[Legal entity name, e.g. FEEKO Oy] [Business ID / Y-tunnus] [Registered address] [Contact email]
For personal data you (as a Coach or Club) enter about others (e.g. players, other coaches), you act as the Data Controller for that data, and CoachLine acts as a Data Processor — see our Terms of Service for details.
2. Contact for data protection matters
For questions about how your personal data is handled, or to exercise your rights, contact: [email address]
3. What personal data we collect
Depending on how you use CoachLine, we may collect:
- Account data: name, email address, city/country (optional), profile role (Coach/Club/Player)
- Authentication data: via email/password or Google sign-in
- Team and club data: team name, roster information, drills, practice plans, season plans
- Player data (entered by coaches): name, jersey number, position, birth date, status, notes, test results, feedback responses (feeling, performance, fatigue ratings, free-text notes)
- Task data: tasks and subtasks created within the Service
- Contact form submissions: name, email, club/team name, message
- Technical data: basic usage data necessary to operate and secure the Service (e.g. login timestamps, error logs)
We do not intentionally collect special categories of personal data (e.g. health data) beyond what a Coach chooses to enter as part of Player Notes or feedback features — Coaches should avoid entering sensitive health information beyond what is necessary for coaching purposes, and are responsible for the appropriateness of such entries under Section 5 of our Terms of Service.
4. How we use personal data
- To provide and operate the Service (account creation, team/club management, feedback collection, task tracking)
- To respond to enquiries submitted via our contact form
- To send transactional communications (e.g. invite emails, password resets) via our email service provider
- To generate AI-assisted content (e.g. practice plans) using the data you provide, via our AI service provider
- To maintain the security and integrity of the Service
We do not use personal data for advertising, and do not sell personal data to third parties.
5. Legal basis for processing
- Performance of a contract: processing necessary to provide the Service you've signed up for
- Legitimate interest: for basic security, fraud prevention, and service improvement
- Consent: where applicable (e.g. optional location field, marketing communications if introduced later)
- Where CoachLine processes Player data on behalf of a Coach/Club (as Data Processor), the Coach/Club is responsible for establishing their own legal basis for that data as Data Controller.
6. How long we retain personal data
- Account data is retained for as long as your account is active.
- You can request account deletion from Settings. We process deletion requests within 30 days, except where retention is required by law (e.g. billing records).
- [To be finalized: specific retention periods per data type, once determined.]
7. Who we share personal data with
We use the following sub-processors to operate the Service:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Europe region) |
| Resend | Transactional email delivery | [confirm data residency] |
| Anthropic | AI-assisted features (e.g. practice plan generation) | [confirm data residency — may involve transfer outside the EEA] |
| Vercel | Application hosting | [confirm data residency] |
Where any provider processes personal data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses), as required by GDPR.
[This table needs to be completed accurately based on each provider's actual data processing terms and hosting regions before publishing — data transfer compliance depends on getting this right.]
We do not sell or rent personal data to third parties for their own marketing purposes.
8. Your rights
Under GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate personal data
- Erasure ("right to be forgotten"), in certain circumstances
- Restrict or object to processing, in certain circumstances
- Withdraw consent, where processing is based on consent, at any time
- Data portability, where applicable
- Lodge a complaint with the Finnish Data Protection Ombudsman (tietosuojavaltuutetun toimisto) or your local supervisory authority
Erasure and data portability requests can be made directly from Settings in the app ("Delete my account" and "Download my data"). For anything else, or if you'd rather not use the in-app tools, contact us at [email address].
9. Children's data
CoachLine may be used by Coaches to enter information about players who are minors. Coaches and Clubs are responsible for ensuring appropriate parental/guardian consent has been obtained before entering a minor's personal data into the Service, in accordance with applicable law. Parents/guardians with questions about a minor's data in CoachLine should contact the relevant Coach or Club, who acts as the Data Controller for that data.
10. Security
We take reasonable technical and organisational measures to protect personal data, including encrypted data transmission, access controls limiting data visibility to authorized users (e.g. Row Level Security ensuring coaches only see their own team's data), and private-by-default handling of sensitive content such as player notes.
11. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated to users, and continued use of the Service after such changes constitutes acceptance.
12. Contact
[Legal entity name] [email address]