Privacy Policy

1. Who we are

CoachReflection is operated by SVMS Consultancy Limited ("we", "our", "us"). This policy explains how we collect, use, share and protect your personal data, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

SVMS Consultancy Limited is the data controller for personal data processed through CoachReflection, on the web and in the iOS and Android apps.

2. What we collect

• Account information: name, email address and password
• Profile information: club name, coaching level and age group
• Your reflections, session notes and session plans, including anything you write in them
• Session plan images and other files you upload
• Your conversations with the AI coach, and the insights and drills it generates for you
• Memory the app builds from your reflections so it can refer back to them
• Club membership, if you join a club, and challenge participation
• Streaks, badges and progress statistics
• Referrals, if you refer someone or arrive through a referral
• Push notification subscriptions, if you turn notifications on
• API keys, if you create one to use CoachReflection from another tool
• Feedback and reports you send us
• Records of the emails we send you and whether they were delivered, opened or unsubscribed
• Payment data: your Stripe customer and subscription identifiers, plan, status and renewal dates. Card details are held by Stripe. We never see or store your full card number.
• Technical and usage data: IP address, browser and device information, pages and features used, session timestamps

Reflections are personal. Please avoid naming players, especially children, where a first name or initial would do. You do not need to identify anyone for the AI to give you a useful reflection.

3. Why we process it, and our legal basis

Where we rely on legitimate interest you have the right to object. See section 7.

4. AI processing

When you use an AI feature, the relevant reflection, session plan or image is sent to an AI provider to generate the analysis you asked for. In plain terms, the private things you write can leave our servers, so we name exactly where they go:

• Google is the primary provider. Your content is sent to the Gemini API, which also produces the numerical representations used to search your own past reflections.
• OpenAI is used as a fallback when the primary provider is unavailable.

We use their APIs on business terms, which do not permit your content to be used to train their models. AI output is generated automatically, with no human reviewing it first, and it can be wrong. We do not sell personal coaching data, and we do not share it with anyone for their advertising.

5. Who we share it with

• Supabase (USA): database, authentication and file storage
• Google (USA and Ireland): the Gemini API behind the AI features
• OpenAI (USA): fallback AI provider
• Stripe (USA): payment processing
• Resend (USA): email delivery, used by the 360TFT hub that sends our email
• Sentry (USA): server-side error monitoring
• Cloudflare (USA): content delivery, DNS and protection against attacks
• Hetzner Online GmbH (Germany): the servers the application runs on

If you join a club, its administrators can see the reflections and progress you choose to share with that club. Reflections you do not share stay private to you.

We may also disclose data where the law, a court order, or the defence of legal claims requires it. Signing up to CoachReflection does not sign you up to any unrelated 360TFT product mailing list.

International transfers. Several processors above are in the United States, so your data is transferred outside the UK. Those transfers rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on the UK extension to the EU-US Data Privacy Framework where the provider is certified under it.

6. How long we keep it

• Account data, reflections and uploads: until you delete them or close your account, then up to 30 days while they clear our backups
• AI conversations and generated insights: until you delete them or close your account
• Usage and analytics records: 12 months, then deleted or aggregated so they no longer identify you
• Email records: until you unsubscribe or ask for deletion. We keep a record of the unsubscribe so we do not email you again.
• Payment records: 7 years, as required by UK tax law
• Error diagnostics: 90 days

You can delete your account and everything in it at any time from Delete account, or by emailing us.

7. Your rights

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted
• Ask us to restrict how we use it
• Receive your data in a portable, machine-readable format
• Object to processing we base on legitimate interest
• Withdraw consent at any time, where we rely on consent
• Ask for human review of automated output

To exercise any of these, email [email protected]. We will respond within one month, and there is no charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office. We would rather you came to us first so we can put it right.

8. Security

• All traffic is encrypted in transit using TLS
• Data is encrypted at rest by our database provider
• Database and file access is restricted by row-level security policies, so one account cannot read another account's reflections
• API keys are stored hashed

No online system can promise absolute security. If you think your account has been compromised, email us straight away.

9. If something goes wrong

If there is a personal data breach likely to be a risk to your rights, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell you directly without undue delay where the risk to you is high.

10. Cookies

We use essential cookies for authentication and session management. We do not use tracking or advertising cookies, and we do not run advertising pixels.

11. Children

CoachReflection is built for coaches aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us their data, email us and we will delete it. Please keep identifying details about the players you coach out of your reflections.

12. Changes to this policy

We may update this policy from time to time and will move the date at the top. If a change materially affects your rights we will tell you by email or in the app before it takes effect.

13. Contact us

See also our Terms of Service.