Section 1 Data controller

The controller of your personal data is Fortnight AI LTD, a company registered in the United Kingdom under number 17085717, operating under the Coachlog brand. Contact for data protection matters: support@coachlog.app As an entity based outside the EU but providing services to users in the EU, we comply with the General Data Protection Regulation (GDPR) and UK GDPR.

Section 2 What data we process

Account data: email address, first name, last name, profile photo, interface language, time zone. Subscription data: plan status (Free/Pro), period start date, usage limits (recording minutes, number of reports). Training data: team names, player data (name, number, position, age categories), voice notes, transcripts, AI analyses, statistics, PDF reports. Technical data: IP address, device identifier, browser type, error logs (Sentry), analytics events (PostHog - anonymized). Payment data: handled by Paddle.com Market Ltd. Coachlog does not store card numbers or CVV data. We receive only a transaction token and subscription status.

Section 3 Purposes and legal bases for processing

Providing the service (Article 6(1)(b) GDPR): account creation, app access, recording storage, AI analysis generation, invoice handling. Financial settlements (Article 6(1)(c) GDPR): tax and accounting obligations of the Operator and Paddle.com Market Ltd as Merchant of Record. Own marketing and customer support (Article 6(1)(f) GDPR): transactional emails (registration confirmation, password reset, notifications), account reactivation, satisfaction research. Security and abuse detection (Article 6(1)(f) GDPR): access logs, rate limiting, detection of suspicious behavior.

Section 4 Data sub-processors

To provide Coachlog services, we use the following trusted providers (sub-processors) with whom we have Data Processing Agreements (DPAs): * Supabase Inc. (USA, database and authentication hosting, eu-central-1 region for EU data) - DPA + Standard Contractual Clauses * Paddle.com Market Ltd (UK, Merchant of Record for web payments) - DPA + UK adequacy decision * OpenAI Inc. (USA, AI transcript analysis) - DPA + SCC * Anthropic PBC (USA, AI Chat Assistant) - DPA + SCC * Deepgram Inc. (USA, audio transcription) - DPA + SCC * Resend (USA, transactional email delivery) - DPA + SCC * Sentry (USA, application error monitoring) - DPA + SCC, anonymized data * PostHog Inc. (USA, product analytics) - DPA + SCC, aggregated data * Apple Inc. / Google LLC (App Store / Google Play - only for mobile users) The full list of sub-processors is available on request at support@coachlog.app.

Section 5 Data retention period

Account and training data: for the entire period while the account is active + 30 days after deletion (security period, recovery option). Billing data: 5 years from the end of the calendar year in which the transaction occurred (UK / EU accounting obligation). Error logs (Sentry): 90 days. Analytics data (PostHog): 13 months (aggregated, without the ability to identify an individual user).

Section 6 Your rights (GDPR / UK GDPR)

You have the full right to: access your data (Article 15), rectification (Article 16), erasure (right to be forgotten - Article 17), restriction of processing (Article 18), data portability (Article 20), and objection to processing (Article 21). Data export: a full JSON export is available in Account settings -> Data & privacy -> Download my data (includes profile, teams, players, notes, transcripts, analyses; it does not include audio files due to size). Account deletion: available in Account settings -> Danger zone -> Delete account. This operation is irreversible, cancels active subscriptions, and deletes all data within 30 days. Complaint to a supervisory authority: users in Poland may file a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl). Users in other EU countries may contact their national authority. UK users may contact the ICO (www.ico.org.uk).

Section 7 Cookies and tracking

Coachlog uses only essential cookies (session, authentication, language preferences). We do not use marketing cookies or third-party tracking cookies. Product analytics (PostHog) runs server-side in aggregated form. You can disable analytics in Account settings -> Data & privacy -> Analytics opt-out (stored in the `analytics_optout=1` cookie).

Section 8 Data security

All data is encrypted in transit (TLS 1.3) and at rest (AES-256, Supabase Postgres + AWS S3). Database access is restricted by Row Level Security (RLS) - each user can see only their own data. Authorization: hashed passwords (bcrypt), optional MFA, JWT sessions with a 1-hour TTL and automatic refresh. Audio files are stored in private AWS S3 buckets - access is available only through short-lived (5 minute) Signed URLs. The application is in the process of SOC 2 Type II certification (planned completion in Q3 2026).

Section 9 International data transfers

Some data may be transferred outside the European Economic Area (EEA), in particular to the USA (sub-processors: Supabase, OpenAI, Anthropic, Deepgram, Resend, Sentry, PostHog). Transfers are based on Standard Contractual Clauses (SCCs) approved by the European Commission, combined with additional technical measures (end-to-end encryption). UK - adequacy decision recognizing the UK level of protection as equivalent to the EU (June 2021).

Section 10 Changes to this privacy policy

We will notify you by email 30 days in advance about material changes (for example new sub-processors or new processing purposes). Minor editorial changes are published without notice with an updated Last updated date at the top of this page.