Datenschutzerklärung

This is an English translation of our privacy policy. In the event of any discrepancy, the French version prevails.

1. Data controller

The data controller for personal data collected through the CoachedBy platform is Sport'N Data, a French SARL with a share capital of €15,000, registered with the Nice Trade and Companies Register under SIREN number 938 617 974 (EU VAT number: FR00938617974), whose registered office is at 96 Corniche Fleurie, 06000 Nice, France.

Contact: contact@coachedby.io

2. Data we collect

When you use the Platform, we collect the following data:

• Identification data: user identifier, email address.
• Athlete profile: intensity thresholds (power, pace, heart rate), weight, maximum heart rate, level, weekly availability, training days, injury notes.
• Training plans: generated plans, scheduled sessions, change history.
• Conversation history: exchanges with the AI coaching chatbots.
• Coach methodology: methodology content provided by coaches during onboarding.
• Calendar entries: scheduled sessions, sporting events, synchronisation data.
• Direct messages: exchanges with coaches as part of supervised coaching (Coach in the Loop).
• Subscription data: coaching mode subscribed to, billing history, subscription status.
• Feedback: feedback and suggestions submitted through the feedback widget.
• OAuth tokens: authentication tokens used to connect training platforms — intervals.icu and Garmin (direct OAuth, through these platforms' official developer programs) and, through our processor Terra, other connected devices and platforms (WHOOP, Zwift, ROUVY, etc.).
• Performance data from connected platforms (intervals.icu, Garmin, WHOOP, Zwift, ROUVY, etc.): when the User connects an account, we synchronise the recorded activities and their second-by-second data streams (power, heart rate, cadence, altitude, GPS position), as well as derived daily metrics (training load, power curves, plan compliance scores). Depending on the connected platform, we also synchronise daily wellness data: sleep (duration and stages), heart rate variability (HRV), resting heart rate, stress level measured by the device, step count and weight. This information is treated as sports performance data and is used exclusively to compute training analyses and recovery scores, and as context provided to the coaching chatbots.
• Browsing and analytics data: IP address, browser type, pages viewed, usage events (via PostHog, hosted in the EU). For visitors who are not logged in, these events are collected anonymously; once the User is logged in, they are linked to their account identifier in order to measure engagement and improve the service.

Sign in with Google

When the User chooses to sign in with Google, Google shares with us, with the User's consent, the basic profile information covered by the openid, email and profile scopes: name, email address, profile picture and Google account identifier. We store only the email address and the Google account identifier, in our authentication service (Amazon Cognito, EU); the name and the profile picture are not stored.

• Use: solely to create the User's CoachedBy account and to sign them in. We do not access any other Google data or service (Gmail, Drive, Calendar, contacts, etc.).
• Sharing: Google user data is not shared with, sold to or transferred to any third party, is not used for advertising, profiling or creditworthiness decisions, and is not used to develop, improve or train artificial intelligence or machine learning models.
• Protection: encrypted in transit (TLS) and at rest, with access restricted to authorised personnel.
• Retention and deletion: kept for as long as the Account is active and deleted when the Account is closed — unless the same sign-in is also used for an active coach account (from the profile page or by writing to contact@coachedby.io). The User can also revoke CoachedBy's access at any time from their Google Account (myaccount.google.com/permissions).

CoachedBy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Purposes and legal basis

4. Recipients of the data

Personal data may be disclosed to the following recipients:

• Internal team: authorised members of Sport'N Data, for the management and improvement of the Services.
• The coach chosen by the User: by subscribing to a coach, the User agrees that this coach may view their training and wellness data (activities, training load, recovery, HRV, sleep), including data from connected devices, in order to supervise their training. This access ends with the subscription. The data is not disclosed to any other user.
• Amazon Web Services (AWS): data hosting in the eu-central-1 region (Frankfurt, Germany).
• Artificial intelligence models: conversations are processed and training metrics are analysed by AI models hosted in the European Union (Amazon Bedrock, AWS eu-central-1, Frankfurt), within CoachedBy's own infrastructure. Data from connected devices and platforms is never used to train artificial intelligence or machine learning models. The data sent to the models is pseudonymised: only an internal technical identifier is used, with no name, email address or any other information that directly identifies the User. No data is transferred outside the EU as part of this processing.
• intervals.icu: synchronisation of training plans and activities when the User connects their account (direct OAuth).
• Garmin: synchronisation of activities and wellness data, and delivery of planned workouts to the device, when the User connects their Garmin Connect account (direct OAuth, Garmin Connect Developer Program). Data received from Garmin is not sold, shared with or transferred to any third party; it is visible only to the User and to the coach they subscribe to.
• Terra API (Terra Enabling Developers, Inc., a Delaware corporation, United States, and its UK subsidiary Terra Enabling Developers Limited): aggregation processor used to connect third-party devices and platforms (WHOOP, Zwift, ROUVY, etc.). When the User connects a device, Terra receives the OAuth authorisation granted with the provider and sends us the corresponding activity and wellness data. The user reference sent to Terra is a pseudonymised internal technical identifier (no name or email address). Data is processed primarily in the United Kingdom, a country covered by a European Commission adequacy decision; transfers to the United States may occur and are governed by the European Commission's Standard Contractual Clauses (Article 46 GDPR).
• Google: authentication provider when the User chooses to sign in with Google (see « Sign in with Google » above). Google user data received by CoachedBy is not shared with any other recipient.
• Stripe: secure card payment processing, subscription management and payouts to coaches.
• PostHog (hosted in the EU): usage analytics to improve the Platform. Events are anonymous for visitors who are not logged in and linked to the account identifier after login. No third-party advertising tracking.

5. Retention periods

• Account data and athlete profile: retained for as long as the Account is active, then deleted within 30 days of the deletion request.
• Conversation history: retained for as long as the Account is active.
• Training plans: retained for as long as the Account is active.
• Performance data (activities, streams, derived metrics, wellness): retained for as long as the Account is active. Disconnecting a platform stops any further synchronisation but keeps the data already imported, which reappears if the platform is reconnected. Cancelling a subscription does not delete the Account: the data is kept so the User can resume their training follow-up, and the coach no longer has access to it. When the Account is deleted, all of this data, including the original activity files, is deleted within 30 days; no history is kept.
• Payment data: kept in the active database for the duration of the subscription. When the Account is deleted, only the billing data (name, email address, invoices, amounts) and the proof of acceptance of the terms of sale, including the waiver of the right of withdrawal, are kept, with our payment provider Stripe and with restricted access, for 10 years in accordance with legal accounting obligations (article L123-22 of the French Commercial Code).
• Messages sent to support (bug reports, suggestions): kept for as long as the Account is active, then deleted within 30 days of the Account's deletion.
• OAuth tokens: stored on our servers, encrypted (AWS KMS), never sent to the browser; revoked with the platform concerned as soon as the User disconnects it, and deleted when the Account is closed.

6. International transfers

All personal data is hosted and processed in the European Union (AWS eu-central-1, Frankfurt, Germany). The artificial intelligence models used by the Platform run on infrastructure located in the EU. No personal data is transferred outside the European Union as part of AI processing.

Some technical processors (Stripe, for payments; Terra, for device connections) may involve transfers to the United States, governed by Standard Contractual Clauses (SCCs) approved by the European Commission, in accordance with Article 46 of the GDPR.

7. Data security

The Publisher implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure, including:

• Encryption of data in transit (HTTPS/TLS) and at rest.
• Strict access control to databases.
• Access monitoring and logging.
• Hosting on certified infrastructure (AWS).

In the event of a personal data breach likely to result in a high risk to the rights and freedoms of the individuals concerned, the Publisher will notify the CNIL within 72 hours of becoming aware of it and will inform the affected Users without undue delay, in accordance with Articles 33 and 34 of the GDPR.

8. User rights

Under the General Data Protection Regulation (GDPR), you have the following rights over your personal data:

• Right of access: obtain confirmation that your data is being processed and receive a copy of it.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request the deletion of your data under the conditions set out in the GDPR.
• Right to data portability: receive your data in a structured, machine-readable format. You can exercise this right yourself from your profile page, using the data export feature (JSON format).
• Right to restriction: restrict the processing of your data in certain cases.
• Right to object: object to the processing of your data on legitimate grounds.
• Right to withdraw consent: withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise these rights, contact us at contact@coachedby.io.

You also have the right to lodge a complaint with the CNIL(Commission Nationale de l'Informatique et des Libertés, the French data protection authority):

• Address: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
• Website: www.cnil.fr

9. Cookies and usage analytics

The Platform distinguishes between two categories of trackers. No advertising cookies, and no third-party trackers for advertising purposes, are used.

Strictly necessary trackers — set without consent, because they are essential to a service you have requested: the user session (authentication), language preference, and the record of your cookie choice. None of them is used to track you.

Audience measurement — subject to your prior consent. Until you have accepted, no audience measurement tracker is set on or read from your device.

This audience measurement relies on PostHog(hosted in the European Union), using first-party cookies only, with no sharing with third parties, and respects the browser's Do Not Track (DNT) signal. Usage events are anonymous for visitors who are not logged in; once the User is logged in, they are linked to their account identifier in order to measure engagement and improve the service. This data is never sold, nor used for advertising purposes.

Changing or withdrawing your consent: the “Cookies” link in the footer — and, for logged-in Users, the “Cookies and tracking” card under Profile › Account — reopens the choice panel at any time. Withdrawing is as easy as accepting and takes effect immediately. Your choice is kept for 6 months, after which you are asked again.

Retention periods applied:

• Session cookies: duration of the browsing session.
• Preference cookies (language, interface settings): 6 months maximum.
• Record of your cookie choice: 6 months.
• PostHog analytics cookies: 13 months maximum, in line with the CNIL recommendation.
• Associated analytics data: 25 months maximum.

10. Links to third-party sites

The Platform may contain links to third-party sites (intervals.icu, etc.). The Publisher is not responsible for the privacy practices of those sites. We encourage you to read the privacy policy of each third-party site you visit.

11. Changes to this policy

This Privacy Policy may be amended at any time. Any change will be published on this page together with the date of the update. We encourage Users to consult this page regularly.

12. Contact

For any question about the protection of your personal data, you can contact us:

• By email: contact@coachedby.io
• By post: Sport'N Data, 96 Corniche Fleurie, 06000 Nice, France