Privacy Policy
Last updated: 12 June 2026
Important: This policy has not yet been reviewed by a qualified lawyer. Have your legal counsel review it before relying on it — in particular whether Configrity Limited, as a UK-established controller offering the service to people in the EU, needs to appoint an EU representative under Article 27 GDPR, and whether both UK GDPR and EU GDPR apply to the processing described here.
1. Who we are
TrainerBuddy is a product of Configrity Limited, a company registered in England and Wales.
- Company number: 17237907
- Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
- Privacy contact: privacy@trainerbuddy.app
When you use the TrainerBuddy platform as a trainer, you are our customer and we are the data controller for your account data. When you enter your clients' personal data into TrainerBuddy, you act as the data controller for that client data and TrainerBuddy acts as your data processor under Article 28 GDPR.
2. Data we collect
2.1 Trainer account data
When you create a TrainerBuddy account we collect:
- Full name and display name
- Email address
- Phone number (optional)
- Profile photo (optional)
- Business name (optional)
- Authentication identifiers (Apple ID or Google Sign-In subject identifier)
2.2 Client data entered by trainers
Trainers may enter their clients' personal data into TrainerBuddy. This data belongs to the trainer–client relationship and may include:
- Client names and contact details (email, phone)
- Session history (dates, duration, type, status)
- Coaching notes, which may include text, photos, video, or audio recordings uploaded by the trainer
- Health and fitness information voluntarily shared in notes
- Progress data (body measurements and progress photos) recorded by the trainer or the client; clients can delete their own progress entries at any time
TrainerBuddy processes this data on behalf of the trainer (as data processor). Trainers are responsible for ensuring they have a lawful basis to enter and process their clients' data and for providing their clients with appropriate privacy notices.
2.3 Payment data
Subscription payments are processed by Stripe. TrainerBuddy does not store full card numbers, IBANs, or other sensitive payment instrument details. We store only:
- Stripe customer ID and subscription ID
- Safe display fields (last four digits of a card, payment method brand, billing country)
- Invoice and payment status records
2.4 Push notification tokens
If you enable push notifications, we store a device push token (issued by Apple or Google via Expo) linked to your account. We use this only to deliver notifications you have opted into.
2.5 Website lead form data
If you submit a contact or sign-up form on trainerbuddy.app, we collect your name, email address, and the content of your message. We use this to respond to your enquiry and may follow up about TrainerBuddy if you asked us to.
2.6 Technical and usage data
We collect standard server logs (IP address, device type, OS version, app version) for security monitoring and crash diagnostics. We do not use third-party advertising trackers.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the TrainerBuddy service | Art. 6(1)(b) — performance of a contract |
| Processing subscription payments via Stripe | Art. 6(1)(b) — performance of a contract |
| Sending transactional notifications (session reminders, payment receipts) | Art. 6(1)(b) — performance of a contract |
| Responding to support and contact requests | Art. 6(1)(f) — legitimate interest |
| Security monitoring and abuse prevention | Art. 6(1)(f) — legitimate interest |
| Compliance with legal obligations (e.g. tax records) | Art. 6(1)(c) — legal obligation |
| Marketing communications (where opted in) | Art. 6(1)(a) — consent |
4. Subprocessors
We use the following subprocessors to deliver the service. By using TrainerBuddy you acknowledge their involvement.
| Subprocessor | Role | Location |
|---|---|---|
| Supabase | Database hosting and authentication | EU (AWS Frankfurt) |
| Stripe | Payment processing | USA / EU (SCCs apply) |
| Expo (Expo Application Services) | Push notification delivery | USA (SCCs apply) |
| Apple | Sign in with Apple, APNs push delivery | USA (SCCs apply) |
| Sign in with Google, FCM push delivery | USA (SCCs apply) |
SCCs = Standard Contractual Clauses (EU Commission Implementing Decision 2021/914). Transfers to the USA are protected by SCCs or, where applicable, the EU–US Data Privacy Framework.
5. Data retention
- Active accounts: We retain your data for as long as your account is active.
- After account deletion: Account data is deleted within 30 days. Aggregate, anonymised analytics data may be retained indefinitely.
- Financial records: Payment and invoice records are retained for 6 years to comply with UK tax and company law (HMRC and the Companies Act 2006).
- Client data: If a trainer deletes their account, all associated client data they entered is deleted within 30 days. Trainers may export or delete client data at any time via the app.
- Push tokens: Deleted immediately when you disable notifications or delete your account.
- Website lead form data: Retained for up to 24 months or until you ask us to delete it.
6. Your rights under GDPR
As a data subject you have the following rights. To exercise any of them, email privacy@trainerbuddy.app. We will respond within 30 days.
- Right of access (Art. 15): Request a copy of the personal data we hold about you.
- Right to rectification (Art. 16): Ask us to correct inaccurate or incomplete data.
- Right to erasure (Art. 17): Ask us to delete your personal data, subject to legal retention obligations.
- Right to data portability (Art. 20): Receive your data in a structured, machine-readable format. In-app data export is also available under Profile → Export data.
- Right to object (Art. 21): Object to processing based on legitimate interest, including direct marketing.
- Right to restrict processing (Art. 18): Ask us to pause processing in certain circumstances.
- Right to lodge a complaint: We are established in the United Kingdom, so you may complain to the UK Information Commissioner's Office (ico.org.uk). If you are in the EU or EEA, you may instead complain to the supervisory authority where you live — in the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
7. In-app account deletion
You can delete your TrainerBuddy account directly inside the app: go to Profile → Settings → Delete account. Deletion is permanent and initiates the 30-day data removal process described in Section 5. If you are unable to access the app, email privacy@trainerbuddy.app and we will process the deletion manually.
8. Trainer responsibilities as data controller
When you use TrainerBuddy to store and manage your clients' personal data, you are acting as the data controller for that data under GDPR. This means you are responsible for:
- Having a lawful basis (e.g. consent or legitimate interest) to collect and process your clients' data
- Providing your clients with a privacy notice that covers the use of TrainerBuddy as a tool
- Ensuring your clients' data is accurate and up to date
- Honouring any data subject requests your clients make to you
- Not entering sensitive special-category data (Art. 9 GDPR) without appropriate safeguards
TrainerBuddy provides the technical infrastructure and processes this data solely on your instructions. A Data Processing Agreement (DPA) is available on request at privacy@trainerbuddy.app.
9. Changes to this policy
We may update this policy from time to time. We will notify active users by email or in-app notification at least 14 days before material changes take effect. The "Last updated" date at the top of this page always reflects the most recent version.