Privacy Policy

1. Who we are

TrainerBuddy is a product of [COMPANY LEGAL NAME], a company registered in the Netherlands.

• KvK: [KVK NUMBER]
• BTW: [BTW NUMBER]
• Registered address: [BUSINESS ADDRESS]
• Privacy contact: privacy@trainerbuddy.app

When you use the TrainerBuddy platform as a trainer, you are our customer and we are the data controller for your account data. When you enter your clients' personal data into TrainerBuddy, you act as the data controller for that client data and TrainerBuddy acts as your data processor under Article 28 GDPR.

2. Data we collect

2.1 Trainer account data

When you create a TrainerBuddy account we collect:

• Full name and display name
• Email address
• Phone number (optional)
• Profile photo (optional)
• Business name (optional)
• Authentication identifiers (Apple ID or Google Sign-In subject identifier)

2.2 Client data entered by trainers

Trainers may enter their clients' personal data into TrainerBuddy. This data belongs to the trainer–client relationship and may include:

• Client names and contact details (email, phone)
• Session history (dates, duration, type, status)
• Coaching notes, which may include text, photos, video, or audio recordings uploaded by the trainer
• Health and fitness information voluntarily shared in notes

TrainerBuddy processes this data on behalf of the trainer (as data processor). Trainers are responsible for ensuring they have a lawful basis to enter and process their clients' data and for providing their clients with appropriate privacy notices.

2.3 Payment data

Subscription payments are processed by Stripe. TrainerBuddy does not store full card numbers, IBANs, or other sensitive payment instrument details. We store only:

• Stripe customer ID and subscription ID
• Safe display fields (last four digits of a card, payment method brand, billing country)
• Invoice and payment status records

2.4 Push notification tokens

If you enable push notifications, we store a device push token (issued by Apple or Google via Expo) linked to your account. We use this only to deliver notifications you have opted into.

2.5 Website lead form data

If you submit a contact or sign-up form on trainerbuddy.app, we collect your name, email address, and the content of your message. We use this to respond to your enquiry and may follow up about TrainerBuddy if you asked us to.

2.6 Technical and usage data

We collect standard server logs (IP address, device type, OS version, app version) for security monitoring and crash diagnostics. We do not use third-party advertising trackers.

3. Purposes and legal bases

4. Subprocessors

We use the following subprocessors to deliver the service. By using TrainerBuddy you acknowledge their involvement.

SCCs = Standard Contractual Clauses (EU Commission Implementing Decision 2021/914). Transfers to the USA are protected by SCCs or, where applicable, the EU–US Data Privacy Framework.

5. Data retention

• Active accounts: We retain your data for as long as your account is active.
• After account deletion: Account data is deleted within 30 days. Aggregate, anonymised analytics data may be retained indefinitely.
• Financial records: Payment and invoice records are retained for 7 years to comply with Dutch fiscal law (Belastingdienst).
• Client data: If a trainer deletes their account, all associated client data they entered is deleted within 30 days. Trainers may export or delete client data at any time via the app.
• Push tokens: Deleted immediately when you disable notifications or delete your account.
• Website lead form data: Retained for up to 24 months or until you ask us to delete it.

6. Your rights under GDPR

As a data subject you have the following rights. To exercise any of them, email privacy@trainerbuddy.app. We will respond within 30 days.

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17): Ask us to delete your personal data, subject to legal retention obligations.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format. In-app data export is also available under Profile → Export data.
• Right to object (Art. 21): Object to processing based on legitimate interest, including direct marketing.
• Right to restrict processing (Art. 18): Ask us to pause processing in certain circumstances.
• Right to lodge a complaint: You may lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

7. In-app account deletion

You can delete your TrainerBuddy account directly inside the app: go to Profile → Settings → Delete account. Deletion is permanent and initiates the 30-day data removal process described in Section 5. If you are unable to access the app, email privacy@trainerbuddy.app and we will process the deletion manually.

8. Trainer responsibilities as data controller

When you use TrainerBuddy to store and manage your clients' personal data, you are acting as the data controller for that data under GDPR. This means you are responsible for:

• Having a lawful basis (e.g. consent or legitimate interest) to collect and process your clients' data
• Providing your clients with a privacy notice that covers the use of TrainerBuddy as a tool
• Ensuring your clients' data is accurate and up to date
• Honouring any data subject requests your clients make to you
• Not entering sensitive special-category data (Art. 9 GDPR) without appropriate safeguards

TrainerBuddy provides the technical infrastructure and processes this data solely on your instructions. A Data Processing Agreement (DPA) is available on request at privacy@trainerbuddy.app.

9. Changes to this policy

We may update this policy from time to time. We will notify active users by email or in-app notification at least 14 days before material changes take effect. The "Last updated" date at the top of this page always reflects the most recent version.