Privacy Policy

2.1 Account information

• ·Email address (required to create an account, via Google OAuth)
• ·Google account display name and avatar (if you sign in with Google)
• ·A randomly generated user ID issued by our auth provider

2.2 Profile content (you publish this)

• ·Display name, headline, biography, location
• ·Coaching qualifications and badges
• ·Clubs, roles, and dates of employment
• ·Testimonials (which you confirm are genuine and consented to by the author)
• ·Resource links (videos, articles, social profiles)
• ·Slug — the URL fragment your page lives at
• ·Avatar image (if uploaded)

Profile content is published on a public URL. You control what you publish and can edit or delete it at any time.

2.3 Usage data

• ·Page views on your public CoachPage
• ·Login timestamps
• ·IP address (server logs, retained for 30 days for abuse and rate-limiting)
• ·Browser and device information (server logs)

2.4 Payment data

• ·Stripe customer ID
• ·Plan purchased (1-Year or Lifetime), purchase date, and renewal date if applicable

Full payment card details are processed and stored by Stripe. We never see or store them.

• ·Operate the Service — host your public profile, authenticate logins, take payments. Legal basis: contract.
• ·Service emails — receipts, plan-expiry warnings, billing issues. Legal basis: contract.
• ·Onboarding nudges — a short welcome sequence after signup. Legal basis: legitimate interest. You can opt out at any time.
• ·Prevent fraud and abuse. Legal basis: legitimate interest.
• ·Comply with legal and tax obligations. Legal basis: legal obligation.

• ·Supabase (USA / EU) — auth, database, file storage
• ·Stripe (USA / Ireland) — payment processing
• ·Resend (USA) — transactional and onboarding emails
• ·Hetzner (Germany) — application hosting
• ·Cloudflare (USA) — DNS and edge security (no personal-data caching)

Each provider processes data under their own privacy policy and under data-processing agreements with us.

We do not sell your personal data, and we do not use it for third-party advertising.

Some of our processors are based in the United States. Where personal data is transferred outside the UK / EEA, we rely on UK-approved Standard Contractual Clauses and the relevant data-protection frameworks. You can request more detail by emailing us.

• ·Account and profile data — until you delete your account
• ·Server access logs — 30 days
• ·Payment records — 7 years (UK accounting/tax law)
• ·Email send / unsubscribe records — kept indefinitely so we can honour your unsubscribe preference even if you re-sign-up

When you delete your account we remove your profile and account data within 30 days of the request. Some records are retained longer where required by law (e.g. payment records).

Under UK GDPR you have the right to:

• ·Access — request a copy of the data we hold on you
• ·Rectification — ask us to correct inaccurate data
• ·Erasure — ask us to delete your data ('right to be forgotten')
• ·Restrict processing — ask us to limit how we use your data
• ·Portability — receive your data in a machine-readable format
• ·Object — object to processing based on legitimate interests
• ·Withdraw consent — for any consent-based processing

You can exercise most of these rights yourself: edit your profile from the dashboard, export your data, or delete your account. For anything else, email admin@360tft.com and we will respond within one month.

You can also lodge a complaint with the Information Commissioner's Office:

• ·TLS / HTTPS in transit
• ·Encryption at rest in our database and file storage
• ·OAuth-based authentication (no passwords stored on our side)
• ·Server-side row-level access controls
• ·Restricted, audited access for staff

No system is 100% secure. If you suspect unauthorised access to your account, email us immediately.

In the event of a personal-data breach likely to result in a risk to your rights, we will notify the ICO within 72 hours of becoming aware, and will notify affected users without undue delay.

CoachPage uses only essential cookies — for authentication and session management. We do not use advertising cookies, and we do not load Google Analytics or any third-party analytics tracker on your public CoachPage.

CoachPage is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe we have, please contact us and we will delete it.

The content you publish on your CoachPage — name, photo, biography, qualifications, clubs, testimonials, links — is, by design, public. It can be indexed by search engines (paid plans only) and viewed by anyone with the URL.

Free accounts use a randomised, non-discoverable slug and are marked noindex so they will not appear in Google search results.

We may update this Privacy Policy. Material changes will be notified by email or in-app at least 30 days before they take effect.