Privacy Policy

FORCOACH (“FORCOACH”, “we”, “us”) provides a scheduling, earnings, and invoicing tool for independent fitness instructors who teach across multiple studios. This policy explains what information we collect through forcoach.io and the FORCOACH web application, how we use it, and the rights you have under the EU/French General Data Protection Regulation (GDPR) and French data protection law (Loi Informatique et Libertés).

1. Who operates FORCOACH (data controller)

FORCOACH is operated by a sole trader (entrepreneur individuel) registered in France under SIREN 104962998, which acts as the data controller for the personal data described in this policy. For any privacy question, to exercise your rights, or to request our full registered business details, contact contact@forcoach.io.

2. Information we collect

We collect information in the following ways:

• Account information you provide directly: name, email address, password (stored securely by our authentication provider, never in plain text), time zone, and currency preference.
• Studio and schedule data you enter yourself: studio names, contact details, compensation rates, and class/session details (title, date, time, location, notes).
• Schedule data you import, either by uploading a CSV file or by connecting a Google Calendar account (see Section 4 below for how Google data specifically is handled).
• Usage information collected automatically, such as log data needed to operate and secure the service (e.g. request timestamps, error logs). We do not use third-party advertising trackers or sell any data to advertisers.

3. Legal basis for processing (GDPR Article 6)

We process your personal data on the following legal bases:

• Performance of a contract: to create your account and provide the core FORCOACH service (scheduling, earnings, invoicing) you've signed up for.
• Consent: for optional features you explicitly opt into, such as connecting Google Calendar. You can withdraw this consent at any time by disconnecting the integration.
• Legitimate interest: to keep the service secure, prevent misuse, and maintain essential operational logs, balanced against your right to privacy.

4. Google Calendar data specifically

If you choose to connect Google Calendar, FORCOACH requests read-only access (https://www.googleapis.com/auth/calendar.readonly) to a calendar you select. We use this access solely to:

• List the calendars available in your Google account so you can choose which one to sync from.
• Read event details (title, start/end time, location, description) from the calendar you select, in order to create matching class entries inside FORCOACH.

FORCOACH's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We never write to, modify, or delete anything in your Google Calendar. Access is read-only.
• Google data is used exclusively to display and manage your class schedule inside FORCOACH. We do not use it for advertising, and we do not sell it or share it with any third party.
• We do not use Google user data to train generalized AI or machine learning models.
• You can disconnect Google Calendar at any time from the Calendar page inside the app, which stops future syncing. You can also fully revoke FORCOACH's access at any time from your Google Account permissions page.

5. How we use your information

• To provide, operate, and maintain the FORCOACH service.
• To calculate your hours, earnings, and generate invoices based on the schedule and studio data you provide.
• To communicate with you about your account, such as password resets or important service notices.
• To keep the service secure and prevent misuse.

6. Where your data is stored and international transfers

Your account and application data is stored with Supabase, our database and authentication provider, over encrypted connections. Emails (such as password resets) are sent via our transactional email provider. These providers act as our data processors and only handle data as needed to operate FORCOACH.

As FORCOACH grows, our hosting infrastructure may change, including a potential move to servers we manage directly. If any future change involves transferring data outside the EU/EEA, we'll update this policy to name the specific safeguard relied on for that transfer, such as the European Commission's Standard Contractual Clauses, before that change takes effect.

7. Security measures and data protection mechanisms

We apply the following technical and organizational measures to protect your personal data, including sensitive data such as your Google Calendar schedule details and financial information used to calculate earnings and invoices:

• Encryption in transit: all traffic between your browser, the FORCOACH application, and our backend is encrypted using HTTPS/TLS. We do not transmit personal data over unencrypted connections.
• Encryption at rest: your account and application data is stored in Supabase, which encrypts data at rest at the infrastructure level.
• Access controls: our database enforces row-level security so that each account can only read or write its own data — one coach can never query another coach's schedule, earnings, or invoices, even in the event of an application bug. Internal access to production data is restricted to what is strictly necessary to operate and support the service.
• Authentication security: passwords are hashed by our authentication provider and are never stored or logged in plain text. Sessions use short-lived, signed tokens.
• Minimal third-party access: the Google Calendar integration requests read-only access to a single calendar you choose, and OAuth tokens are stored encrypted and used only for the syncing described in Section 4.
• Data minimization: we only collect the data described in Section 2 and do not request access beyond what FORCOACH's features require.

If we become aware of a data breach affecting your personal data, we will notify affected users and, where required, the CNIL, in line with our obligations under the GDPR.

8. Data retention and deletion

We retain your account and schedule data for as long as your account is active. If you'd like your account and associated data deleted, contact us at contact@forcoach.io and we will delete it, other than records we're legally required to keep.

9. Cookies

FORCOACH uses only the essential cookies needed to keep you signed in and to remember basic preferences. We do not use third-party advertising or tracking cookies, and because these cookies are strictly necessary for the service to function, they do not require separate consent under the ePrivacy Directive.

10. Your rights

Under the GDPR and French data protection law, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Eraseyour data (“right to be forgotten”), subject to any legal retention requirements.
• Restrict or object to certain processing of your data.
• Port your data to another service in a structured, commonly used format.
• Withdraw consent at any time, for processing based on consent (such as the Google Calendar connection), without affecting the lawfulness of processing before withdrawal.
• Lodge a complaintwith France's data protection authority, the CNIL (Commission Nationale de l'Informatique et des Libertés), if you believe your data protection rights have been violated.

To exercise any of these rights, contact us at contact@forcoach.io. We'll respond within the timeframe required by applicable law.

11. Children's privacy

FORCOACH is intended for use by adults operating a coaching business and is not directed at children. We do not knowingly collect information from children.

12. Changes to this policy

We may update this policy as FORCOACH evolves. If we make material changes, we'll update the “Last updated” date above and, where appropriate, notify you directly.

13. Contact us

Questions about this policy or your data? Email us at contact@forcoach.io.