Privacy Policy

Last updated: 6 February 2026

Coachalyze Ltd (company number SC874953, registered at 104 Ferry Road, Edinburgh, Scotland, EH6 4PG) ("Coachalyze", "we", "us", "our") is committed to protecting the privacy of all users, including coaches, parents, and child athletes. This policy explains how we collect, use, store, and share personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information We Collect

1a. Coach and Parent Data

• Account information (full name, email address, phone number)
• Organisation details (club name, sport, branding)
• Payment and billing information (processed securely through Stripe; we do not store card numbers)
• Coach accreditation details (certificates, qualifications)
• Login credentials and authentication data

1b. Child Athlete Data

Child athlete data is entered and managed by authorised coaches or parents, not collected directly from children. This data may include:

• Name, date of birth, and age group
• Position and team assignment
• Training session ratings and attendance records
• Game performance ratings and statistics
• Coach-written development notes and session feedback
• AI-generated development reports (based on anonymised data)
• Growth and measurement data (height, weight) where recorded by coaches
• Photographs (avatar/profile images uploaded by coaches or parents)
• Lifestyle data submitted by parents (sleep, nutrition, wellbeing)

2. How We Use Your Information

We use collected information to:

• Provide and maintain the Coachalyze coaching platform
• Track player development and generate progress reports
• Generate AI-powered development insights using anonymised performance data
• Send performance alerts and updates to coaches
• Share progress reports with parents (when authorised by coaches)
• Process subscription payments and manage billing
• Communicate service updates and important notices
• Improve our services and develop new features

3. Lawful Basis for Processing

Under UK GDPR, we process personal data on the following lawful bases:

• Contract: Processing necessary to deliver the Coachalyze service to coaches and organisations (Article 6(1)(b))
• Consent: Parental consent for the processing of child athlete data, including AI-generated reports (Article 6(1)(a)). This consent can be withdrawn at any time
• Legitimate interests: Improving our platform, preventing fraud, and ensuring platform security (Article 6(1)(f))
• Legal obligation: Where we are required to retain data for tax, billing, or regulatory purposes (Article 6(1)(c))

4. Data Sharing and Sub-Processors

Your data is protected and only shared with the following trusted service providers who are contractually bound to protect your data:

Within the platform, data is shared as follows:

• Club administrators can view data for all coaches and players within their organisation
• Coaches can view and manage data for players in their teams
• Parents can view their own linked children's data, reports, and ratings
• Data may be disclosed when required by law or to protect our legal rights

5. International Data Transfers

Some of our sub-processors are based in the United States. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO) and the UK International Data Transfer Agreement (IDTA). Importantly, player names are never sent to our AI provider (Anthropic) — only anonymised performance ratings are transmitted.

6. Data Security

We implement industry-standard security measures including TLS encryption in transit, AES-256 encryption at rest, row-level security policies (ensuring users can only access their own data), secure authentication via Supabase Auth, and regular security reviews. However, no method of transmission over the Internet is 100% secure.

7. Children's Privacy

Coachalyze takes the privacy of child athletes very seriously. Key protections include:

• No direct collection from children: All child data is entered by authorised coaches or parents. Children do not create accounts or interact with the platform directly
• Parental consent: When parents are invited to the platform, we require explicit consent for data collection, AI processing, and coach data sharing before access is granted
• AI anonymisation: Player names are never sent to our AI provider. Only anonymised performance metrics are transmitted for report generation. The player's first name is re-inserted into the report locally after generation
• No behavioural advertising: We do not use child data for advertising, profiling, or marketing purposes. There are no third-party advertising trackers on our platform
• No sale of data: We never sell, rent, or trade child athlete data to any third party
• Minimal data collection: We only collect data that is necessary for the coaching and player development purpose of the platform
• UK Age Appropriate Design Code: We design our services with children's best interests in mind, consistent with the ICO's Children's Code
• Right to withdraw: Parents can withdraw consent at any time by contacting privacy@coachalyze.com. Upon withdrawal, the child's data will be removed from AI processing and parent access revoked

8. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you or your child
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data (subject to legal retention requirements)
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent for data processing at any time without affecting the lawfulness of prior processing
• Rights related to automated decision-making: AI-generated reports are provided as coaching aids only and are always reviewed by coaches before being shared. No automated decisions with legal or significant effects are made

To exercise any of these rights, contact us at privacy@coachalyze.com. We will respond within one month as required by UK GDPR.

9. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Player development data may be retained for historical analysis unless deletion is requested. Upon account deletion, personal data is removed within 30 days, except where retention is required for legal, tax, or regulatory purposes.

10. Cookies and Analytics

Coachalyze uses essential cookies for authentication and session management. We do not use third-party advertising or tracking cookies. Error monitoring is performed by Sentry using technical data only (no personal information).

11. Updates to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or through the platform at least 30 days before they take effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at privacy@coachalyze.com

Coachalyze Ltd
Company number: SC874953
104 Ferry Road, Edinburgh, Scotland, EH6 4PG