Privacy Policy

Last updated: [EFFECTIVE DATE]

This is a starting template, not legal advice. Have it reviewed by a lawyer for your jurisdiction before launch, and replace every bracketed placeholder (and the values in src/config.ts → LEGAL).

This policy explains what personal information Kota Physique Coaching (“we”, “us”), operated by [LEGAL ENTITY NAME], collects when you use this website and the client portal, how we use it, and the choices you have. By creating an account or submitting the application form you agree to this policy.

Information we collect

Directly from you:

Account details: your name and email address. If you set a password we store only a one-way hash of it, never the password itself.
Coaching application: the goals, training history, and any other details you enter in the enquiry form.
Client content: progress photos, physique and form-check videos, voice notes, and any documents or messages you upload or send through the portal. These can include images of your body and information about your health, training, and nutrition.
Payment information: handled entirely by Stripe. We receive a customer identifier and your subscription status; we never see or store your card number.

Automatically:

Technical data: IP address, browser type, and request logs, used for security and to keep the service running.
Cookies and local storage: see Cookies below.

How we use your information

To provide coaching: build and adjust your programs, review your check-ins, and communicate with you.
To create and secure your account and authenticate sign-in.
To process payments and manage your subscription (via Stripe).
To send service email: sign-in links, application replies, and notifications about new messages. These are transactional, not marketing.
To detect, prevent, and investigate abuse or security incidents.
To comply with legal obligations.

We do not sell your personal information, and we do not use your photos, videos, or health information for advertising or to train machine-learning models.

Where your data is stored and who processes it

We use a small number of service providers (“sub-processors”) to run the service. Each only receives what it needs for its function:

Railway: application hosting and the PostgreSQL database (account data, profiles, messages, subscription status).
Cloudflare R2: private object storage for all uploaded media. Files are not publicly accessible; the portal serves them through short-lived signed links.
Stripe: payment processing and card storage. See the Stripe Privacy Policy.
Resend: delivery of transactional email.

Some of these providers may process data on servers outside your country, including in the United States.

Data retention

We keep your account and content while your account is active. You can delete individual photos, videos, and files from the portal at any time; deletion removes the file from storage. When your coaching ends you may ask us to close your account, and we will delete your content and profile within 30 days, except where we must retain limited records (for example, payment and invoice records) to meet legal or accounting obligations.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise any of these, email us at privacy@example.com. We will respond within the time required by applicable law. You may also have the right to complain to your local data protection authority.

Cookies and local storage

Session cookie: set when you sign in, to keep you logged in. The site does not work without it. It is not used for tracking.
Local storage: small preferences kept in your browser (such as an unsent message draft or a remembered tab). This never leaves your device.

We do not use third-party advertising or analytics cookies.

Security

Data is encrypted in transit. Media storage is private and access-scoped, passwords are hashed, and payment card data never touches our servers. No system is perfectly secure, but we take reasonable measures to protect your information and will notify you of a breach affecting your data as required by law.

Children

This service is for adults. It is not directed to anyone under 18, and we do not knowingly collect information from them.

Changes to this policy

We may update this policy. If we make a material change we will update the “last updated” date and, where appropriate, notify you by email or in the portal.

Contact

Questions about this policy or your data: privacy@example.com, or by post at [BUSINESS ADDRESS].