Privacy Policy

Last updated: {{DATE — set when this policy is actually published}}

1. Who we are

CoachLens is operated by {{Legal Company Name}}, {{registered address}} ("we", "us", "our"). We're the data controller for the personal data described in this policy. For any privacy question or to exercise the rights in §9, contact {{privacy@coachlens.ie}}.

2. What we collect

Account data: name, email, hashed password (we never store your password in plain text), role (player/coach/scout/club admin), region.
Player data: sports played, position, bio markers you enter (sprint times, vertical jump, etc.), and — for a player under 18 — a parent or guardian's name, email and phone number.
Uploaded content: training/game videos, and any images you upload (e.g. an avatar).
AI-generated data: skill ratings, written feedback, and (optionally) movement/pose analysis derived from your uploaded videos.
Team & club data: academies, teams, coach assignments, and roster information, as entered by coaches and club admins.
Communications: session feedback, notes, and messages exchanged through the Service (e.g. coach notes, coach-request messages).
Technical data: IP address (used only for rate-limiting/abuse prevention and basic error diagnostics — see §7), and the one session cookie described in §8.

3. How we use it

To provide the Service — run your account, generate AI feedback, manage rosters/teams, and show you your own data and reports.
To send transactional email (password resets, parent-approval requests, notifications) via our email provider, Resend.
To enforce our Terms of Service and keep the Service secure (rate limiting, error monitoring).
To comply with legal obligations, and to establish, exercise or defend legal claims.

We do not sell your personal data, and we do not use it for third-party advertising.

4. Legal basis for processing (GDPR)

Contract: processing needed to provide the account and features you sign up for.
Consent: for a minor's data (see §5) and for optional features like AI movement analysis.
Legitimate interests: security, abuse prevention, and improving the Service — balanced against your rights, and never for a minor's data without the additional protections in §5.
Legal obligation: where we're required to keep or disclose data by law.

5. Children's privacy and parental consent

CoachLens is built for grassroots sport, which means many of our players are under 18. We take that seriously:

A player account for someone under 18 requires a parent or guardian's contact details on file. Before any coach can add that player to their squad, we email the parent/guardian a link to explicitly approve or decline the request — a coach cannot connect to a minor without that approval.
Alternatively, a parent or guardian can create and fully control a "managed" child profile themselves through their own account — the child's data is only ever entered and managed by the parent/guardian, not by the child directly.
We do not knowingly collect personal data from a child below {{minimum age — confirm with counsel}} without verified parental consent, and we do not knowingly allow a child below that age to hold an account independent of a parent or guardian.
A parent or guardian can review, correct, or request deletion of their child's data at any time by contacting us at the email in §1 — this applies whether the child has their own account (with a parent/guardian email on file) or a fully managed profile.

{{Legal review needed: GDPR sets the default digital-consent age at 16, but EU member states can lower it to as low as 13 — Ireland's Data Protection Act 2018 sets it at 16. Confirm which age threshold applies to your actual user base and that the account flows above satisfy it (e.g. whether the parent-approval email flow itself counts as verifiable parental consent, or whether a stronger verification step is needed) before launch.}}

6. Video processing and where your data goes

When you upload a video, it's sent to our AI processing partners to generate your report:

Replicate / Google Gemini — analyses the video and generates skill ratings and written feedback.
Roboflow (optional feature) — if you tag a person in a clip, their movement is tracked using a pose-estimation model to power the movement-analysis feature.

These providers may process data outside the European Economic Area (e.g. in the United States). Where that happens, we rely on appropriate safeguards (such as Standard Contractual Clauses) to protect your data.

{{Legal review needed: confirm and document the actual transfer mechanism/DPA in place with each processor (Replicate, Roboflow, Resend, Railway, Google) before launch.}}

7. How long we keep your data

Raw video files are automatically deleted 90 days after upload. Your AI report, skill scores, and everything derived from the video stay available — just without the original clip to replay.
Account and profile data is kept until you (or, for a minor, their parent/guardian) ask us to delete it, or your account is removed by an administrator.
Error/security logs are retained only as long as needed to investigate and resolve issues.

8. Cookies

Strictly necessary. CoachLens uses a session cookie that keeps you logged in (aicoach_session). It's set to httpOnly (not readable by page scripts) and secure in production. It's needed for the service to work, so it doesn't require consent.

Analytics (optional). We only use analytics cookies or similar technologies if you choose "Accept all" (or switch Analytics on under "Customise") in the cookie banner. They're off by default, and we don't use advertising cookies.

Your choice. We remember your choice in your browser's local storage (key coachlens_cookie_consent). You can change or withdraw it at any time with the "Cookie settings" link in the site footer. If you sign in with Google, Google sets its own cookies under its own policy.

9. Your rights

If you're in the EEA/UK (or a similar regime applies to you), you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Request deletion of your data ("right to be forgotten").
Restrict or object to certain processing.
Receive your data in a portable format.
Lodge a complaint with your local data protection authority — in Ireland, the Data Protection Commission (dataprotection.ie).

To exercise any of these, contact us at the email in §1. A parent or guardian can exercise these rights on behalf of a minor they're responsible for.

10. Security

Passwords are hashed (never stored in plain text). Traffic to the Service is encrypted in transit (HTTPS). Session cookies are httpOnly and, in production, marked secure. No system is perfectly secure, and we can't guarantee absolute security of data you transmit to us.

11. Changes to this policy

We may update this policy from time to time. If we make a material change, we'll let you know (e.g. by email or an in-app notice) before it takes effect.

12. Contact

Questions about this policy, or a request under §9? Email {{privacy@coachlens.ie}}. See also our Terms of Service.