Privacy Policy

This Privacy Policy explains how Core Padel Workout ("we", "us", or "our") collects, uses, shares, and protects personal data when you use our website and training platform (the "Service").

1. Data controller

Core Padel Workout is the data controller for personal data processed through the Service. Contact us at hello@corepadel.app for privacy questions or requests.

2. Personal data we collect

Depending on how you use the Service, we may collect:

• Account data: name, email address, password hash, and profile details you provide during signup or onboarding.
• Training preferences: training environment, equipment, goals, and related onboarding answers used to personalise programs.
• Usage and progress data: programs started, sessions completed, workout start and completion times, and interactions with program content.
• Subscription and billing data: subscription status, plan details, and payment references processed through Stripe. We do not store full payment card numbers.
• Communications: messages you send us and emails we send you, such as account verification, password reset, and service updates.
• Technical data: IP address, browser type, device information, and cookies or similar technologies needed to operate and secure the Service.

3. How we use your data

We use personal data to:

• Create and manage your account.
• Provide access to programs, workouts, and member features.
• Track training progress and show your activity history.
• Process subscriptions and payments.
• Send service-related emails and respond to support requests.
• Improve the Service, fix bugs, and maintain security.
• Comply with legal obligations and enforce our Terms.

4. Legal bases for processing (EEA/UK users)

Where GDPR or similar laws apply, we rely on:

• Contract: to provide the Service you signed up for, including program access and billing.
• Legitimate interests: to secure the platform, prevent abuse, and improve our products, balanced against your rights.
• Consent: where required for optional marketing communications or non-essential cookies.
• Legal obligation: where we must retain or disclose data to comply with law.

5. How we share data

We do not sell your personal data. We may share data with trusted service providers who help us operate the Service, such as:

• Supabase for authentication, database hosting, and file storage.
• Stripe for subscription billing and payment processing.
• Email providers such as Resend for transactional email delivery.
• Infrastructure and analytics providers that help us host, monitor, and improve the Service.

These providers process data on our instructions and under appropriate contractual safeguards. We may also disclose data if required by law, court order, or to protect our rights, users, or the public.

6. International transfers

Your data may be processed in countries outside your own, including within the European Economic Area and by providers in other regions. Where required, we use appropriate safeguards such as standard contractual clauses or equivalent mechanisms.

7. Cookies and similar technologies

We use essential cookies and local storage to keep you signed in, remember preferences, and protect the Service. We may also use analytics or performance tools to understand how the platform is used. You can control non-essential cookies through your browser settings, but some features may not work correctly if essential cookies are disabled.

8. Data retention

We keep personal data only as long as needed for the purposes described in this policy, including while your account is active and for a reasonable period afterward for backups, legal compliance, and dispute resolution. Training progress and subscription records may be retained according to operational and accounting requirements.

9. Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data, subject to legal exceptions.
• Restrict or object to certain processing.
• Request data portability where applicable.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise these rights, email hello@corepadel.app. We may need to verify your identity before responding.

10. Children

The Service is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

11. Security

We use technical and organisational measures designed to protect personal data, including access controls, encrypted connections, and secure hosting. No online service can be guaranteed completely secure, so please use a strong password and keep your credentials private.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the "Last updated" date. Material changes may also be communicated by email or in-product notice where appropriate.

13. Contact

For privacy questions or requests, contact hello@corepadel.app.