CoachOS Privacy Policy

Last updated: 2026-06-22

This Privacy Policy explains how Beka Kokoladze ("CoachOS", "we", "us") collects, uses, shares, and protects personal data when you use the CoachOS mobile application (the "App") and the website at https://coachos-ai.com (the "Site", together the "Services").

We are the controller of the personal data described in this policy, except where we act as a processor on behalf of coaches for the data they enter about their own clients — see Section 9.

If you have any questions or wish to exercise your rights, contact us at privacy@coachos.app.

1. Who we are

We have not appointed a statutory Data Protection Officer because we are not required to; all privacy matters are handled at privacy@coachos.app.

2. A quick summary

• CoachOS is a hands‑free assistant for coaches and trainers. You speak commands; we transcribe,

understand, and act on them (log sessions, manage clients, schedule events, track payments).

• To do this we process your voice audio, your account details, and the **client and

business data you enter**.

• We do not sell your personal data and we **do not use it for cross‑app advertising or

tracking**.

• We use a small set of trusted sub‑processors (e.g. Deepgram, Anthropic, OpenAI, ElevenLabs,

Supabase, RevenueCat) to deliver the service. The full list is at Section 8 and in https://coachos-ai.com/sub-processors.

• You can export or delete your data at any time from Settings → Data & Privacy, or

by emailing privacy@coachos.app.

3. The personal data we collect

3.1 Data you provide

• Account data — your email address (used for magic‑link sign‑in) and display/coach name.
• Business profile — sport/discipline, session format, billing model, policies, and notes

you configure.

• Client records you create — your clients' names, email addresses, phone numbers, bios,

payment status, session counts, and notes. *You are responsible for having a lawful basis to enter this data — see Section 9 and the DPA.*

• Session and calendar content — session logs, summaries, calendar events, attendance, and

free‑text notes.

• Payment/subscription data — managed by RevenueCat and Apple; we receive subscription

status and entitlements, not your full card number.

• Support communications — anything you send us by email.

3.2 Data created from your use

• Voice audio and transcripts — when you use a voice command, we capture microphone audio,

stream it for live transcription, and store the resulting transcript and any AI‑generated summary linked to the relevant client/session/event.

• Usage and device data — app version, device model, OS version, time zone, and basic

diagnostic/error logs needed to operate and secure the Services.

• Push notification token — to deliver reminders and alerts to your device.

3.3 Website data

• Waitlist email — if you submit the early‑access form, we store your email and the page it

came from.

• Server/security logs — IP address and request metadata, retained briefly for security.
• The Site uses only strictly‑necessary technologies and a **privacy‑friendly, cookieless

analytics** measurement (no cross‑site tracking). See the Cookie Policy.

3.4 Special‑category data

CoachOS is not designed to collect health or other special‑category data. However, free‑text session notes or summaries you enter could contain health‑related information about a client. Please avoid entering special‑category data unless you have the explicit consent or other lawful basis required under Article 9 GDPR. We process such content only as your processor and only to provide the Services.

3.5 Children

The Services are intended for users aged 18 and over and are not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact privacy@coachos.app and we will delete it.

4. How and why we use your data (purposes & legal bases — GDPR/UK GDPR)

Where we rely on consent, you may withdraw it at any time without affecting prior processing. Where we rely on legitimate interests, you may object — see Section 6.

5. Who we share data with

We share personal data only with:

• Sub‑processors that operate the Services on our instructions (Section 8). Each is bound by a

data‑processing agreement and may not use your data for its own purposes.

• Communication providers you choose to use — when you send a client an SMS, WhatsApp, or

email through CoachOS, we transmit the message and the recipient's contact detail to Twilio, Meta (WhatsApp Business), or SendGrid respectively to deliver it.

• Apple and Google for app distribution, subscriptions, push delivery, and (if you connect it)

calendar sync.

• Professional advisers, auditors, or authorities where required by law.
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this

policy.

We do not sell personal data and do not "share" it for cross‑context behavioural advertising as those terms are defined under US state privacy laws.

6. Your rights

6.1 Everyone

You can access, export, and delete your CoachOS data at any time from Settings → Data & Privacy in the App, or by emailing privacy@coachos.app. Deleting your account permanently removes your account and associated records (subject to limited legal retention — see Section 7).

6.2 EU/EEA & UK (GDPR / UK GDPR)

You have the right to: access; rectification; erasure ("right to be forgotten"); restriction of processing; data portability; object to processing based on legitimate interests; and withdraw consent. To exercise any right, contact privacy@coachos.app. We respond within one month. You may also lodge a complaint with your local authority — for us, the competent German state data protection authority (the Landesdatenschutzbehörde for the federal state in which the controller is established); in the UK, the Information Commissioner's Office (ICO).

6.3 California (CCPA/CPRA) & other US states

If applicable, you have the right to: know/access the categories and specific pieces of personal information collected; delete; correct; opt out of sale/sharing (we do not sell or share); and to non‑discrimination for exercising your rights. We do not use or disclose sensitive personal information beyond the purposes permitted under the CPRA. Submit requests to privacy@coachos.app; we verify requests using your account email. Authorised agents may submit requests with proof of authorisation.

"Shine the Light" (California Civil Code §1798.83): we do not disclose personal information to third parties for their direct‑marketing purposes.

7. How long we keep data

Our full internal schedule is maintained in our records of processing.

8. Sub‑processors & third parties

We rely on the following categories of sub‑processors. The current itemised list, with each provider's location and purpose, is maintained at https://coachos-ai.com/sub-processors.

9. International data transfers

Some sub‑processors are located outside the EEA/UK (primarily the United States). Where we transfer personal data internationally, we rely on appropriate safeguards, including the European Commission Standard Contractual Clauses (and the UK International Data Transfer Addendum), and/or the provider's certification under the EU‑US / UK Data Privacy Framework where available. You may request a copy of the relevant safeguards at privacy@coachos.app.

10. When we act as a processor (your clients' data)

When you, as a coach, enter personal data about your own clients, you are the controller of that data and CoachOS is your processor. We process it only to provide the Services and on your documented instructions. Our obligations are set out in our Data Processing Addendum (https://coachos-ai.com/dpa), which forms part of the Terms.

You are responsible for: providing your clients with appropriate privacy information; having a lawful basis to enter and process their data (including any consent required for SMS/WhatsApp/email contact and for any health‑related notes); and responding to your clients' data‑subject requests. We will assist you with those requests as your processor.

11. How we protect your data

We use Row‑Level Security on the database, encryption in transit (TLS), encrypted device storage for credentials, access controls, and the principle of least privilege. No system is perfectly secure; if a personal‑data breach occurs that is likely to result in a risk to you, we will notify the relevant authority within 72 hours where required and inform affected users without undue delay.

12. Automated decision‑making

CoachOS uses AI to interpret your voice commands and generate suggestions and summaries. These do not produce legal or similarly significant effects about you within the meaning of Article 22 GDPR — you remain in control and confirm actions. We do not carry out solely automated decision‑making with such effects.

13. Changes to this policy

We may update this policy. We will post the new version at https://coachos-ai.com/privacy with an updated "Last updated" date and, for material changes, notify you in‑app or by email.

14. Contact

Beka Kokoladze Germany — full postal address available on request at privacy@coachos.app Email: privacy@coachos.app UK representative (UK GDPR Art. 27): To be appointed before public launch (UK GDPR Art. 27)