Boccia ProTrainer Privacy Policy
Effective date: [DD.MM.YYYY]
Last updated: [DD.MM.YYYY]
⚠️ Disclaimer: This document is a template based on GDPR best practices. Consult a lawyer specializing in e-commerce/SaaS before publishing. Fill in fields marked with
[...].
§ 1. Data Controller
The controller of your personal data is:
[Jarosław Plewa / Business Name]
Address: [street, postal code, city, Poland]
Tax ID (NIP): [XXX] · Business ID (REGON): [XXX]
Email: privacy@bocciaprotrainer.com
§ 2. Data we collect
| Category | Data | Purpose |
|---|---|---|
| Account | Email, hashed password, name | Account creation and service |
| Sport profile | Category (BC1–BC4), club, assistant | App personalization |
| Training | Shots, scores, ramp calibrations, training plans | Core app functionality |
| Health (optional) | Hooper Index (sleep, stress, fatigue, muscle soreness, energy level) | Wellness monitoring — sensitive data, collected only with explicit consent |
| Payment | Card / payment method data (processed by Lemon Squeezy) | Subscription billing |
| Technical | IP address, device identifier, session logs | Security, debugging, abuse prevention |
We do NOT collect:
- GPS location data
- Biometric data
- Social media data
§ 3. Legal basis (GDPR)
- Art. 6(1)(b) GDPR — contract performance (account, subscription)
- Art. 6(1)(a) GDPR — consent (health data, marketing)
- Art. 6(1)(f) GDPR — legitimate interest (security, analytics)
- Art. 9(2)(a) GDPR — explicit consent for processing sensitive data (health)
§ 4. Data processors
| Processor | Purpose | Location | Status |
|---|---|---|---|
| Supabase Inc. | Database hosting, authentication | EU (EU region) | DPA |
| Lemon Squeezy | Payment processing, Merchant of Record (tax compliance) | USA | DPA + SCC |
| Vercel Inc. | App hosting | EU / USA | DPA + SCC |
| Resend | Transactional email delivery | EU / USA | DPA + SCC |
| Cloudflare, Inc. (Turnstile) | Bot protection for forms | EU / USA | DPA + SCC |
All processors are bound by GDPR-compliant Data Processing Agreements (DPAs). Data transfers outside the European Economic Area rely on Standard Contractual Clauses (SCCs) approved by the European Commission.
Lemon Squeezy as Merchant of Record — this means Lemon Squeezy acts as the seller of record for tax purposes, calculates and remits VAT according to EU rules, and issues compliant invoices.
We do NOT sell your data to any third parties.
§ 5. Retention period
| Data | Period |
|---|---|
| Active account | For the duration of the subscription + 30 days |
| Deleted account (soft delete) | 30 days — recovery window |
| Permanently deleted account | Training data anonymized after 30 days |
| Accounting records (invoices, transactions) | 5 years — Polish accounting law requirement |
| Technical logs | 90 days |
| Backups | 30 days (rotated) |
§ 6. Your rights (GDPR)
You have the right to:
- ✅ Access your data (
Account → Export my data— JSON export) - ✅ Rectification of incorrect or incomplete data
- ✅ Erasure (the "right to be forgotten")
- ✅ Restriction of processing
- ✅ Portability (export in JSON / CSV format)
- ✅ Object to processing
- ✅ Withdraw consent at any time (without affecting processing lawfulness before withdrawal)
- ✅ Lodge a complaint with your local Data Protection Authority (or Polish UODO: www.uodo.gov.pl)
Exercising your rights: privacy@bocciaprotrainer.com — response within 30 days (Art. 12 GDPR).
§ 7. Cookies and similar technologies
We use:
- Necessary cookies — session, login, preferences (no consent required, ePrivacy Directive)
- Analytics cookies — [Plausible Analytics / Google Analytics 4] — consent-based
- localStorage — UI preferences (language, font size, sidebar state)
Consent for analytics cookies can be withdrawn in the cookie banner or browser settings.
§ 8. Data security
Technical and organizational safeguards implemented:
- 🔒 Passwords hashed with bcrypt (cost factor ≥10)
- 🔒 HTTPS / TLS 1.3 communication
- 🔒 At-rest encryption of data in Supabase (AES-256)
- 🔒 Row Level Security (RLS) at the database layer
- 🔒 Regular automated backups with restore testing
- 🔒 Optional 2FA login
- 🔒 Administrative access audits
§ 9. Children and minors
The app is not directed at persons under 13 years of age. Persons aged 13–16 must obtain parental/legal guardian consent to create an account. Accounts detected as belonging to underage users will be suspended and data deleted.
§ 10. Policy changes
We will inform you of material changes to this Privacy Policy:
- By email (to the address provided at registration) with at least 14 days' notice
- Via in-app notification
By continuing to use the app after the changes take effect, you accept the new version.
§ 11. Contact
For data protection matters:
- 📧 privacy@bocciaprotrainer.com
- ✉️ Postal address: [full address]
© [Year] Boccia ProTrainer · Jarosław Plewa