CoachFlow is operated by GROUPE SEPRO SARL, a company incorporated in Senegal under RCCM SN DKR 2023 B 53657, NINEA 010861228, of 6597 Liberté 6, Grand-Dakar, Senegal, trading as CoachFlow (“we”). We are the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) for the account data described here, because the practices that use CoachFlow and the clients they record are in South Africa. Being established in Senegal, we are also subject to loi n° 2008-12 of 25 January 2008 on the protection of personal data. Each coaching practice that uses CoachFlow is the responsible party for what it records about its own clients; we process that data on its behalf as an operator. Questions and requests: support@groupesepro.com.

Account data: your name, email address and telephone number, your language preference, and the record that you accepted these terms (version and time). Sign-in is handled by Clerk; a password, when you choose one, is stored by Clerk and never by us. Practice data recorded by your coach: sessions, availability, rates, statements and payments, notes, and any dependants an adult client enrols. Optional data, only with your consent: a profile picture (camera and location details are removed before it is stored) and a session rating with an optional comment. Payment data: we never see card details — payments are made with Payfast, and we receive only the confirmation, amount and currency.

To run the service you or your practice asked for: scheduling sessions, sending reminders and statement emails, taking payments for a practice, and keeping the financial records a practice is required to keep. Every notification is part of the service; there is no marketing email and no selling of data. We make no automated decisions about you and send no data to artificial-intelligence services.

Your coach and the other coaches of the same practice see the practice’s records. A rating you leave is visible to the coaches of that practice, never to other clients. Where an adult client has given a dependant access to the household, that person sees the household’s records. Our processors, each bound by contract: Clerk (sign-in), OVHcloud (hosting, in France), Resend (email), Payfast (payments, South Africa), Cloudflare (domain name service). Founder and support staff may access a practice’s data to help it, and every such action is recorded under the staff member’s own name. One thing is not a processor: where a session has a place, the map shown on that session’s page is loaded by your browser directly from Google Maps, so Google receives the address your coach typed and your device’s IP address. We send Google nothing ourselves, and a session with no place loads no map.

Data is hosted in France (OVHcloud, Gravelines). Sign-in data is held by Clerk and email delivery by Resend in their own regions. Transfers outside South Africa rest on section 72 of POPIA: the recipient is bound by contract to protection substantially similar to POPIA. We are ourselves established in Senegal and reach the data from there on that same basis. Each of these providers is bound by its published data-processing terms, which we have reviewed against that standard. The map on a session page is the exception: it is served by Google from its own regions at the moment your browser loads the page, we have no data-processing contract with Google for it, and what Google does with that request is governed by Google’s own privacy policy.

Account data: for as long as the account exists. Issued statements, tax invoices and payments: five years from issue, as the law requires of a practice; when an account is deleted these records are kept with the personal identifiers replaced, so they no longer name you. Everything else is deleted or anonymised when the account is deleted. Encrypted backups are kept for sixty days.

You may ask for a copy of your data, ask for it to be corrected, object to its processing, and ask for it to be deleted. Your coach can correct what the practice recorded; a copy of your own record can be requested from within the app or from support@groupesepro.com. Deleting your account is described on the page “Deleting your account and data”. You may complain to the Information Regulator (South Africa), complaints.IR@justice.gov.za, or to the Commission de protection des données personnelles (Senegal), the authority of the country in which we are established.

Nobody under eighteen holds a CoachFlow account. A child attends sessions as a dependant on an adult client’s record; that adult’s acceptance of these terms covers the dependant, and the adult alone can see, correct or delete the dependant’s record.

When this policy changes, the version number at the top changes, and you are asked to accept the new version at your next sign-in. We keep the record of which version you accepted, and when.