Privacy policy

• Controller: Add On Dev Solutions S.L., tax ID (CIF) B22654610, Calle Espronceda nº 2, planta 1, puerta C, 21001 Huelva (Spain).
• Privacy contact: contacto@addon-sport.com.

Each Coach is independently responsible for any data they process outside the Platform and for their professional notes about their athletes; inside the Platform, they only access your data while you have an active relationship and in order to provide their service.

• Account: name, email, password (hashed), language, country and time zone.
• Athlete profile: division, level, hand, goals, training days and, if you provide them, club and date of birth.
• Coach profile: bio, specialties, qualifications, city, services and prices, availability.
• Training data: rounds (scores and the position of each arrow), plans, sessions and logs, equipment tests, equipment and sight marks, competitions (dates, goals and results), and achievements and streaks calculated from your activity.
• Wellness (optional): the daily check-in of sleep, fatigue, stress, muscle soreness and mood, on 1-to-5 scales. See “Wellness data” below.
• Communications: chat messages and attachments (photos, videos, audio, documents), your coaches' comments on rounds, sessions and competitions, bookings, video-call records (date and duration; calls are not recorded) and reviews.
• Payments and billing: amounts, currency, payment status, receipts and invoices and, if you provide them, your tax details (name or company name, tax ID and address). For coaches, also your billing mode. Card and bank account details are handled directly by Stripe: we don't store them.
• Technical data: IP address, device type, push notification token, security and audit logs.
• Waitlist: email, profile (coach or athlete) and language.

Wellness data (special category). Your wellness check-in answers (especially fatigue and muscle soreness) may reveal information about your health (art. 9 GDPR). The check-in is optional: we only process it with your explicit consent, which you can withdraw at any time without affecting the rest of the app; when you withdraw it we stop collecting this data and delete its history. Only you and the coaches you're actively working with can see it, and they use it to adapt your training (for example, they're alerted if fatigue or soreness stays high two days in a row). We don't use it for anything else or share it with third parties.

If you choose to share other information about injuries or health with your coach in the chat, you do so voluntarily and only they will see it.

We don't sell your data or use it for third-party advertising. We don't make automated decisions with legal effects about you.

Children under 14 may only use the Platform with the consent of their parents or guardians (art. 7 LOPDGDD), who may exercise their rights on their behalf. If we find an account belonging to a child under 14 without that consent, we will delete it.

• Your coach (or your athletes, if you are a coach), only while the relationship is active and as far as necessary.
• Providers that process data on our behalf (processors) under contract and with safeguards: server and database hosting in the EU, file storage (Cloudflare R2), email delivery (Resend), push notifications (Expo and Apple's and Google's services) and video calls (LiveKit, which only relays audio and video in real time: calls are neither recorded nor stored).
• Payments: Stripe processes athletes' payments and coaches' payouts as our processor. For its own legal obligations (verifying coaches' identity, preventing fraud and money laundering) it acts as an independent controller under its own privacy policy (stripe.com/privacy).
• Public authorities, judges and courts where there is a legal obligation.

We host the Platform in the European Union: servers, database and backups are in EU data centres.

Some providers are established outside the European Economic Area (mainly in the United States) or may access data from there. In those cases transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the standard contractual clauses approved by the European Commission, with supplementary measures where needed. You can ask us for a copy of these safeguards.

• While you have an account: your account, profile, training data and messages.
• When you delete your account: we immediately delete your profile, rounds, wellness, competitions, equipment, messages, uploaded files and notifications. Backups are overwritten within 30 days at most.
• Wellness data: while you keep your consent; deleted when you withdraw it or delete your account.
• Invoices, receipts and payment data: kept for the legal periods even if you delete your account, blocked and only available to the authorities: 6 years (art. 30 of the Spanish Commercial Code) and the limitation periods set by tax law.
• Video calls: not recorded; we only keep the date, duration and minutes used, together with the payment data.
• Audit and security log: up to 2 years, keeping only minimal data (identifier, action, date and IP).
• Waitlist: until launch and at most 12 months, or until you withdraw your consent.

You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability and to withdraw your consent at any time. You can do it directly in the app:

• Access and portability: Profile (or Account, if you are a coach) → Privacy and data → Download my data. You'll get a JSON file with your data.
• Erasure: Profile (or Account, if you are a coach) → Privacy and data → Delete my account. It's deleted immediately, except what the law requires us to keep (invoices and payments).
• Rectification: by editing your profile in the app.
• For any other request, email contacto@addon-sport.com from your account's email address. We will reply within one month.

If you believe we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the authority in your country.

We apply reasonable technical and organisational measures: encrypted connections (HTTPS), hashed passwords, file access through signed, time-limited links, role-based access control and logging of administrative actions.

If we change this policy significantly, we will tell you in the app or by email before the change applies.