Privacy Policy

1. Who is responsible for your data

The controller is Agile Smart (a sole proprietorship operated by Koffi Anani Hounnou), 206-25, avenue Vincent-D'Indy, Montréal (Québec) H2V 2S8, Canada, NEQ 2278861648.

The person in charge of the protection of personal information under Law 25, who is also your contact point for any GDPR question, is Koffi Anani Hounnou. You can reach them directly at [email protected].

A useful clarification on roles: when you book a session, the coach is responsible for their own practice and for any notes they keep outside the platform. We are responsible for the platform, the account, the booking and the payment. What your coach keeps on their own systems falls outside this policy: ask them directly.

2. The data we collect

There are three sources: what you give us, what your use of the service produces, and, for coaches only, what we gather from public sources.

3. Why we process this data, and on what basis

Every processing operation rests on a specific legal basis. Where the basis is consent, you can withdraw it at any time; where it is legitimate interest, you can object.

Transactional messages. Messages that are essential to the service (booking confirmation, session reminder, receipt, password reset, notice of a change to the terms) are part of performing the contract. They are not marketing and therefore carry no unsubscribe link: opting out would mean no longer being told about your own appointments.

4. How long we keep it

These periods are enforced by a daily purge, not case by case.

5. Who can access your data

Internally, access is limited to those who need it for their role. Administrative accounts require two-factor authentication, and every sensitive action is logged.

Other users see your data only to the extent you decided: a coach’s profile is public by the coach’s own choice; a client’s identity is disclosed only to the coach they approached.

6. Our processors

We deliberately rely on a small number of providers. Each is bound by a data processing agreement and acts only on our instructions.

7. Transfers outside Quebec and the European Union

Primary hosting is in the European Union. Some providers in the table above are nonetheless established in the United States, which amounts to a communication of personal information outside Quebec under Law 25, and a transfer outside the European Union under the GDPR.

• Legal framework: each transfer relies on the European Commission’s standard contractual clauses and, where the provider participates, on the EU-US Data Privacy Framework.
• Prior assessment: as required by Article 17 of Law 25, before any transfer we assess whether the information will receive adequate protection, having regard to its sensitivity, the purpose, and the safeguards in place.
• Minimisation: we send each provider only what it strictly needs. Sentry receives technical context, not the content of your exchanges; Resend receives the email to be sent, not your history.

You can obtain a copy of the safeguards governing these transfers by writing to [email protected].

8. Automated decisions, profiling and artificial intelligence

Search result ranking relies on objective criteria, relevance to your search, specialisms, language, city, average rating, profile completeness. It is not an automated individual decision within the meaning of Article 22 GDPR.

We use artificial intelligence tools to produce editorial content (articles, descriptions). Those tools do not receive your account, booking or message data. Should that change, this policy would be amended before any such use.

9. Minimum age

EraCoach is reserved for people aged 18 or over. We do not knowingly collect data about minors and do not offer them a service.

If you become aware that an account has been created by a minor, report it to [email protected]: the account will be closed and the data deleted without delay.

10. Security

The measures listed below are actually in place. We do not state guarantees here that we could not demonstrate.

• All communications encrypted in transit (TLS).
• Passwords stored as irreversible hashes: we cannot read them.
• Data partitioned at database level: every query is filtered by access policies, including in the event of an application flaw.
• Two-factor authentication required for administrative accounts.
• Timestamped audit log of sensitive actions, visible to administration only.
• Daily encrypted database backup, whose restoration is actually tested every month.
• No card data on our servers: entry and storage are handled by Stripe, certified PCI-DSS Level 1.
• Protection against automated attacks and abusive traffic upstream of our servers.

No measure makes a system impregnable. Choose a unique password, do not reuse it elsewhere, and tell us immediately about any suspicious activity on your account.

11. In the event of a confidentiality incident

We maintain a register of confidentiality incidents, as required by Law 25.

• Where an incident presents a risk of serious injury, we inform the Commission d’accès à l’information du Québec and the individuals concerned promptly.
• For people located in the European Union, notification to the supervisory authority is made within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR.
• The information provided states the nature of the incident, the data affected, the likely consequences and the steps you can take to protect yourself.

12. Your rights

Access

Confirm that we process your data and receive a copy of it.

Rectification

Have inaccurate or incomplete information corrected.

Erasure

Have your data deleted, except where the law requires us to keep it (accounting) or it remains necessary to establish a legal claim.

Portability

Receive, in a structured, machine-readable format, the computerised data you provided to us. This right is expressly provided by both the GDPR and Law 25.

Restriction

Ask that processing be frozen while a dispute is examined.

Objection

Object to processing based on legitimate interest, and at any time to prospecting.

Withdrawal of consent

Withdraw your agreement at any time, without calling into question what was done beforehand.

De-indexation and cessation of dissemination (Law 25)

Require that dissemination of information about you cease, or that a link giving access to it be de-indexed, where that dissemination causes you serious injury.

Automated decisions

Be told if a decision about you rests solely on automated processing, and obtain human intervention. No such processing is in place today.

Post-mortem instructions

Set instructions on what happens to your data after your death.

How to exercise these rights. Write to [email protected] or use the contact form. We reply within 30 days. If we need to verify your identity, we ask for the minimum necessary: never a copy of an identity document by plain email.

Some of these rights can be exercised straight from your account: change your information, remove your profile from public display, unsubscribe from mailings, and delete your account. Deletion is started from your settings and carried out after 7 days, during which you can change your mind. After that, your profile is anonymised and the data that belongs to you alone (favourites, saved searches, devices, payment methods, calendar connections) is deleted.

If our answer does not satisfy you, you may complain to the Commission d’accès à l’information du Québec or, if you live in the European Union, to your country’s supervisory authority, in France the CNIL, in Spain the AEPD. Complaining to an authority does not deprive you of any judicial remedy.

13. Cookies and trackers

Trackers placed on your device, their lifetime and how to refuse or withdraw your consent are covered by a dedicated document: the cookie policy.

14. Changes to this policy

This policy evolves with the service. Any substantive change (a new purpose, a new recipient, a new transfer outside Quebec or the EU, a change of controller) is notified to you by email at least 30 days before it takes effect, so that you can object or close your account.

Editorial corrections are signalled by updating the effective date and version number at the top of this page.