Privacy Policy

1. Data we collect

EraCoach only collects the data necessary for the proper operation of the platform and your user experience:

• Identity (last name, first name, email, preferred language)
• Authentication data (hashed by Supabase Auth)
• Coach profile (bio, specialties, certifications, photo)
• Booking and message history
• Payment data (handled by Stripe — we do not store any bank details)
• Technical data (cookies, IP address, user-agent) for security purposes

2. Purposes of processing

• Enable coach / coachee matching
• Manage booking, payment and invoicing
• Ensure the security of the platform and fight fraud
• Improve our services (anonymized analytics)
• Keep you informed (optional newsletter, from which you can unsubscribe at any time)

3. Legal bases

In accordance with the GDPR, we process your data on the following legal bases: performance of the contract (user account, booking), legitimate interest (security, product improvement), consent (non-essential cookies, marketing).

4. Retention period

• Active account: as long as your account is open
• Closed account: 13 months maximum (except legal obligation)
• Invoices and accounting data: 10 years (legal obligation)

5. Your rights

You have a right of access, rectification, erasure, portability, restriction and objection. To exercise these rights, use our contact form with the category « Legal & GDPR ». Every GDPR request is processed within 30 days in accordance with the regulations.

6. Security

EraCoach implements all appropriate technical and organizational measures: TLS encryption, password hashing (Argon2), restricted access, regular audits, encrypted backups.

7. Sub-processors

List of main sub-processors: Supabase (hosting and auth), Stripe (payment), Resend (transactional email), Vercel (CDN). All are GDPR-compliant.

8. Complaints

If you believe that your rights are not being respected, you can lodge a complaint with the CNIL (cnil.fr).