Data Processing Agreement
This agreement forms part of the Terms for coaches between you (the coach, the "controller") and AS Golf Retail Ltd, trading as Coachd (company number 13262746) ("Coachd", the "processor"). It covers the personal data of your players that Coachd processes for you, under the UK GDPR and the Data Protection Act 2018.
1. Roles
You decide why and how your players' data is used: you are the controller. Coachd processes it only to provide the service to you and on your documented instructions, which are these terms and how you use the app.
2. What is processed
| Who | Your players (clients), and you |
|---|---|
| Data | Names, email addresses, phone numbers, lesson dates and bookings, lesson recordings and transcripts, lesson notes, practice logs, rounds and scores, swing videos, messages, and questions asked to your AI assistant |
| Purpose | Writing and delivering lesson notes, the player app, the AI assistant, messaging and your coaching dashboard |
| How long | Lesson audio is deleted as soon as it has been transcribed. Everything else is kept while your account is open, and deleted within 30 days of it closing |
Coachd is not designed for special category data (such as health information). Notes are written to leave out injuries and health; please don't record or enter such data beyond what's needed.
3. Our commitments
- Process the data only on your instructions, and tell you if we think an instruction breaks data protection law.
- Make sure everyone who handles it is bound by confidentiality.
- Keep it secure, including encryption in transit and at rest, access controls and separation between coaches' data.
- Tell you without undue delay, and within 48 hours of becoming aware, of any personal data breach affecting your data.
- Help you respond to your players' requests (access, correction, deletion) and with any data protection impact assessment.
- Delete or return the data when the service ends, as set out in the terms.
- Give you the information you reasonably need to show compliance, and allow reasonable audits on notice.
4. Sub-processors
You authorise us to use these providers. We'll tell you at least 30 days before adding or replacing one, and you can object.
| Provider | What for |
|---|---|
| Supabase | Database, file storage and sign-in |
| Cloudflare | Hosting the app and its server |
| Anthropic | Writing lesson notes and the AI assistant's replies |
| ElevenLabs | Transcribing lesson audio, and the AI voice |
| Stripe | Coach billing (no player data) |
| Resend | Account and reminder emails |
Where a provider processes data outside the UK, we rely on an adequacy decision or the UK's approved transfer safeguards. We choose each provider's settings so your data isn't used to train their AI models, wherever they offer that choice.
5. Your commitments
You have a lawful basis for the processing, you tell your players about it (including that lessons are recorded), and the data you give us is accurate and limited to what's needed.