Privacy policy

For account administration, CoachStack subscriptions, website inquiries, security, and CoachStack’s own website analytics, the controller is Habib Mestiri, sole trader (entrepreneur individuel), trading as CoachStack, SIRET 917 634 800 00028, Boulevard de Paris, 13003 Marseille, France.

Contact: contact@coachstack.co. No data protection officer has been appointed.

When a coaching organization uses CoachStack to manage its leads, clients, members, programs, messages, or campaigns, that organization decides why and how those records are used and is the controller. CoachStack processes those records on the organization’s instructions to provide the service. Contact the organization first about those records. Organizations can contact us to request the data processing terms applicable to their account.

• Account and profile information, including name, email address, profile image, sign-in provider, organization membership, and permissions.
• Information entered into a workspace, including leads, clients, enrollments, coaching sessions, course materials, files, messages, community activity, and marketing contact records.
• Subscription and payment references, invoices, billing status, and Stripe account identifiers. Card details are collected and handled by Stripe, not stored by CoachStack.
• Email preferences, campaign recipients, delivery status, and campaign engagement information when an organization enables those features.
• Messages sent to CoachStack, demo booking details entered on Calendly, and technical information needed to operate, troubleshoot, and secure the service.
• For Google sign-in, Google may provide your email address, name, and profile image. CoachStack uses these to create and secure your account. CoachStack does not request access to Google Drive, Gmail, or other Google content through sign-in.
• For website analytics, Vercel Analytics provides anonymized page-view and traffic statistics, such as page, referrer, approximate country, browser, and operating system. Vercel says its analytics do not use cookies and use a visitor hash that resets daily.

• To create and secure accounts, authenticate users, provide workspaces, and support requested features. The legal basis is performance of a contract or steps taken at your request before a contract.
• To manage subscriptions, process payments, and maintain accounting records. The legal basis is performance of a contract and compliance with legal obligations.
• To respond to inquiries, troubleshoot issues, prevent abuse, and protect the service. The legal basis is our legitimate interests in operating and securing CoachStack.
• To understand visits to the public website through anonymized audience statistics. The legal basis is our legitimate interest in measuring and improving the website.
• To send service communications and, where permitted, product updates. You can opt out of optional marketing messages at any time.
• Organizations using CoachStack choose the purposes and legal bases for their own customer, member, and marketing data and must provide the required notices to those people.

We share information with providers only as needed to operate the service, process payments, deliver messages or media, or respond to your request. We do not sell personal information.

• Vercel: Application hosting and website analytics.
• Supabase: Authentication, database, and application data storage.
• Stripe: Platform billing and payments made by organizations.
• Resend: Transactional and organization-requested email delivery.
• Cloudflare: Domain services and background job infrastructure.
• Bunny.net: Media storage and delivery.
• Google: Sign-in when you choose Google authentication.
• Calendly: Optional demo bookings on Calendly.

Calendly is opened on its own website when you choose to book a demo. Its own privacy notice applies to information entered there. Providers and their processing locations can change as the service evolves.

Account and workspace information is kept while the relevant account or organization uses the service. When an organization closes its account, its owner can contact us to request export or deletion of workspace information. We may retain information that is needed for legal obligations, accounting, security, or the establishment or defense of legal claims. Data in backups is removed according to the applicable backup cycle.

Invoices and accounting records are retained for the period required by applicable law, which can be ten years in France. Support correspondence is kept for as long as needed to resolve the request and document related follow-up. We retain only the minimum information needed to honor an email opt-out.

Our providers may process information in France, elsewhere in the European Economic Area, or outside it, depending on the provider and service configuration. Where applicable law requires safeguards for an international transfer, we rely on an adequacy decision or appropriate safeguards such as standard contractual clauses. Contact us for information about the safeguards relevant to a particular processing activity.

CoachStack uses authentication and security cookies needed to sign in and keep a session working. The site also stores certain interface preferences in your browser. These technologies do not serve advertising.

Vercel Analytics is used for website audience measurement. Vercel documents that this feature does not use cookies and uses anonymized statistics. You can limit browser storage or block scripts in your browser, though some sign-in features may then stop working.

Where CoachStack is the controller, you may request access, correction, deletion, restriction, or portability of your information, or object to processing based on legitimate interests. You may withdraw consent where processing relies on consent. This does not affect processing that took place before withdrawal or information we must retain by law.

Contact contact@coachstack.co. We may ask for information needed to verify your identity. For information managed by a coaching organization, contact that organization; CoachStack will assist it as required by law.

You may lodge a complaint with the French data protection authority, the CNIL.

Organizations are responsible for choosing a lawful basis, providing privacy notices, managing access permissions, responding to requests from their clients and members, and ensuring that campaign recipients have the required permissions. They should not upload sensitive information, including health information, unless they have a lawful basis and have put the required safeguards in place.

CoachStack is a coaching business platform, not a medical record service.

We may update this policy when the service or its data practices change. The current version and its update date will be published on this page. Questions or requests: contact@coachstack.co.