Privacy policy

Last updated: 21 September 2026

This Privacy Policy explains how VEGUY SOFTWARE processes personal data in connection with the CoachiFoot website, Web App and services.

1. DATA CONTROLLER

Cyril Vanlerberghe, sole trader (entrepreneur individuel — EI) Trading name: VEGUY SOFTWARE 80 rue Charles Jaquinod 01550 Farges — France SIRET: 501 952 063 00045 RCS : 501 952 063 R.C.S. Bourg-en-Bresse Email: contact@coachifoot.com

2. DATA PROCESSED

Depending on how the service is used, CoachiFoot may process:

Coach data: name, email address, telephone number where provided, login credentials and technical account-related data.

Usage data: logins, sessions, actions necessary for operation and security, content created, sessions, drills, teams, calendar, use of AI features and associated technical data.

Payment and subscription data: subscription status, payment events, transaction references and receipts necessary for operation of the subscription. Full payment-card details are processed by payment providers and are not stored by CoachiFoot.

Player data entered by the coach: name, shirt number, photograph, date of birth, preferred foot, team and captain status. The coach may also record assessments and comments, test results with scores and dates, positions, placements in line-ups and attendance at calendar events.

Players do not have a CoachiFoot account, email address or telephone number recorded in their profile and have no login credentials.

Communication and marketing data: email address, consent or objection choices, associated date and information necessary to manage communications.

Cookie/tracker data: information collected by authorised tools in accordance with the user's consent preferences.

3. PURPOSES AND LEGAL BASES

Data is processed in particular to: – create and administer the account, provide CoachiFoot features and manage the subscription: performance of a contract; – manage payments, invoices and legal obligations: performance of a contract and compliance with legal obligations; – ensure security, prevent abuse, and technically maintain and improve the service: VEGUY SOFTWARE's legitimate interests, subject to data subjects' rights; – respond to support requests: performance of a contract or legitimate interests, depending on the request; – send marketing communications where consent is required: consent; – retain evidence of an objection to direct marketing: legitimate interests and compliance with applicable obligations; – use audience-measurement or advertising tools that are not strictly necessary: consent where required; – provide artificial-intelligence features requested by the user: performance of the requested service.

4. PLAYER AND MINOR DATA

Player profiles are created and administered exclusively by coaches. Players do not create accounts and do not use CoachiFoot directly.

A coach entering information about a player must ensure that they are authorised to do so and that the individuals concerned have received the necessary information where required by law. Particular care is required where the player is a minor or a photograph is recorded.

CoachiFoot asks coaches to limit recorded information to what is necessary for sports management.

5. ARTIFICIAL INTELLIGENCE

Certain CoachiFoot features use the OpenAI API, currently with the gpt-4o-mini model.

Depending on the feature used, the following may be transmitted to OpenAI: – the question entered by the coach; – team names and the number of players in each team, without a nominal player list; – names and dates of recent or upcoming sessions; – names and themes of relevant drills; – for the session generator: age category, group size, objective and session duration.

CoachiFoot does not send OpenAI player-profile fields such as the player's name, date of birth, photograph, assessments or attendance.

However, because team names, session names and questions are free-text fields, a user may themselves enter personal information in them. Users are therefore encouraged not to include unnecessary personal data, particularly concerning minors, in fields transmitted to AI features.

6. RECIPIENTS AND SERVICE PROVIDERS

To the extent necessary for their respective functions, data may be processed by the following service providers: – Amazon Web Services / Amazon S3: file storage, including photographs and images, with the relevant primary storage in the Paris region; – Backblaze B2: encrypted nightly backups stored in Amsterdam; – Vercel: hosting of the web component and processing of technical requests; – A2 Hosting: current hosting of the server and database; – OpenAI: artificial-intelligence features; – Stripe: Web payments and subscriptions; – PayPal: Web payments and subscriptions; – Apple and Google Play: management of purchases and subscription receipts made through the mobile applications; – Asynk / mail.asynk.tech: current sending of certain transactional emails, including verification and password-reset emails; – PDF service hosted in Germany: temporary processing of session content when generating a PDF; – Google Analytics, Google Ads and Meta: audience measurement/advertising, only in accordance with applicable consent requirements; – Cookiebot: recording and management of consent choices.

Amazon SES is configured but, until it is used for production sending, it is not presented as an effective recipient for email sending. This list may be updated as the infrastructure evolves.

7. INTERNATIONAL DATA TRANSFERS

Certain service providers are established outside, or may process data outside, the European Economic Area.

Where data is transferred to a country not covered by an applicable adequacy decision, VEGUY SOFTWARE relies, depending on the provider and processing activity, on mechanisms provided for by the GDPR, including the European Commission's Standard Contractual Clauses and, where relevant, applicable certification mechanisms or adequacy decisions.

Where the services used allow it, data is hosted in European regions as far as possible.

8. RETENTION PERIODS

Active accounts and the data necessary for them are retained for the duration of use of the service.

Inactive accounts are intended to be deleted after two years without activity, unless an active subscription or legal obligation justifies retention. A warning is planned before deletion. As reliable activity tracking began in September 2026, the two-year period is calculated no earlier than September 2026 for older accounts; the first automatic deletions under this rule therefore cannot take place before September 2028.

Player data, photographs, assessments, tests and attendance records are retained for as long as the coach retains the player or their account, and are then deleted under the applicable erasure procedure.

Private drills and sessions are retained while the account exists. Content voluntarily shared with the community may remain after account deletion, but is dissociated from the coach's identity and reassigned to a generic account.

Encrypted backups are retained for 30 days before rotation.

Expired login sessions and password-reset tokens are intended to be purged after their period of technical usefulness.

Technical and security logs are retained for a maximum of 12 months under the retention policy currently being deployed.

CRM data used for direct marketing is retained for a maximum of three years after the end of the relationship or the last relevant contact, as applicable.

Information necessary to demonstrate an objection to direct marketing may be retained for at least three years in a form that prevents further solicitation without unnecessarily retaining the address in plain text.

Accounting, payment or evidentiary data subject to a statutory retention period may be retained for the period required by applicable regulations.

Certain retention automations are currently being technically implemented. The periods above constitute VEGUY SOFTWARE's applicable retention policy and the corresponding mechanisms are deployed consistently with it.

9. ACCOUNT DELETION

When a coach deletes their account, the following are deleted in particular: the account and personal contact details, authentication data, associated sessions and tokens, relevant private content and directly linked data that do not need to be retained to comply with a legal obligation.

Each player linked to the account undergoes an erasure procedure: the name, date of birth and photograph address are erased and the photograph is deleted from storage.

Content previously shared with the community may be retained without any link to the coach's identity, by reassignment to a generic account.

A copy of deleted data may temporarily remain in encrypted backups until they rotate, for a maximum of 30 days.

Certain data strictly necessary to comply with a legal obligation, establish or defend legal claims, meet accounting requirements or retain a marketing objection may be kept separately for the necessary period.

10. COOKIES AND TRACKERS

CoachiFoot uses cookies and trackers that are strictly necessary for operation of the service.

Subject to the user's consent where required, CoachiFoot may also use Google Analytics, Google Ads and Meta for audience measurement, analytics and advertising.

Cookiebot records the user's choice and manages the activation of the relevant trackers.

Users may accept, refuse or change their choices at any time using the cookie-management tool available on the website.

11. TRANSACTIONAL AND MARKETING COMMUNICATIONS

Emails essential to operation of the account or service, such as account verification, security, password reset or necessary service information, are distinct from commercial communications.

Marketing communications are sent only where permitted by applicable law, including on the basis of consent where consent is required.

Marketing consent is optional and may be withdrawn at any time. Commercial communications include a simple means of objecting to future messages.

12. SECURITY

VEGUY SOFTWARE implements technical and organisational measures designed to protect data against unauthorised access, loss, alteration or disclosure.

Depending on the components concerned, measures include encryption, access restrictions, encrypted backups, logging of certain activities and restricted access to storage areas.

As no IT system can guarantee zero risk, measures are adapted and reassessed in light of changes to the service and identified risks.

13. DATA SUBJECT RIGHTS

Under the conditions laid down by the GDPR and applicable law, data subjects may in particular have the following rights: – right of access; – right to rectification; – right to erasure; – right to restriction of processing; – right to object; – right to data portability where the applicable conditions are met; – right to withdraw consent at any time for processing based on consent.

Requests may be sent to: contact@coachifoot.com.

Proof of identity may be requested only where necessary to verify the identity of the requester.

If, after contacting VEGUY SOFTWARE, a person considers that their rights have not been respected, they may lodge a complaint with the CNIL (French Data Protection Authority) or with the competent supervisory authority in their EU country of residence.

14. REQUESTS CONCERNING A PLAYER

Where a request concerns a player's data recorded by a coach, VEGUY SOFTWARE may need to identify the account and coach who created the profile in order to process the request correctly and determine the applicable responsibilities.

For any request: contact@coachifoot.com.

15. CHANGES TO THIS POLICY

This Policy may be updated to reflect changes to CoachiFoot, its service providers or applicable regulations.

In the event of a substantial change, appropriate information may be provided to users depending on the circumstances.

16. CONTACT

VEGUY SOFTWARE — Cyril Vanlerberghe EI 80 rue Charles Jaquinod 01550 Farges — France SIRET: 501 952 063 00045 Email: contact@coachifoot.com