Privacy Policy

1. Who we are

Orca Coaching Platform(“Orca”, “we”, “us”) is a coaching platform registered in the United Kingdom at [Registered address — TODO]. We provide software that fitness and nutrition coaches use to manage their businesses and their clients. For questions about this policy or your data, contact us at privacy@orca.app.

2. Scope

This policy covers the coach-facing Orca dashboard and the accounts of coaches and their staff. Client portals operated by coaches on their own domains are provided by the coach, who determines what personal data is collected there (see section 5).

3. Data we collect

• Account data — name, email address, password credentials, business name and settings.
• Billing data — subscription and payment details, processed by Stripe. We do not store full card numbers.
• Usage data — log data, device and browser information, and interactions with the service, used to operate and improve the platform.
• Client data uploaded by coaches — information coaches enter about their own clients (contact details, programmes, nutrition plans, check-ins, progress data, photos). We process this on the coach’s behalf.

4. Legal bases (UK GDPR)

• Contract — providing the service you signed up for, including billing and support.
• Legitimate interests — securing the platform, preventing abuse, and improving the product.
• Legal obligation — accounting, tax, and regulatory record-keeping.
• Consent — where required, for example optional marketing communications; you can withdraw consent at any time.

5. Coaches as data controllers for client data

For data about a coach’s clients, the coach is the data controller and Orca acts as a data processor, handling that data only on the coach’s instructions as set out in our Terms of Service and data processing terms. Clients seeking to exercise data rights over information their coach holds should contact their coach directly; we will assist coaches in fulfilling such requests.

6. Third-party processors

We use the following sub-processors to run the service:

• Supabase — database and authentication hosting.
• Stripe — subscription billing and coach client payments (Stripe Connect).
• Resend — transactional email delivery.
• Vercel — application hosting and file storage.
• UploadThing — file upload handling.

Each processor is bound by data processing terms consistent with UK GDPR.

7. International transfers

Some processors store data outside the UK, including in the United States and the EU. Where data leaves the UK, we rely on adequacy regulations, the UK International Data Transfer Agreement, or standard contractual clauses with the UK addendum.

8. Retention

• Account data — kept while your account is active and for up to 90 days after closure, to allow reactivation and data export.
• Client data — retained per the controlling coach’s instructions; deleted when the coach deletes it or closes their account (subject to the same 90-day window).
• Billing records — kept for 6 years to meet UK accounting obligations.
• Logs — typically retained for no more than 12 months.

9. Your rights (UK GDPR)

You have the right to access, rectify, erase, restrict, and port your personal data, to object to certain processing, and to withdraw consent. To exercise any right, email privacy@orca.app. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

10. California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to request its deletion or correction, and to not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined by the CCPA. Submit requests to privacy@orca.app.

11. Cookies

We use strictly necessary cookies for authentication and session management. We do not use third-party advertising cookies on the dashboard.

12. Security

Data is encrypted in transit and at rest, access is scoped per business with role-based controls, and we review our security practices regularly. No system is perfectly secure; we will notify affected users and regulators of any breach as required by law.

13. Contact

Orca Coaching Platform, [Registered address — TODO]. Email: privacy@orca.app.