Privacy Policy

This policy explains how CoachHQ Apps FZCO, a free zone company incorporated under the International Free Zone Authority (IFZA), Dubai, United Arab Emirates (licence number 76556) (“CoachHQ”, “we”) handles personal data in connection with the CoachHQ platform (app.hq.coach) and our websites (hq.coach). Contact for privacy matters: privacy@hq.coach.

Although we are based in the UAE, we offer our services to businesses in the United Kingdom and European Union, so we apply the standards of the UK GDPR and EU GDPR to that processing, alongside the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). Production data is hosted in the EU (AWS Stockholm). All privacy matters are handled directly by us at privacy@hq.coach.

1. The two roles we play

• Controller — for data about coaches and their staff (account holders), website visitors, and marketing leads. Sections 2–6 cover this.
• Processor — for data that coaching businesses put into the platform about their clients and leads (“Customer Data”). The coaching business is the controller; we process on its instructions. Section 7 is our processing commitment to those businesses. If you are a client of a coaching business that uses CoachHQ, that business’s privacy notice applies to you — direct requests to them and we will help them respond.

2. Data we collect as controller

• Account data — name, email, business name, password (hashed), phone, timezone, role.
• Billing data — plan, subscription status and payment history. Card details are held by our payment providers (Stripe, Whop), never on our servers; we store at most the card brand, last four digits and expiry for display.
• Usage and device data — log data, IP address, browser, and in-app product analytics (PostHog) used to operate, secure and improve the platform.
• Marketing data — if you fill in a form on our websites or sign up from a campaign: your contact details, the campaign parameters (UTM tags, click IDs) and referrer; and on marketing pages, advertising cookies/pixels (Meta, Hyros) for measuring our ads.
• Signup consents — a timestamped record of your acceptance of the Terms.

3. Why we use it (lawful bases)

• Contract — creating and running your account, billing, support, service messages (including notices before a free period ends).
• Legitimate interests — securing the platform, preventing abuse of free plans, product analytics, and marketing our own services to business contacts (with opt-out on every message).
• Legitimate interests (advertising) — measuring the performance of our own advertising on our marketing pages (see section 8 for how to opt out).
• Legal obligation — accounting and tax records.

4. Retention

• Account data: for the life of the account and up to 90 days after closure, then deleted or anonymised (billing records kept as legally required, typically 6 years).
• Free Call Tracker accounts: data is kept during the 90-day free period and for 90 further days afterwards (the export window in the Terms), then archived and deleted or irreversibly anonymised.
• Marketing leads: up to 24 months from last interaction.
• Logs and analytics: typically 12 months or less.

5. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent where consent is the basis (equivalent rights exist under the UAE PDPL). Exercise them at privacy@hq.coach. UK users can complain to the ICO (ico.org.uk), EU users to their local supervisory authority, and UAE users to the UAE Data Office; we would appreciate the chance to resolve concerns first.

6. Sub-processors and transfers

Production data is hosted with AWS in the EU (Stockholm, eu-north-1), encrypted in transit and at rest. Where a provider below processes data outside the UK/EEA, we rely on adequacy decisions or Standard Contractual Clauses. Because our operating company is in the UAE, remote access to personal data from the UAE is itself a restricted transfer — we safeguard it with the UK IDTA/Addendum and EU Standard Contractual Clauses between our entities and personnel, alongside strict internal access controls.

We will update this list as providers change; material changes to Customer Data sub-processors are notified to account holders.

7. Our commitments as processor (Customer Data)

For personal data that coaching businesses store in CoachHQ about their clients, we: process it only to provide the Services and on the business’s documented instructions; keep it confidential; protect it with appropriate technical and organisational measures (encryption in transit and at rest, access controls, EU hosting, per-tenant isolation); engage only the sub-processors listed above under equivalent obligations; assist the controller with data subject requests and security obligations; notify the controller without undue delay of a personal data breach affecting their data; and on termination return (export) or delete Customer Data in line with the retention schedule in the Terms. This section constitutes our data processing terms under Article 28 UK/EU GDPR. [OPTIONAL: replace with a signed DPA for enterprise customers.]

8. Cookies on our websites

Marketing pages use strictly-necessary cookies and advertising measurement (Meta pixel, Hyros) to understand which of our ads work. You can opt out by blocking third-party cookies in your browser, via Meta’s ad preferences (facebook.com/adpreferences), or with a content-blocking extension — the pages work fully without them. The app itself uses cookies/local storage necessary to keep you signed in, plus product analytics (PostHog) to improve the product.

9. Changes

We will post updates here and, for material changes, notify account holders by email or in-app.

CoachHQ Apps FZCO, IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE · privacy@hq.coach