Privacy Policy

VDR Consulting Limited (company number 15311355), trading as "Coach Kaidenz", is the data controller for the personal data described in this policy. We're registered in England & Wales. This policy explains what data we collect, why, and what rights you have over it, in line with UK GDPR and the Data Protection Act 2018.

1. What we collect

To provide the service, we collect and process:

• Account information: name, email address, and authentication details, handled via our identity provider (Clerk)
• Training data: activity files you upload (FIT, TCX, GPX, CSV), including heart rate, power, pace, GPS location, and other performance metrics recorded by your device
• Health-adjacent data: metrics like heart rate variability, resting heart rate, and any health context you share in conversation with your coach — this is used solely to inform your training guidance
• Conversation history: your messages with Coach Kaidenz, so the coaching can build on past context
• Payment information: handled directly by our payment processor (Paddle) — we don't store your full card details ourselves
• Usage data: basic technical data about how you use the service, for reliability and improvement purposes

2. Why we process it, and our legal basis

• To provide the service (performance of a contract) — your training data and conversation history are processed to generate plans, analyse sessions, and power your coaching conversations. The service cannot function without this.
• To process payment and manage your subscription (performance of a contract)
• To maintain and improve the service (legitimate interest) — for example, understanding aggregate usage patterns to fix problems or improve reliability. We don't use your individual training data to train AI models without your explicit consent.
• To communicate with you about your account, billing, or material changes to the service (performance of a contract / legitimate interest)

3. Who we share data with

We use a small number of third-party service providers to run Coach Kaidenz. Each processes data on our behalf, under contractual data protection terms — none of them are permitted to use your data for their own purposes:

• Anthropic — processes your conversation content and training data to generate coaching responses (the underlying AI model)
• Supabase — hosts our application database
• Clerk — handles authentication and account management
• Paddle — processes subscription payments and billing
• Vercel — hosts the application itself

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

4. International data transfers

Some of our service providers are based outside the UK, principally in the United States. Where we transfer personal data outside the UK, we rely on appropriate safeguards recognised under UK GDPR — including Standard Contractual Clauses or equivalent mechanisms provided by our processors — to ensure your data continues to receive an appropriate level of protection.

5. How long we keep your data

We retain your account and training data for as long as your account is active, so your coaching history remains useful to you. If you delete your account, we'll delete or anonymise your personal data within a reasonable period, except where we're required to retain certain records (for example, billing records) for legal or accounting purposes.

6. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Have inaccurate data corrected
• Request erasure of your data ("right to be forgotten")
• Request a copy of your data in a portable format
• Restrict or object to certain processing
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact us at kaidenz.help@gmail.com. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we haven't handled your data properly.

7. Security

We use reputable, industry-standard providers for authentication, hosting, and data storage, and rely on their security practices alongside our own access controls. No system is completely secure, but we take reasonable technical and organisational steps to protect your data.

8. Children

Kaidenz is not intended for anyone under 18. We don't knowingly collect data from children.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll let you know before they take effect.

10. Contact

For any questions about this policy or how we handle your data, reach us at kaidenz.help@gmail.com.