Privacy Policy

1. Information We Collect

We collect the following categories of information:

• Account data: Name, email address, role, and agency affiliation provided during signup.
• Usage data: Pages visited, features used, timestamps, and IP addresses for security and analytics.
• Content data: Workout plans, exercise records, client progress, and other data you create in the Service.
• Payment data: Billing address and payment method details processed by our payment provider (Stripe). We do not store card numbers.
• Communication data: Messages you send to our support team.

2. How We Use Your Information

• To provide, operate, and maintain the Service
• To process payments and manage subscriptions
• To send transactional emails (welcome, invoices, password resets)
• To detect and prevent fraud, abuse, and security incidents
• To respond to support requests
• To comply with legal obligations

3. Data Isolation Between Agencies

TrackHQ is a multi-tenant platform. Each agency's data is strictly isolated — no agency can access another agency's trainers, clients, or workout data. This isolation is enforced at both the application layer (JWT-based agency context) and the database layer.

4. Data Retention

We retain your account data for as long as your account is active or as needed to provide the Service. If you cancel your account, we will delete or anonymise your data within 90 days, unless we are required by law to retain it longer.

Demo and inactive accounts are subject to automated cleanup after a configurable retention period (default: 15 days for demo accounts).

5. Sharing of Information

We do not sell your personal data. We share data only with:

• Stripe — payment processing
• Resend — transactional email delivery
• Cloud infrastructure providers — hosting and storage (data remains in the EU/UK)
• Law enforcement — when required by applicable law

6. Security

We implement industry-standard security measures including JWT authentication with token blacklisting, bcrypt password hashing, TLS in transit, and encrypted storage at rest. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

7. Cookies

We use strictly necessary cookies to maintain your authentication session. We do not use third-party advertising or tracking cookies.

• auth_token — stores your JWT session token (session duration)
• csrf_token — CSRF protection (session duration)

8. Your Rights (GDPR)

If you are located in the EEA or UK, you have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Portability: Receive your data in a machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Restriction: Request restriction of processing in certain circumstances.

To exercise any of these rights, email privacy@trackhq.ie. We will respond within 30 days.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or via an in-app notice at least 30 days before the change takes effect.

10. Contact

For privacy enquiries, contact our Data Protection Officer at info@trackhq.ie. Registered address: Speeir Limited, England and Wales.