Privacy Policy

The data controller responsible for your personal data is:

Coachess SRL
A Romanian limited liability company (societate cu răspundere limitată)
Registered office: [FILL IN REGISTERED ADDRESS]
Trade Registry number: [FILL IN J40/... NUMBER]
Tax identification code (CUI): [FILL IN CUI]
Email: privacy@coachess.org

If you have any questions about this Policy, how we use your data, or how to exercise your rights, please contact us at the email above.

We collect only the data we need to run the Service. Specifically:

Under the GDPR we must have a lawful basis for processing your personal data. The basis depends on the purpose:

• Performance of a contract (Article 6(1)(b) GDPR) — for Account creation, authentication, lesson progress tracking, rating tests, training sessions, and (when PRO launches) Subscription billing and delivery. We need this data to provide the Service you signed up for.
• Consent (Article 6(1)(a) GDPR) — for game imports from Lichess and Chess.com. You explicitly trigger the import by entering your platform username. You can withdraw consent at any time by deleting your imported games (see Section 6).
• Legitimate interests (Article 6(1)(f) GDPR) — for security logging, abuse prevention, fraud detection, and aggregated cookieless analytics. We assess that these interests do not override your fundamental rights and freedoms because the data is minimal, short-lived, and not used to profile individuals.
• Legal obligation (Article 6(1)(c) GDPR) — for invoicing, accounting, and tax reporting records we are required by Romanian and EU law to retain.

We do not sell your personal data. We share data only with the following categories of recipients, and only to the extent necessary for the purposes described:

• Google LLC (United States) — provides the Sign-In with Google flow. You authenticate directly with Google; Google returns your profile data to us. Governed by the EU–US Data Privacy Framework.
• Lichess (France) and Chess.com, LLC (United States) — public APIs from which we retrieve your own games when you ask us to. We only query these with the username you provide.
• Stripe, Inc. (United States; future) — will process PRO subscription payments when the paid tier launches. Stripe is certified under the EU–US Data Privacy Framework and is itself an independent data controller for card data.
• Anthropic, PBC (United States; future) — will process messages you send to the Boris coach chat to generate responses. Anthropic offers data processing terms consistent with GDPR.
• Resend, Inc. (United States) — delivers transactional email (e.g. sign-in notifications, subscription receipts). Resend acts as our data processor.
• Hosting and infrastructure providers — Coachess is hosted on servers located in the European Union. Our infrastructure, databases, and engine analysis all run on our own servers; user data does not leave our infrastructure except where sent to the specific third parties listed above.
• Legal and professional advisors — lawyers, accountants, and auditors bound by confidentiality, where disclosure is necessary for legal, accounting, or compliance reasons.
• Authorities — if we are legally required to disclose data in response to a valid order from a competent court or authority, or where disclosure is necessary to protect the rights, safety, or property of Coachess, our users, or the public.

We do not share your data for advertising, retargeting, or any form of behavioral profiling by third parties.

Coachess' servers are located in the European Union. Some third parties we use (notably Google, Stripe, Anthropic, Resend) are based in the United States. When personal data is transferred outside the European Economic Area, we rely on one or more of the following safeguards:

• The EU–US Data Privacy Framework, where the recipient is certified under it;
• Standard Contractual Clauses approved by the European Commission;
• Your explicit consent, where the transfer is triggered by your specific action (e.g. signing in with Google).

You can request a copy of the relevant safeguards by emailing privacy@coachess.org.

• Account data and learning progress — for as long as your Account exists. If you delete your Account, this data is removed within 30 days, except for records we must keep for legal reasons.
• Imported games and diagnostic reports — until you delete them from your Account or delete your Account. You can request deletion at any time by emailing privacy@coachess.org.
• Server and security logs — retained for up to 90 days and then automatically purged, unless retained longer for investigation of a specific security incident.
• Payment and invoicing records — retained for the period required by Romanian and EU accounting and tax law (currently up to 10 years for some records), even if you close your Account.
• Analytics — aggregated, non-identifying usage data is retained for up to 12 months.

If you are in the European Economic Area, the United Kingdom, or another jurisdiction that grants similar rights, you have the following rights in relation to your personal data:

• Right of access (Article 15) — obtain confirmation of whether we process your data, and a copy of the data.
• Right to rectification (Article 16) — have inaccurate or incomplete data corrected.
• Right to erasure / “right to be forgotten” (Article 17) — have your data deleted in the circumstances set out in the GDPR.
• Right to restriction of processing (Article 18) — ask us to stop processing your data while a dispute is resolved.
• Right to data portability (Article 20) — receive the data you provided to us in a structured, commonly used, machine-readable format, and transmit it to another controller.
• Right to object (Article 21) — object to processing based on legitimate interests.
• Right not to be subject to automated decision-making (Article 22) — we do not use your data for any decision that has legal or similarly significant effects on you without human involvement.
• Right to withdraw consent — where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of processing already carried out.

To exercise any of these rights, email privacy@coachess.org. We will respond within 30 days (extendable by another 60 days for complex requests, in which case we will let you know). We may need to verify your identity before acting on a request, to protect you from impersonation.

You also have the right to lodge a complaint with a supervisory authority. In Romania that is the National Supervisory Authority for Personal Data Processing (ANSPDCP), dataprotection.ro. You may also complain to the supervisory authority of the EU Member State where you live or work.

Coachess uses a minimal set of cookies strictly necessary for the Service to function (session authentication, CSRF protection). We do not use third-party advertising cookies and we do not use cross-site tracking. For details, see our Cookie Notice.

The Service is not directed to children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has provided us with personal data, please contact privacy@coachess.org and we will delete the data.

We take the security of your personal data seriously. Our technical and organizational measures include:

• Encryption in transit (HTTPS / TLS) for all connections to the Service
• Encryption of secrets and authentication tokens at rest
• Access controls limiting who in our organization can access personal data
• Regular software updates and security patches
• Separation of production and development environments
• Database backups stored in the European Union

No system can be guaranteed 100% secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by Article 33 GDPR, and we will notify you without undue delay if the breach is likely to result in a high risk to your rights and freedoms (Article 34 GDPR).

The Service uses automated processing to generate chess analysis and training recommendations (for example, Stockfish evaluations and diagnostic findings). This processing does not produce legal or similarly significant effects on you within the meaning of Article 22 GDPR — it is an educational tool you consult voluntarily.

We may update this Privacy Policy to reflect changes in the Service, in applicable law, or in our data-handling practices. If we make material changes, we will notify you by email and by posting a notice on the Service at least 30 days before the changes take effect, unless the changes are required by law or relate to a new feature. The “Last Updated” date at the top of this page tells you when the Policy was most recently revised.

For any privacy-related question, complaint, or request, contact us at:

Coachess SRL
[FILL IN REGISTERED ADDRESS]
Romania
Email: privacy@coachess.org