Trainer privacy notice

1. Which data this covers

This notice is about you: the person or business that holds a Push account, and anyone who visits our website. For this data Push is the controller. Push is provided by VERSATECH LTD, company number 17298768, registered office 1 Watson Close, Wellingborough, United Kingdom, NN8 5UH, registered with the Information Commissioner's Office under number [ICO NUMBER].

It is not about your clients' data. There, you are the controller and Push is your processor — see section 9 of the platform terms of service, and the client-facing privacy policy your clients are shown.

2. What we collect

• Account details — name, email address, phone number, password (stored hashed), profile photo, the details of your workspace, and any optional profile details you add, such as date of birth.
• Your confirmation that you are 18 or over, from the tick box at sign-up.
• Sign in with Google details, if you use it — the email address, name and profile picture Google gives us.
• Business details — your public page content, trading name, location and address if you publish them, qualifications and services, your packages and prices, and the payment details you show clients under How to pay me. Addresses you look up are sent to Google to find them.
• Billing details — plan, subscription status, invoices and payment history, and the status of the Stripe account you connect for client payments. Card details are held by Stripe and are not stored by Push.
• Records of which terms you accepted — the version, the time, your IP address and your browser. If you close your account we keep these with your email address stored only in hashed form.
• Security and technical data — IP address, device and browser, sign-in sessions and server logs, collected to keep the service secure and working.
• Errors — when something goes wrong in the apps or on our servers, we record what failed, where, and when, in our own error log on our own servers. We leave out what you typed, passwords, sign-in tokens and other personal details, though an error can still be linked to the account it happened to.
• Notification settings — if you turn on notifications, the address your browser gives us to deliver them to.
• Support correspondence — what you send us and our replies.
• A partner's code, if you signed up with a partner's link or code — which partner referred you, and whether your membership has been paid for, so we can pay them their commission. See section 4.

How you use Push

We record, against your account:

• which days you use each Push app, and what type of device you use;
• which parts of the app you open each day (for example check-ins or plans), but not what you do or type in them;
• each sign-in: when, how (password or Google), whether it worked, the device type, and the country and region worked out from your IP address (the IP address itself is not kept for this);
• which in-app guides you start, finish or skip;
• when you sign up: where you came from — the campaign tags on the link you followed, the website that referred you and the page you landed on — and your approximate location: your country, from your device's time zone, and your region and city, estimated from your IP address at sign-up.

We use this to run, support, secure and improve Push and to understand which marketing works, on the basis of our legitimate interests. Our staff can see it for your account when they support you; otherwise we look at it in aggregate. IP geolocation data is by DB-IP, licensed under CC BY 4.0, and is looked up on our own servers.

Cookies and our website

In the apps we only use cookies needed to sign you in, keep you signed in and finish signing in with Google. We do not use analytics or advertising cookies.

On our marketing website we count visits with Cloudflare Web Analytics, which does not use cookies. The website keeps where you arrived from in your browser tab's session storage, cleared when you close the tab, only to pass it to sign-up. If you arrive through a partner's link, the website stores the partner's code in a cookie called push_aff and in your browser's storage for 60 days, so that the partner is credited if you sign up. You can clear it at any time in your browser's settings.

3. Why we use it, and on what basis

• To provide the service and administer your account — performance of our contract with you.
• To take payment, pursue unpaid fees and keep tax records — contract and legal obligation.
• To keep the platform secure, prevent fraud and abuse, and find and fix faults — legitimate interests.
• To understand how Push is used, improve it, and measure our marketing — legitimate interests.
• To keep evidence of which terms you accepted, and to establish, exercise or defend legal claims — legitimate interests.

We do not send you marketing. The emails we send are about your account, your subscription and your clients.

4. Who we share it with

Only with the suppliers we need to run the service, each under contract and only for that purpose. We do not sell your data.

Stripe also acts as a controller in its own right for the Stripe account you connect, under its own terms and privacy policy. Your public page, and what you publish on it, is visible to anyone. We may disclose data where the law requires it, to protect someone's safety, to establish or defend a legal claim, or to a buyer of our business, who would have to keep it under the same terms.

We do not send your personal data, or your clients', to any AI provider. The Push team uses an AI tool (OpenAI) only to help draft and illustrate content for Push's own libraries of meals and exercises, and nothing about you or your clients is sent to it. Photographs are resized and cut out from their background on our own servers.

If you join through a partner. Some people who recommend Push are partners in our affiliate programme, and we pay them a commission when a coach they referred becomes a paying member. If you sign up with a partner's link or code, we record that you did, and the partner sees your first name, the initial of your surname, your town and country, the date you joined and the status of your subscription (for example, on a trial; paid, and the date your first payment went through; or cancelled before paying), and nothing else. They never see your email address, your clients, your business details or what you pay. We share this so the partner can check the commission we pay them is right, on the basis of our legitimate interests, and they may use it only for that. If you would rather a partner did not see it, sign up without their link or code.

5. How long we keep it

We do not delete anything on a timer, including when your free trial or subscription ends. Your workspace and its records are the coaching history you and your clients rely on, so we keep them until you delete them, you close your account, or you ask us to delete them. You can ask us at any time.

• Your account — while it is open. Closing it is immediate: we delete your account and your workspace as soon as you close it.
• Usage records (section 2) — while your account is open; deleted with it, except a history of account events (such as signing up, subscribing and closing the account), which we keep without your name or email address.
• Payment records — at least 6 years, as tax law requires, kept after you close your account.
• Records of which terms you accepted — kept after you close your account, as evidence of what was agreed.
• Server logs — 30 days. Access logs (which include IP addresses) — 90 days.
• Backups — deleted data can remain in our encrypted backups for up to 7 days, and deleted files in encrypted storage versions for up to 90 days.

6. Where it is stored

Your data is stored in the United Kingdom, on Amazon Web Services in London. Stripe, Resend, Google, Mapbox, Cloudflare and the push services may process data outside the UK, including in the United States, as the table in section 4 shows. For those transfers we rely on the safeguards UK law requires: UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum. If you use Push from outside the UK, your data is sent to and stored in the UK.

7. Your rights

You can download your account data, and the records of any workspace you own, from Settings › Your data. For anything else — a copy of other data we hold, correcting it, deleting it, or restricting or objecting to how we use it (including the usage records in section 2) — write to us at support@versatech.uk. We respond within one month. You can close your account yourself from Settings. You can also complain to the Information Commissioner's Office, though we would rather you came to us first.

8. Contacting us

VERSATECH LTD, 1 Watson Close, Wellingborough, United Kingdom, NN8 5UH. Email: support@versatech.uk. ICO registration number: [ICO NUMBER].

9. Changes

When we change this notice in a way that matters, we will tell you in the app before the change applies to you. The version and date at the top of this page identify the wording in force.