Va'a Coaching Privacy Policy

DRAFT v0.1 — 2026-09-24. Not legal advice. Written from what the Va'a Coaching system is planned to do (see PLAN.md). A qualified lawyer must review it before launch, especially the children's section (COPPA), the EU/France section (GDPR) and the Japan section (APPI). Items in [brackets] are placeholders to fill in.

Effective date: [date] Last updated: [date]

Va'a Coaching ("Va'a Coaching", "we", "us") is the online paddling training platform of [ARE Tahiti legal entity name], [address], United States. This policy explains what personal information we collect through vaacoaching.com, the Va'a Coaching iOS and Android apps, live classes, coaching calls and related services (together, the "Services"), how we use it, and the choices and rights you have.

The short version:

• We collect only what we need to train you and run your account.
• All of your data is stored in the United States.
• We never sell your personal information and we don't share it for targeted advertising. There is no pooled "marketing network".
• There are no third-party ad or tracking tools in our apps, and non-essential cookies on our website load only if you agree.
• Most AI features run on our own servers. When we use a cloud AI service, we remove names, emails and phone numbers first, and our providers may not train their models on your data.
• Children under 13 can train with us only through a parent's account and with the parent's consent (see section 9).
• You can download or delete your data at any time from your account's Your data & privacy page.

---

1. Who is responsible for your data

[ARE Tahiti legal entity name] is responsible for (the "controller" of) the personal information described in this policy. Privacy contact: [privacy@vaacoaching.com] · [postal address] [If required under GDPR: EU representative name and address]

2. Information we collect

2.1 Information you give us

Category	Examples
Account	Name, email, password (stored only as a secure hash) or passkey, preferred language, profile photo (optional)
Paddler profile	Birth year, paddling level, club and crew, goals, the canoes you paddle (e.g. V1, V6)
Parent / guardian	For children's accounts: the parent's name, email and the consent they gave (see section 9)
Purchases	What you bought, price, date, billing country/ZIP for tax. Card details go directly to Stripe, Apple or Google; we never see or store your full card number
Training content you create	Quiz answers, course progress, notes, comments, community posts, messages to coaches
Technique videos	Videos of yourself paddling that you record or upload for review
Coaching and live sessions	Bookings, attendance, audio/video during calls, and recordings when a session is recorded (you are always told before recording starts)
Waivers and safety	Your signed liability waiver (name, date, time, IP address/device, waiver version) and an emergency contact (name, relationship, phone), whom you confirm agreed to be listed
Training log	Workouts you log (distance, time, pace, effort, notes), training plans assigned to you, skill levels and badges
Canoe registration	For ARE canoe owners: model, serial number, purchase date, dealer, proof of purchase, and warranty claim photos
Clinics and camps	Registrations, attendance (QR check-in), seat/canoe assignments, post-event feedback
Gifts and referrals	Gift recipient's name and email (used only to deliver the gift), referral links and rewards
Paddling spots	Locations you save to see wind, swell and tide. We do not track your device's location in the background
Support	Messages you send us
Website inquiries	If you use "Send us a message" on our website without signing in: your name, email address (stored encrypted), the topic and your message, the language and page you wrote from, and a scrambled (hashed) network address used only to limit misuse. We use it only to answer you (and send you a confirmation); never for marketing

2.2 Information collected automatically

Category	Examples
Usage	Lessons watched, video progress, features used, errors. Collected by our own first-party analytics, without third-party trackers
Device	App version, device model, operating system, language, time zone, push-notification token
Log and security	IP address, browser type, sign-in times, security events (used to protect your account and stop abuse)
Cookies	See section 7

2.3 Information we create from your content

• Transcripts, subtitles, chapters and summaries of course videos, live classes and (if recorded) coaching sessions.
• Technique analysis: from your technique videos we compute body-position points ("pose data") and paddling metrics such as stroke rate, reach, rotation and timing, and we draft feedback. Pose data is stored as numbers. We do not use facial recognition and do not use pose data to identify you.

2.4 Information from others

• Payment providers (Stripe, Apple, Google) tell us whether a payment, renewal or refund succeeded.
• Your club may add you to a club account or crew roster.
• Coaches add training notes and feedback to your record.

We do not buy personal information from data brokers.

3. How we use your information

Purpose	Legal basis (for EU/UK users)
Create and run your account, deliver courses, coaching, live classes and the apps	Contract
Process payments, subscriptions, renewals and refunds	Contract; legal obligation (tax, accounting)
Give technique feedback and track your progress	Contract; consent for technique-video analysis
AI features: tutor answers from our course content, search inside videos, subtitles and translations (English, Japanese, French), summaries	Contract; legitimate interest in improving training
Record live classes and coaching sessions for replays	Consent / legitimate interest, with notice before recording
Send service messages (receipts, booking reminders, security alerts)	Contract
Run the referral program: record that you joined through a friend's link, check eligibility (not an existing customer, not the same payment account, a yearly limit, sign-ups from the same network reviewed by staff) and give both of you gift-card credit	Legitimate interest in rewarding referrals and preventing abuse. The person who invited you only sees counts, never who you are or what you bought. Adults only
Deliver a gift card you bought to the person you name (their name and email, your message, one email on the day you choose)	Contract with you; legitimate interest of the recipient in receiving the gift
Send news emails (newsletters)	Consent: an unticked box at sign-up or the switch on your privacy page, sent only once your address is confirmed; never to children; one-click unsubscribe in every email
Keep the Services safe: fraud prevention, abuse detection, content moderation, security logs	Legitimate interest; legal obligation
Improve the Services using first-party, aggregated analytics	Legitimate interest (EU: consent where required for cookies)
Comply with law and enforce our Terms	Legal obligation; legitimate interest

We do not use your data for targeted advertising, and we do not make decisions with legal or similarly significant effects about you based solely on automated processing.

4. Artificial intelligence

• Local first. Most AI processing (transcription, translation, technique analysis, tutor answers, search) runs on servers we operate in the United States.
• Cloud AI. Some tasks (for example polishing a translated sales page) may use Microsoft Azure OpenAI Service or Azure AI Speech in the United States. Before anything is sent, we remove names, email addresses and phone numbers. Microsoft processes it under its enterprise terms and does not use it to train its models.
• Children's data is never sent to cloud AI services.
• No training on your data. We do not use your personal information to train general-purpose AI models.
• AI output can be wrong. Technique feedback is an estimate. For paid coaching and for all children, a coach reviews AI feedback before you see it.
• The website guide "Hoku". Everyone (visitors, possible clients and signed-in members) can ask a chat guide on vaacoaching.com about our courses, prices, coaches, clinics and how the site works. It answers only from the public content of this website and fixed how-to texts, never from anyone's account, orders or records. When no AI service is available it simply picks the matching part of our website's own content, without any AI. The questions and answers are not saved (only the number of words processed and which AI service handled them are counted, without the text), and we ask visitors not to share personal details in the chat. To limit misuse, we briefly keep a scrambled (hashed) version of your network address in the server's memory to count how many questions come from one place; it is not written to any database. Because no personal record is attached, a question may be handled by Microsoft Azure OpenAI Service if our own servers are busy, after we remove email addresses and phone numbers from it. (DRAFT for lawyer review: confirm the wording and whether a notice at the chat button is enough.)
• You can turn optional AI features off in your settings.

5. How we share your information

We do not sell personal information and do not "share" it for cross-context behavioral advertising (as those terms are defined under California and other US state laws).

We share information only with:

Recipient	Why	Location
Microsoft Azure (Front Door, Blob Storage, OpenAI Service, AI Speech, Communication Services Email)	Hosting and delivering video and files, security (firewall), limited AI tasks, sending email	United States
Stripe	Web payments, subscriptions, tax calculation	United States
Apple and Google	In-app purchases, push notifications (Apple Push Notification service, Firebase Cloud Messaging; notifications carry no personal content)	United States / global
[WorkSuite / operator of livekit.worksuite.cloud]	Real-time video and audio for live classes and coaching calls	[United States]
Your coach and ARE Tahiti staff	Delivering your training; access is limited to the coaches assigned to you	—
Your club manager	If you train through a club: your progress in club programs	—
Other members	Only what you choose to post in the community (children's posts are limited; see section 9)	—
Professional advisers, authorities	When required by law, to protect rights and safety, or in a legal claim	—
A buyer or successor	If our business is sold or merged, subject to this policy	—

Our service providers may use your information only to provide services to us, under written contracts. A current list is available at [vaacoaching.com/subprocessors].

Things you choose to share.

• Certificates: each certificate has a code that anyone you give it to can check on vaacoaching.com. The check shows only your first name, the initial of your last name, the course and the date.
• Your club: if you belong to a club, you can choose to share your progress with its managers (course progress, this week's training, whether your waiver is signed, your level). Parents choose for their children. Without that choice the club's managers see only your first name and initial. You can stop sharing at any time on the My club page.
• Community: posts, comments and mahalos in the community are seen by the members of that space (everyone, your club, or the students of a course). Members see you by first name and last initial; coaches and staff by full name. Paddlers under 18 can post only in their own club's space, and children take part only through a parent's account. You can delete what you wrote at any time; moderators can hide posts that break the rules, and they're kept for the record. Erasing your account removes everything you wrote.
• Live classes: you join a live class without camera or microphone; other members see your first name and initial. If the coach brings you on stage (adults only), everyone in the class sees and hears you. We keep a list of who joined each class for the coach; it's in your data download and removed if you ask for deletion. Classes aren't recorded by the platform yet; a coach may attach a separate video as the replay.
• Ocean conditions: the forecasts on the site come from Open-Meteo and NOAA (US National Weather Service and tide predictions). We send them only the coordinates of our paddling spots, never anything about you.
• Gift cards: when you buy a gift card for someone, you give us their name and email so we can send it. We use them only for that email (and a resend if they ask), store them encrypted, and never add them to newsletters. The code itself works like cash: anyone who has it can spend the balance.
• Calendar subscriptions: if you add your sessions to Google, Apple or Outlook calendar, the private link sends your session times, places and (for coaches) paddlers' first names and initials to that calendar provider. Anyone with the link can see them, so keep it private; if it leaks, ask us and we reset it.

6. Where your data is stored

All personal information is stored in the United States, on our servers there and in Microsoft Azure US regions (with a backup copy in a second US region). If you use the Services from outside the United States (for example from Japan or France), your information is transferred to the United States. For EU/UK users we rely on [the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses]. For users in Japan, see section 12.

7. Cookies and similar technologies

• Strictly necessary cookies (sign-in, security, checkout, remembering your cookie choice) are always on.
• A friend's invitation: if you open a friend's share link, a first-party cookie holds only their share code for up to 30 days, so your sign-up counts as their referral. It's deleted when you sign up.
• Your language choice is remembered in a small preference cookie, set only when you pick a language (on your account instead when you're signed in).
• Today vaacoaching.com sets no analytics or marketing cookies at all and loads nothing from other websites.
• Analytics: our own first-party, privacy-friendly analytics. [Where the law requires consent, it runs only after you agree.]
• Marketing pixels (e.g. Google Analytics, Meta Pixel), if we ever use them, load only after you opt in.
• Our cookie banner makes "Reject all" as easy as "Accept all", and you can change your choice at any time from the footer link "Cookie settings".
• We honor Global Privacy Control (GPC) browser signals as an opt-out.
• Our apps contain no third-party analytics, advertising or attribution SDKs.

8. How long we keep information

Data	How long
Account and profile	While your account is open, then deleted or anonymized within [90] days after you close it
Accounts nobody uses	If there's no sign-in or other activity (purchases, lessons, training, sessions) for [3] years, we email you, and 30 days later delete or anonymize the account as above unless you sign in. A parent's account includes the children's profiles
Purchase and tax records	As long as tax and accounting laws require (typically [7] years)
Gift cards	The card and its balance history as purchase records; the recipient's name, email and your message until the card expires (five years), or sooner if you ask for deletion
Course progress, quiz results, certificates	While your account is open; progress on a course whose access ended more than [3] years ago is deleted (certificates and levels stay)
Technique videos	[180] days after upload unless you choose to keep them; children: [90] days. Metrics and coach feedback stay in your progress history until you delete them
Session recordings	As long as the replay is offered, or until you ask us to remove your part where feasible
Messages and community posts	While your account is open, unless you delete them earlier; a conversation with our staff with no new message for [3] years is deleted
Download and listening history	[2] years
Website inquiries ("Send us a message" without an account), with our replies	[90] days after the inquiry is closed; an inquiry never closed, [180] days after it arrived. Deleted sooner if you ask
Email and notification logs (which message went out, never its text)	[180] days for emails to you; [90] days for app notifications
Signed waivers	For as long as a claim about the activity could be brought (typically [the limitation period plus 1 year]; for a child, counted from when they turn 18). After an erasure request the signature is kept but no longer linked to your profile details
Training log, emergency contact	While your account is open; deleted when you ask for deletion
Security logs	[12] months
Record of privacy requests	[3] years after the request is closed, to show we handled it
Marketing consent records	For as long as needed to prove consent, then [3] years

We may keep information longer when we must preserve it for a legal claim, an investigation or a request from the authorities (a "legal hold"); it is deleted on the normal schedule once the hold ends.

[Note for the lawyer — 2026-09-29, retention as the system now enforces it (Settings → Data retention). Please confirm or change each period; nothing here is final.]

• Every automatic deletion rule above starts switched off; staff preview how much it would delete and then switch it on. Periods are adjustable within limits; the bracketed numbers are the defaults.
• Accounts nobody uses: new rule (default 3 years, notice 30 days before, anonymization through the same process as a deletion request, children with the parent). A running subscription counts as activity; someone who bought lifetime access to a course and never signs in would still be anonymized — please confirm this is acceptable or whether paid lifetime access should count as activity.
• Technique videos: the table says [180] days after upload ([90] for children); the system currently deletes the files 1 year after the coach's review (and unfinished uploads after a day). One of the two must change.
• Security logs [12] months: the audit log is hash-chained and never deleted (deleting entries would break the chain); it holds record ids and peppered IP hashes, not contact details. App device sessions are kept with the account. Please confirm the wording (e.g. "security logs: kept, without contact details") or whether old years must be archived/removed.
• Purchase and tax records and signed waivers are kept and anonymized after erasure, but not deleted automatically at the end of their legal period yet; please confirm the periods (tax: 7 years? waivers: limitation period + 1 year, counted from age 18 for a child?) so they can be enforced.
• Record of privacy requests: deleted [3] years after closing (includes the record of each data download).
• Website inquiries (2026-10-01): messages from people with no account ("Send us a message"; name, email stored encrypted, message, a hashed network address). Proposed: [90] days after closing, [180] days if never closed, both adjustable; found by email address for data downloads and erasure; never used for marketing and no marketing consent is created; the form has a checkbox "ARE Tahiti may email me about this inquiry" (with a link to this policy) and one confirming the writer is 18 or older or a parent/guardian. Please confirm the periods, the wording of the two checkboxes, and that a parent writing about a child needs nothing more.
• Consent records are append-only and kept after erasure, attached to the anonymized record, to prove consent; no deletion yet.
• Session recordings: the system deletes coaching-call recordings after a setting (default 90 days) and at once if anyone withdraws; the table's "as long as the replay is offered" fits live-class replays only.
• Legal hold: staff with the privacy permission can place one (reason, optional end date); it stops the rules above and deletion requests for that person until it ends. Please confirm how a deletion request received during a hold should be answered.
• Members can now see every consent they gave and withdraw news by email, sharing with their club, and session recordings from Your data & privacy → See and withdraw consents (§11).

9. Children's privacy (under 13)

Va'a Coaching welcomes young paddlers, but children under 13 (and, for users in France, under 15) may use the Services only through a family account set up by a parent or legal guardian, and only after the parent gives verifiable consent. We comply with the U.S. Children's Online Privacy Protection Act (COPPA).

What we collect from a child: first name, birth year, club and level, training progress, quiz answers, messages with their assigned coach, and technique videos and session recordings if the parent allows them. We do not ask a child for more information than is reasonably needed to take part.

How it's used: only to provide training. Never for marketing to the child, targeted advertising, or cloud AI.

Extra protections for children:

• No public profile; community participation is limited to their own club or crew, if the parent allows it.
• Private messages only with the assigned coach, and the parent can read them.
• 1:1 video calls only with the parent's permission; the parent may join any call.
• The AI tutor is off unless the parent turns it on. Technique feedback is always reviewed by a coach.
• Coaches who work with children have completed a background check.

Parents' rights. A parent can at any time review the child's information, download it, correct it, stop further collection, withdraw consent, or delete the child's account and data, from the parent dashboard or by contacting [privacy@vaacoaching.com]. We will not require a child to disclose more information than necessary as a condition of participating.

If we learn we collected personal information from a child under 13 without verifiable parental consent, we will delete it.

10. Security

We protect your information with measures including encryption in transit (TLS) and at rest, encryption of sensitive fields, encrypted video delivery, a web application firewall, two-factor sign-in for staff, role-based access limited to what each person needs, audit logs of staff access to personal data, backups that cannot be altered, and regular security testing. No system is perfectly secure; if a breach affects your personal information, we will notify you and authorities as the law requires.

11. Your rights and choices

Everyone can, from Your data & privacy in your account or by emailing [privacy@vaacoaching.com]:

• Access / download a copy of your data in a common format.
• Correct inaccurate information.
• Delete your account and data (subject to records we must keep by law). We complete deletion requests within 30 days; deleting a parent's account also deletes the children's profiles linked to it.
• Unsubscribe from marketing emails (link in every email).
• Withdraw consent (for example to technique-video analysis or recordings) for future processing.
• Turn off optional AI features and non-essential cookies.

US state residents (for example California, Colorado, Connecticut, Virginia, Texas, Oregon and others) also have rights, depending on the state, to know what we collect, to delete and correct it, to obtain a portable copy, to opt out of sale, sharing, targeted advertising and profiling (we do none of these), and not to be discriminated against for using these rights. You may use an authorized agent. If we deny your request, you can appeal by replying to our decision.

EU / UK residents (for example in France) have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent, and the right to complain to a supervisory authority (in France, the CNIL).

How we respond: we verify your identity, then respond within 45 days (US state laws) or one month (GDPR). These periods may be extended where the law allows, and we'll tell you if so. Requests are free.

12. Users in Japan

We handle personal information of users in Japan in line with Japan's Act on the Protection of Personal Information (APPI). Your information is transferred to and stored in the United States, which has no single comprehensive federal privacy law equivalent to the APPI; we protect it with the measures in this policy and in our contracts with service providers. You may ask us to disclose, correct, stop using or delete your information, or for information about transfers, by contacting [privacy@vaacoaching.com].

13. Changes to this policy

We may update this policy. If the changes are significant, we will notify you by email or in the app before they take effect, and, where required (for example for children's data), ask for consent again. The "Last updated" date above shows the latest version.

14. Contact us

[ARE Tahiti legal entity name] — Va'a Coaching [Address] Email: [privacy@vaacoaching.com]