Data processing terms

These terms form part of the terms of service between Nexuf Tech LLC ("Spotter", "we") and each coach ("you"). They apply when we process personal data about your clients on your behalf.

You are the controller and we are your processor under Sri Lanka's Personal Data Protection Act No. 9 of 2022 and, where it applies, the GDPR. We're a separate controller for your own account, billing, and security records.

• People: your clients and prospective clients (including join-request senders), and people named in reviews or transformations you publish.
• Data: contact details, date of birth, gender, height and weight, goals, sessions and attendance, packages and payments you record, workout and meal plans, your private notes, and special category (health) data: body measurements, progress photos and meal photos.
• Purpose: providing Spotter so you can manage your coaching: storing, showing, organising and sharing data with that client, sending notifications, and producing reports and exports.
• Duration: while you use Spotter, then until deletion as described below.

We process client data only on your documented instructions, which are these terms and how you use Spotter's features, unless the law requires otherwise (we'll tell you if so, unless the law forbids it). We don't sell client data, use it for advertising, or use it for our own purposes other than running, securing and supporting Spotter. You are responsible for having a lawful basis and the consents needed, including explicit consent for health data and guardian consent for clients under 18.

Only staff who need it to run or support Spotter can access client data, and they're bound by confidentiality. Support access is view-only, needs a one-time code, lasts up to an hour and is logged.

• Database-level tenant isolation (row-level security) on every table.
• Encryption in transit (TLS) and at rest.
• Client photos in a private storage bucket, served only through links that expire after one hour; upload links expire after five minutes.
• Least-privilege database roles, rate limiting, and audit logs of staff access.
• Automated tests that check one coach can't reach another coach's data.

You authorise the sub-processors listed on our sub-processors page. We bind each to data protection terms at least as protective as these and stay responsible for them. We'll update the list at least 30 days before adding or replacing one that handles client data. You can object on reasonable data protection grounds; if we can't address it, you may cancel and get a refund of prepaid fees for the unused period.

Client data is hosted in Singapore (AWS ap-southeast-1). Some sub-processors operate in the United States and the EU. We make transfers only with safeguards permitted by the PDPA and GDPR, such as standard contractual clauses in our sub-processor agreements.

If we become aware of a breach affecting your client data, we'll notify you without undue delay and within 48 hours, with what we know (what happened, data and people affected, likely consequences, and what we're doing), and update you as we learn more. We'll help you meet your own duties to notify the Data Protection Authority and affected clients.

Most requests can be handled in Spotter: you can view, edit and delete client records. If a client asks us directly, we'll pass the request to you rather than answering it ourselves (unless it concerns their own login). We'll help you with access, correction, deletion and export requests, and with data protection impact assessments, as reasonably needed.

Records older than your plan's history window are hidden, then permanently deleted one year after they were hidden. Records you delete are removed from the app straight away and from backups within about 30 days.

When you close your workspace, you can ask for an export of your client data (CSV or JSON) within 30 days. We then delete it within 30 days, except where the law requires us to keep it. A client's login stays theirs if they also train with another coach.

On request we'll give you the information reasonably needed to show we comply with these terms, including a summary of our security measures and answers to security questionnaires. If that isn't enough, or a regulator requires it, you may audit us with 30 days' notice, at your cost, during business hours, no more than once a year, under confidentiality.

Data protection questions or a signed copy of these terms: dev@nexuf.io, or Nexuf Tech LLC, 30 N Gould St Ste R, Sheridan, WY 82801, United States.