Privacy Policy

1. Overview

TrainerStack is a multi-tenant software platform that helps sports and chess academies run their operations — managing students, guardians, coaches, groups, batches, classes, attendance, billing, credits, notifications, and reports. This Privacy Policy explains what personal data the platform handles, why, how it is shared, and the choices and rights available to the people it concerns.

This policy covers the TrainerStack marketing site, the academy admin workspace, and the public invite and payment pages (together, the “Service”).

2. Our role: controller and processor

TrainerStack operates in two distinct roles depending on the data involved. This distinction matters because it determines who is responsible for the data and who you should contact about it.

• As a processor (on behalf of an academy). When an academy adds and manages its students, guardians, coaches, staff, attendance, invoices, and related records, the academy is the data controller and decides how that data is used. TrainerStack processes it only to provide the Service under the academy’s instructions. If you are a student, guardian, or member of an academy, please direct requests about your data to that academy first; we will support them in responding.
• As a controller. For data about the academy account itself — the owner and staff accounts used to sign in, SaaS subscription and billing details with TrainerStack, support communications, and usage and security logs of the platform — TrainerStack is the data controller.

3. Personal data we handle

The categories of personal data processed through the Service include:

• Account & identity: name, username, email address, phone number, password (stored only as a secure hash), profile photo, role and permissions, and sign-in activity such as last-login time.
• Student records: name, email, phone, gender, date of birth, admission and enrollment details, school name and grade, skill level, profile photo, postal address, and free-text notes added by the academy.
• Guardian records: name, email, phone, occupation and company, the relationship to a student, and WhatsApp contact preferences and delivery status.
• Academy & operations data: groups, batches, classes and sessions, attendance, credits and ledgers, reports, and audit logs of privileged actions.
• Billing & payments: plans, discounts, subscriptions, invoices, and payment transaction records. Card and bank details are entered directly with the relevant payment provider; TrainerStack does not store full card numbers.
• Communications: email and WhatsApp notifications (invites, class and invoice updates, reminders, monthly reports) and their delivery logs.
• Technical data: IP address, device and browser information, request identifiers, and application logs, used to operate and secure the Service.

4. Children’s data

Academies use the Service to manage students who may be children. TrainerStack does not knowingly collect children’s data directly from children and provides no direct login or marketing to them. Student records are created and managed by the academy, which is responsible for having the appropriate legal basis — including any required parental or guardian consent — before entering a child’s information. If you believe a child’s data has been provided without proper authorization, contact the relevant academy or us at privacy@trainerstack.io and we will work with the academy to address it.

5. How we use personal data

• To provide, maintain, and support the academy workspace and its features.
• To authenticate users and enforce role-based access and data isolation.
• To process academy (SaaS) subscriptions and to enable each academy to bill its own students through the academy’s connected payment provider.
• To send operational notifications by email and WhatsApp when an academy enables them.
• To generate reports, exports, and audit trails requested by the academy.
• To secure the Service, prevent abuse, debug issues, and comply with legal obligations.

We do not sell personal data, and we do not use student or guardian data for advertising.

6. Service providers and sub-processors

We share personal data with vetted service providers who process it on our behalf to run the Service, under contractual confidentiality and security obligations. These include:

• Cloud hosting & database — application servers and the PostgreSQL database that store academy data.
• File storage — object storage for uploads such as logos, favicons, and profile photos.
• Payments — Stripe and Razorpay, both for TrainerStack’s own SaaS subscriptions and for academies collecting fees from their students with their own connected accounts.
• Messaging & email — SendGrid for transactional email and a WhatsApp notification provider for guardian messaging.
• Online classes — LiveKit for real-time video in online class sessions.
• Background jobs — Upstash QStash for scheduled tasks such as monthly report delivery.
• Optional integrations — ChessLang, when an academy chooses to connect it to sync entities. Integration tokens are encrypted at rest.

We may also disclose data where required by law, to enforce our terms, or to protect the rights, safety, and security of our users and the Service.

7. International transfers

Our providers may process data in countries other than where you are located. Where data is transferred across borders, we rely on appropriate safeguards (such as standard contractual clauses) and require providers to maintain adequate protection.

8. Data retention

We retain personal data for as long as an academy’s account is active and as needed to provide the Service. Many records are soft-deleted first so academies can recover from mistakes, and are then removed on a scheduled basis. When an academy closes its account, we delete or anonymize its data within a reasonable period, except where we must retain certain records (for example, invoices and payment records) to meet legal, tax, or accounting obligations.

9. Security

We take technical and organizational measures to protect personal data, including encryption in transit, hashed passwords, encrypted integration tokens, strict tenant-level data isolation, role-based access controls with fine-grained permissions, audit logging of privileged actions, and security middleware on all requests. No system can be guaranteed completely secure, but we work to protect data appropriate to its sensitivity.

10. Your rights and choices

Depending on your location, you may have rights to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. Because most student and guardian data is controlled by an academy, we will usually direct such requests to the relevant academy, which can act on the records directly in the platform. For data where TrainerStack is the controller, or to raise a concern, contact us using the details below. You may also opt out of non-essential notifications through the academy’s notification settings.

11. Cookies and similar technologies

We use strictly necessary cookies and local storage to keep you signed in, remember preferences such as theme, and operate the Service securely. We do not use third-party advertising cookies.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify academies through the Service. Continued use of the Service after an update constitutes acceptance of the revised policy.

13. Contact us

For questions about this policy or your personal data, contact us at privacy@trainerstack.io. If you are a student, guardian, or academy member, please also contact your academy, which controls your records within the platform.