Privacy & Personal Data Protection Policy

1Controller and contact

The controller of your data: Trainer-X — freelance certificate no. FL-298140321, address: Jeddah. For any request about your data: samir.ksa1990@gmail.com.

The platform is the controller of trainees' data as the seller of the service. The trainer assigned to a session processes the trainee's data on the platform's behalf under the “Service Provider Agreement”, only to deliver the session.

2The data we collect

Data you provide

• Account details: name, email, mobile number, city, password (stored with a one-way hash that no one can read). The platform may verify your mobile number with a code sent to you on WhatsApp.
• Training preferences (trainees): goals, training type, suitable times, budget, preferred trainer gender, and any notes you write.
• Health data (optional): what you disclose about injuries or conditions relevant to the trainer for your safety. This is sensitive data we process only with your explicit consent and for the stated purpose.
• Medical clearance or medical report for specialties that require it (such as pregnancy fitness and chronic conditions): uploaded with your explicit consent, seen only by the session's trainer, and deleted automatically a few days after the session.
• Trainer data: National ID or Iqama (the document image, and the ID number stored encrypted — only the verification team can see it, every view is logged, it is used to verify identity and to stop one person opening several trainer accounts, and it is deleted with the account), certificates, freelance certificate or commercial registration and its number, photos, IBAN, account holder name and IBAN certificate, and national address.
• Gender: to show you trainers who serve your group when a trainer limits their services to men or women.
• Content you create: reviews, reports, messages.
• Messages sent through the «Help & support» page by visitors without an account: name, email address, topic and message text, used only to reply to you by email.
• Call log (voice and video): only type, time, duration and outcome. We do not record call audio or video.

Data generated by your use

• Bookings and their statuses and payments (with no card data), invoices, and the record of financial transactions, including trainers' fees.
• Technical data: IP address, browser type, sign-in times, and security logs (such as failed sign-in attempts).
• A count of trainer profile views, aggregated daily and not linked to the visitor's identity: each visitor counts once a day through a temporary encrypted fingerprint that cannot reveal who they are and is deleted the next day.

Data from other parties

• From the payment provider: the transaction status and ID, the last four digits of the card and the card type only.

3Why we process your data and the legal basis

• Performing the contract: creating the account, selling and booking the service, payment, refunds, assigning the trainer to the session, paying trainers' fees, notifications.
• Consent: health data, personalised recommendations, marketing messages (you can withdraw consent at any time without affecting what came before).
• Legal obligation: keeping accounting records and invoices, verifying trainers, responding to requests from competent authorities, combating fraud and money laundering.
• Legitimate interest: platform security, preventing misuse, improving the service with aggregated statistics — without prejudice to your rights.

4Smart recommendations

We recommend trainers to you using a transparent scoring algorithm based on your stated preferences, booking history and favourites. No decisions with legal effect on you are made purely automatically, and you can edit or delete your preferences at any time.

5Who sees your data

• The trainer assigned to your session: your name, the contact method needed for the session, the booking details, and any health notes you choose to share. They process this on our behalf only to deliver the session, and are contractually bound not to use it for any other purpose or share it.
• Service contract: for every confirmed booking we issue an electronic contract between the platform and the trainee, naming the trainer who delivers the session and setting out its details, price, cancellation terms and execution record; it is seen by the trainee, the delivering trainer and the platform team. It shows the trainer's full name to the trainee who booked them. The verification link printed on it shows only the contract number, issue date and status, the service type and time, the trainer's display name, the trainee's initials and the contract's digital fingerprint, and opens only for those who have the link.
• Trainees: see only the trainer's public profile (not their identity, documents, IBAN or fee).
• The bank or payouts provider used to transfer fees (trainers): the trainer's name, IBAN and the amount, to make the transfer of their fee.
• The platform team: each according to their permissions (support, finance, verification), with an audit log of every sensitive action.
• Service providers: the payment provider, the cloud hosting provider, the email provider, WhatsApp Business (Meta) for alerts to those who turn them on and for the optional WhatsApp phone-verification code, the browser push-notification services that deliver notifications to your device, the bank or payouts provider used to transfer trainers' fees, the font service (Google Fonts) from which your browser receives font files, and the writing and translation providers for trainers (see the next section). They are contractually bound to protect the data and don't use it for their own purposes.
• The AI provider (trainers, optional): when a trainer themselves asks to “Improve text” or “Write from notes”, we send only the text they wrote and the names of their specialties to the writing provider, Groq (United States), to prepare a suggestion, and send no other data. The trainer reviews the suggestion and decides whether to use it. What the provider keeps is set out in the next section.
• Operational analysis and automatic reminders: an automated system inside the platform analyses aggregated indicators (numbers of bookings, visits, payments and reports) to detect delays and problems, and sends you service reminders when needed (for example a reschedule request awaiting your answer or a session location not yet confirmed). When the team uses the smart report feature, we send the AI provider aggregated numbers only, without names, contact details or message text. The platform may also send operational notifications to the automation tools the team uses, containing only booking references, statuses and amounts, without your name, email or phone number.
• Competent government authorities: where there is a lawful request.

We don't sell or rent your data to anyone.

6Writing and translation tools (for trainers)

To provide text improvement and machine translation in trainer profiles, we use external cloud processing services: Groq (United States) for improving texts, and DeepL (Germany) for translation.

• The trainer runs them by pressing the improve or translate button, after their explicit consent on first use. The platform team may also use the same tool to proofread published texts (such as a trainer's bio and service descriptions) after contact details are masked.
• We send only the text to be improved or translated, after removing contact details (phone numbers, emails, links and handles) and masking the trainer's name. We don't send identity, account data or any document.
• Texts are processed only to improve or translate them. The translation provider may keep texts under its own policy for its free plan; zero data retention is enabled with the writing provider, so it doesn't keep them.
• The result is a suggestion the trainer reviews and edits; it is saved only if they save it.

7Where data is stored and transferred

The platform's data is currently hosted with a cloud hosting provider in: Germany (Frankfurt), with a cloud hosting provider. Where this involves transferring data outside the Kingdom, we comply with the legal rules on transferring personal data abroad, apply appropriate safeguards (encryption in transit, access restriction, contractual obligations), and transfer only the minimum necessary.

8Retention

• Account data: while the account is active; when it is deleted, records are deleted or anonymised, except service contracts and invoices, which stay as issued for the legally required period.
• Financial and accounting records and invoices: for the period required by accounting and tax regulations.
• The trainer's ID document image: deleted automatically a set period after the verification decision, keeping only the result.
• Security logs: as long as needed for protection and investigation.
• Visitor messages sent through the help page: deleted automatically 180 days after they are sent.
• Service contracts: kept as issued (including the trainee's name, the delivering trainer's name and the request details the trainee wrote) with the financial records for the period the law requires to evidence transactions, even after an account is deleted.
• Health data and preferences: until you delete them, withdraw consent, or the account is closed.
• Backups: we keep a daily backup with a cloud storage provider (Cloudflare R2, whose servers may be outside the Kingdom) to protect the data against loss, used only to restore the platform after a failure. Database copies and private documents are encrypted before upload. Data deleted from the platform (including deleted accounts' data) therefore stays in the backups for about 30 days, then is deleted automatically.

9Your rights

Under the Personal Data Protection Law you have the right to:

• Be informed: of how your data is collected, the purpose and the legal basis (this policy is part of that).
• Access: obtain a copy of your data in a clear format.
• Correction: correct, complete or update your data (much of it is available directly in “Settings”).
• Destruction: request deletion of your data when it is no longer needed, unless the law requires keeping it.
• Deleting your account: from “Settings → Delete account”, after entering your password and a confirmation code sent to your email. The account is deactivated at once and hidden from everyone, and it is deleted for good with your data and files after 30 days unless you sign in during that time to restore it. After deletion we keep booking, payment and payout records without your identity for the period the financial and tax regulations require, except service contracts and invoices, which stay as issued for the legally required period, and your text messages and reviews stay with the other party under “Deleted account”. An account can't be deleted while it has an active booking, a refund or open report, or fees not yet transferred.
• Withdraw consent: at any time for processing based on consent.
• Complain: to the competent authority (SDAIA) if you believe your data is processed in breach of the law.

To make a request, email us at samir.ksa1990@gmail.com from your registered email. We reply within the legal period, and may ask for proof of identity to protect you.

10Data security

We use an encrypted connection (HTTPS), strong password hashing, protection against request forgery, sign-in attempt limits, fine-grained staff permissions, and storage of private files outside public paths with content checks. No system is completely secure; if a breach affecting your data occurs, we notify the competent authority within the legal period and notify you where required, explaining what you need to do.

11Cookies

• Essential (always): the sign-in session, the anti-forgery token, appearance and language preferences, and your choice in the cookie banner.
• Measurement and analytics (only with your consent): such as Google Analytics, to understand and improve how the platform is used.
• Advertising and campaign measurement (only with your consent): such as Google Ads, Meta (Instagram and Facebook), TikTok, Snapchat and X, to measure our ads and show them to interested people.
• These tools don't load before you consent, and never run in conversations or the admin panel. We send them general events (sign-up, search, checkout started, payment completed and its value) without your name, email or phone. These providers may process data outside the Kingdom under their own policies.
• You can change your choice at any time from the “Cookie settings” link at the bottom of the site.

12Minors

The platform is intended for people aged 18 and over. We don't create accounts for minors, and if a guardian books for a minor, they are responsible for the data they provide about them. If we learn that an account belongs to a minor, we close it and delete its data.

13Marketing

We only send marketing messages with your consent, and you can unsubscribe at any time. Service messages (booking confirmation, payment, reminders, security) are necessary and are not marketing. In marketing emails only, we measure whether the email was opened (with a small invisible image) and whether its links were clicked (through a link that passes via the platform), and whether a booking followed within 7 days, to improve our emails and send fewer of them; we do not share this data with any advertising party. You can prevent this by turning off image loading in your email app or by unsubscribing.

• Every marketing email has a one-click “Unsubscribe” link that works without signing in; we stop sending to your address at once and keep it on a suppression list for that purpose only.
• Invitations to join are sent only to people who agreed beforehand to be contacted; we never buy or sell mailing lists.
• Trainers may not use trainees' data they see through the platform for any marketing.

14Updates to this policy

We notify you of any material update before it takes effect, and the date of the last update appears at the top of the page.