This policy explains in plain language what personal data TrainYou processes and what you can ask us about it.
1. Who is responsible
TrainYou VOF is responsible for personal data that TrainYou processes for its own purposes. TrainYou is established at Vlier 4, 3171 PT Poortugaal and registered with the Dutch Chamber of Commerce under number 42107437. For privacy questions, email info@trainyou.nl.
A school may itself be the controller for data it enters in TrainYou about students, parents, coaches and staff. TrainYou then processes that data on the school's behalf. Ask the school for help first if your question concerns its lessons, participants or administration.
2. What data we process
•
Account and contact details, such as name, email address, telephone number and sign-in details.
•
Profile details you enter yourself, including your tennis and padel ratings and date of birth. A telephone number is required for your own account. A profile photo is optional. A parent's confirmed contact number may be used for a young person.
•
Data for youth access: the stated date of birth, parent link, the school's check of parental authority and the parent's choice to activate the young person's own access. An email code or stated date of birth is not proof of age or parenthood.
•
Safety data: accepted user rules, blocks, reported content with necessary context, photo reviews, and TrainYou's recorded access and decisions. For account deletion, we retain the request, progress, any exception and necessary retention assessments.
•
School, team and relationship data, including roles, invitations and links between students, parents and staff.
•
Scheduling, lesson participation, attendance, requests, messages and other data needed to use the platform.
•
Invoice and payment data, such as coaches' business and address details, amounts, payment statuses and technical payment references. TrainYou stores a coach's full IBAN for invoicing. When an invoice is sent, we retain the IBAN and other sender details in the invoice; the school receives these details on the invoice and in the PDF. Our payment provider processes card payments. TrainYou does not store full card details.
•
Technical and security data, such as device information, IP address, error messages, audit records and failed sign-in attempts.
•
Usage data for daily activity: your account, the Amsterdam calendar date, the iOS, Android or web platform, and the times of the first and last activity signal that day. We do not measure screens visited, clicks, a device ID or an advertising ID.
•
For retention measurement, we temporarily retain your registration date, registration week and role. This data remains linked to your account for no more than 43 days and is deleted sooner if you turn off activity tracking.
•
Contact with support and choices about notifications and consent.
•
Lesson details you give in a lesson wish, such as your availability, preferences and the pupils you would like to have lessons with (lesson buddies).
•
Technical error reports when the app or our servers crash or return an error, such as the type of error, the screen it happened on, the app version, the device type, the operating system and the language. We do not link these reports to your account and do not store a name or email address with them. To limit abuse and to count how many people run into an error, we use your IP address, a random installation code and your account only in coded form; we delete those codes after 48 hours.
3. Why we use data
We use data to manage accounts and roles, enable lessons and communication, process payments, provide support, prevent misuse and comply with legal obligations.
The legal basis is usually performance of a contract, a legal obligation or our legitimate interest in a safe and usable platform. Where consent is required, we ask for it separately. You can always withdraw consent for future use.
We use daily activity to see whether signed-in customers use TrainYou and to improve the product. Only TrainYou administrators see totals. They do not see a list of active users.
If your school turns on the buddy finder, other pupils of that school can find you by name and choose you as a lesson buddy. They only see your name and a profile photo they could already see. The school is responsible for this and relies on its legitimate interest in forming suitable lesson groups. If you do not want this, turn off "Findable as a lesson buddy" in your profile. Nobody can find you any more, and existing choices of you as a lesson buddy are hidden from everyone, the school included.
4. Who we share data with
We only share data a supplier needs for its task. TrainYou uses, among others, Supabase for database and authentication, Mollie for payments, Expo and EAS for app distribution and hosting, and suppliers for email, notifications and support. We analyse technical error reports with help from Anthropic and record them in GitHub; we only share technical details such as the type of error, the place in the code and the app version, and no text you enter in the app yourself. Google provides crash reports from the Play Store.
In family conversations, the authorised parent, the coach and, when youth access is activated, the student are visible participants. A parent linked later does not automatically gain access to earlier messages. Only authorised TrainYou administrators receive the necessary context of a report. The school does not automatically receive that report.
We do not sell personal data. We share data with public authorities or regulators where required by law. For processing outside the European Economic Area, we use a valid transfer basis and appropriate safeguards.
5. How long we retain data
We do not retain personal data longer than necessary for the purpose for which it was collected. Account and platform data is normally retained while the school or user uses TrainYou. We then delete or anonymise it unless a dispute, security investigation or legal obligation requires longer retention.
We retain invoices, payments and other basic financial administration data for seven years where required by law. We retain security and technical logs for as short a period as possible and only while needed for security, recovery and checks.
Content and explanations stored with a report receive an expiry date of ninety days. The clean-up process removes that context. Decisions, blocks and necessary review references have their own purpose; TrainYou assesses their necessity and retention period separately. When an account is deleted, we erase ordinary personal data and the user's own files. For necessary administration, we record why and until when it is retained.
We retain linked daily activity records for ninety days. We then delete them automatically. Aggregated daily totals do not contain an account ID. Anonymous daily totals older than ninety days remain and can no longer be linked to one account or amended after a later choice.
We delete linked retention data no later than after the D30 window has closed, within 43 days of the start of the registration week. We then retain only cohort totals without an account ID.
We retain technical error reports in our database for no more than 30 days after an error last occurred. When we work on fixing an error, we write a technical description in GitHub, without your name, your email address or text you enter in the app yourself. We keep that description for as long as we need it to maintain TrainYou.
6. Your privacy rights
You can request access to, correction, deletion, restriction or transfer of your personal data. You can object to processing based on a legitimate interest. Email your request to info@trainyou.nl. We may ask for additional information to verify your identity securely.
You can turn off daily activity tracking yourself through Profile. We then immediately delete existing linked activity days and temporary retention data and do not measure new app launches. If you turn tracking on again later, it starts only with future activity. You can also email your objection to info@trainyou.nl.
If you are not satisfied with our response, you can lodge a complaint with the Dutch Data Protection Authority. If your request concerns data managed by a school, we will forward the request or explain how to contact the school.
Read how to delete your TrainYou account
7. Children and parents
The youth route allows children under 13 to participate through a parent or authorised guardian. From 13 to 16, personal access depends on a confirmed parent link and explicit activation by the parent. The parent can disable that access again. A school's check of the parent link does not automatically make someone responsible for payment. Existing accounts receive an announced transition; their lessons and payment arrangements do not disappear as a result.
Sports and training organisations may process minors' data in TrainYou. The school is responsible for a valid legal basis and, where needed, consent from a parent or legal representative. TrainYou uses family links and payment roles to restrict access to data.
For a child under 13, the parent decides whether the child is findable as a lesson buddy. A young person aged 13 to 15 can turn findability off themselves. Only the verified parent can turn it back on.
8. Security and changes
We use access control, encrypted connections, logging and other technical and organisational measures to protect data. No system is completely secure. Report a suspected security issue immediately via info@trainyou.nl.
If the content of this policy changes, we will publish a new version and announce important changes through TrainYou or by email. This version is called privacy-v6 and applies from 1 October 2026.