Privacy Policy

1. Who is responsible for your data

The operator of Next Level Football Training (NLFT) is the data controller for the personal data processed on the platform. This policy explains what we collect and why. It will be finalised, with the controller's full legal identity and contact details, before public launch.

2. What we collect

• Account data — name, email address, password (stored as a hash), account type, and your date of birth at signup (used only to enforce the 18+ rule).
• Booking data — the sessions you book, payment amounts and refund status. Card details are handled entirely by Stripe and never touch NLFT.
• Booking notes — the note you write for a coach. Notes are visible only to you, the assigned coach and platform administrators.
• Coach listing data — profile, qualifications and a district-level base location (never a home address).
• Reviews and dispute reports you choose to submit.

3. Children's data

NLFT is currently adult-only: accounts and coached players must be 18 or over, and the platform holds no data about children. If coaching for under-18s is introduced in future, this policy will be updated first to set out exactly what is collected and how it is protected.

Please do not include medical details, addresses or contact numbers in booking notes — the platform asks you not to at the point of writing.

4. Why we process data (legal bases)

• To run your account and bookings — performance of a contract.
• To meet legal obligations — e.g. financial records of payments.
• To keep the platform safe (coach approval, disputes, moderation) — legitimate interests.
• Optional communications (e.g. SMS reminders, when available) — consent, which you can withdraw at any time.

5. Who we share data with

Service providers who process data on our behalf: Supabase (database, authentication and storage), Stripe (payments), Resend (email), and Vercel (hosting). We do not sell personal data.

Coaches see only what they need to deliver a session: the booker's name and the booking note.

6. Retention

We keep personal data only as long as it is needed. Coach identity documents are deleted immediately after verification — only a record of who verified them and when is retained. Booking and payment records are kept as required for financial reporting.

7. Your rights

Under UK GDPR you can ask for access to, correction of, or deletion of your personal data, object to or restrict processing, and ask for your data in a portable format. You can also complain to the Information Commissioner's Office (ico.org.uk). Contact us via the details on our website to exercise any right.