Privacy Policy

1. Who we are Controller

CoachCraft is operated by:

RugbyGo is the data controller for all personal data processed through the CoachCraft platform.

2. What data we collect

3. Legal basis for processing

4. How we use your data

We use the data we collect to:

• Provide, maintain, and improve the CoachCraft platform
• Enable clubs to manage coaching sessions, player rosters, and team administration
• Support coaches in tracking player wellness and injury recovery (with player consent)
• Provide optional AI-assisted coaching features: an in-portal coaching assistant, and written player development reports generated from the skill ratings a coach has already recorded
• Maintain security audit logs and comply with legal obligations
• Communicate with you about your account and material changes to this policy

We do not use your data for advertising, profiling for commercial purposes, or any purpose incompatible with those listed above.

5. Data sharing and sub-processors

We share personal data only with the sub-processors listed below, each engaged under a written Data Processing Agreement:

We do not sell personal data. We do not share data with third parties for their own marketing purposes.

6. International transfers

Storage. All personal data held in the CoachCraft database is stored in Google Cloud’s eur3 multi-region, which spans data centres in Belgium and the Netherlands. It does not leave the EU at rest.

Processing. All of our backend jobs that act on that data run in Google Cloud’s europe-west1 region in Belgium. This includes the personal data export used to answer access and portability requests, the deletion plan job used to answer erasure requests, the physiotherapy and wellness digest e-mails, the calendar feed, the payment webhook and every notification and scheduled job. None of your team, performance, development or health data is processed in the United States by us or by Google on our behalf.

Sign-in. One exception applies to the service that signs you in. Firebase Authentication, the Google service that checks your email address and password, is operated by Google only from data centres in the United States. The data that service holds is your email address, a hashed form of your password, your account identifier, your sign-in provider, the times you signed in and the network address you signed in from. Nothing else about you passes through it. The transfer is covered by Google’s certification under the EU-US Data Privacy Framework and by the Standard Contractual Clauses in the Google Cloud Data Processing Addendum. We will move to an EU-resident sign-in service if Google makes one available on our platform.

Page delivery and request verification. Two further Google services sit in front of the platform and run on Google’s global infrastructure rather than in a fixed region. Firebase Hosting delivers the portal pages; the pages themselves contain no personal data, but Google records the network address of each request to detect abuse and to report usage, and retains those addresses for a few months. Firebase App Check confirms that each request comes from the genuine CoachCraft portals; the attestation it performs is not retained, and the short-lived token it issues is tied to a device and is kept for at most thirty days for replay protection. Neither service carries any of the data described in section 4. Both are covered by the same Data Privacy Framework certification and Standard Contractual Clauses.

Until 13 September 2026 a number of these jobs ran in Google Cloud’s us-central1 region in Iowa, United States, under Google’s certification under the EU–US Data Privacy Framework and the Standard Contractual Clauses in the Google Cloud Data Processing Addendum. That processing has ended and the corresponding functions have been deleted. Database access logs are held in Google Cloud Logging with a copy in an EU log bucket.

Separately, where a club enables the optional AI features, the content of those requests is processed by Anthropic in the United States. This transfer is covered by Standard Contractual Clauses (EU Commission Decision 2021/914, Module Two: controller to processor), incorporated into the Anthropic Data Processing Addendum.

No Special Category (health or injury) data is included in requests to Anthropic.

7. Data retention

Deletion at the end of the retention period is not yet automated. Until it is, we delete that data by hand, working from a deletion plan that lists every record held about the person concerned. We follow the same process when you ask us to delete your data (see section 8). Health and injury records are always checked by a person before they are deleted, because clinical record keeping rules may require them to be kept for longer. Backup copies expire automatically, so deleted data is gone from backups within 90 days of the deletion date. We are building automated deletion and will update this section when it is in place.

8. Your rights

Under GDPR, you have the following rights in relation to your personal data:

To exercise any right, contact us at admin@rugbycraft.com. We will respond within one month.

9. Youth players (under 16)

Where youth player data is processed under a prior arrangement, parental or guardian consent is required for all data collection, and a specific DPIA must be completed before onboarding. Processing of youth player wellness or health data requires explicit parental consent.

10. AI and automated processing

CoachCraft offers two optional AI-assisted features, both in the coach portal, and both powered by Anthropic’s Claude. Neither is switched on by default: a club must add its own Anthropic API key in Settings before either will run. That key is stored in the coach’s own browser and requests go directly from the browser to Anthropic, so the content of an AI request never passes through CoachCraft servers.

• Coaching assistant. A chat assistant for coaching questions, session design and platform help. It is sent the coach’s current session plan settings, which are coaching context such as objectives, focus areas, session count and template. Anything a coach types into the free-text notes or chat box is also sent, so coaches are asked not to enter player names, health information or other personal details there.
• Player development reports. Where a coach has already recorded monthly skill ratings for a player, they can ask the AI to draft a written report from those ratings. The request contains the playing position, the numeric skill ratings and the change since the previous month. The player’s name is not transmitted; the report is matched back to the player locally, in the coach’s browser.

In both cases:

• No player names, contact details, health or injury records, or Special Category data are transmitted.
• No automated decisions with legal or similarly significant effects are made. Every output is advisory and coaching staff make all final decisions.
• Anthropic does not retain API request content beyond the immediate response.

Session plans themselves are generated by CoachCraft’s own rule-based planner, from the season phase, focus areas, templates and resources a coach selects. No AI is involved in generating a session plan, and no personal data leaves the platform when one is created.

Some clubs and unions using CoachCraft may optionally connect their own third-party AI services by configuring a club-owned API key within the platform settings. Where a club does this, CoachCraft (RugbyGo) is not the data controller or processor for the personal data submitted to that club's AI service — the club is. Clubs are solely responsible for the data protection compliance of their own AI integrations, including entering into appropriate agreements with their AI provider and ensuring data subjects are informed. RugbyGo does not access, store, or process any data submitted by a club through its own AI integration.

11. Data security

We implement the following technical and organisational security measures:

• All data encrypted in transit (TLS) and at rest (Google Cloud hardware-level encryption)
• Role-based access control enforced at the database level, not just the user interface
• Firebase App Check: every API request is verified as originating from a legitimate CoachCraft application
• Deny-by-default database rules: every data path is explicitly permitted or blocked
• Immutable server-side audit logs recording all access to sensitive and Special Category data
• Club workspace isolation: no cross-club data access is architecturally possible

In the event of a personal data breach, we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware, and notify affected individuals without undue delay where the breach poses a high risk to their rights and freedoms.

12. Changes to this policy

We will notify all registered users of material changes to this Privacy Policy via email and in-app notification at least 14 days before changes take effect. The current version number and effective date are shown at the top of this page.

For non-material changes (formatting, typo corrections), we will update the page without advance notice. The version number will not change for non-material edits.

Change history.

• Version 1.4, 24 September 2026. Section 7 corrected: version 1.3 said that data is deleted automatically at the end of its retention period. That was wrong. Deletion is currently carried out by hand from a deletion plan, and automated deletion is still being built. Nothing about how your data is used has changed; the statement now describes what actually happens.
• Version 1.3, 14 September 2026. Section 5 and section 6 corrected: version 1.2 stated that no personal data was processed in the United States. That was wrong for the sign-in service, which Google operates only from the United States. The correction was made the day after the error was found. Section 6 also now describes the network address processing by Firebase Hosting and the device token used by Firebase App Check. Team, performance, development and health data are unaffected.
• Version 1.2, 13 September 2026. Section 5 and section 6 updated: all backend processing now takes place in the EU and the United States processing described in version 1.1 has ended. This change reduces the scope of international transfers and took effect without a notice period.
• 12 September 2026, non-material correction. Storage location corrected from europe-west4 to the eur3 multi-region, which is where the data has always been held.

13. How to make a complaint

If you remain dissatisfied, you have the right to lodge a complaint with your national supervisory authority: