Privacy policy

1. Controller The controller of personal data is Veselin Kostadinov, Sofia, Bulgaria, email: team@vkostadinov.coach. This policy explains what data we collect through vkostadinov.coach, why, and what rights you have. 2. What data we collect · Account data — name, email, phone, city, language (at registration). · Health and fitness data — filled in by you in the onboarding questionnaire and the check-ins: weight, measurements, goals, injuries, allergies, eating habits. These are sensitive data (Art. 9 GDPR) and we process them only with your express consent, in order to prepare and monitor your program. · Progress photos — the weekly photos you upload. They are visible only to you and the coach; they are not published anywhere without separate express consent. · Messages — your correspondence with the coach in the chat. · Payment data — processed by Stripe; we receive only the subscription status and the last details needed for invoicing. Your card number never passes through our servers. · Technical data — IP address, cookies, device data; visit statistics via Google Analytics. 3. Purposes and legal bases Performance of the contract (the subscription services), express consent (health data, photos, notifications), legal obligations (accounting), legitimate interest (security, prevention of abuse, improving the site). 4. Who we share data with Processors on our behalf: Stripe (payments), Brevo (sending emails), LiveKit (video sessions — the video stream is not recorded by us), DigitalOcean (hosting in the EU), Google (Analytics). We do not sell personal data and do not share it with third parties for marketing. 5. Retention periods Account, progress and photo data — while the account is active. When the profile is deleted the data is erased, except for data we are legally required to keep (e.g. accounting documents — up to 10 years). You can download your data at any time from "Profile → Download my data" and delete your profile from "Profile → Delete profile". 6. Your rights You have the right of access, rectification, erasure, restriction of processing, portability and objection, as well as to withdraw your consent at any time (without this affecting the lawfulness of processing prior to the withdrawal). Write to us at team@vkostadinov.coach — we respond within 30 days. You also have the right to lodge a complaint with the Commission for Personal Data Protection (KZLD) (kzld.bg, Sofia, 2 Prof. Tsvetan Lazarov Blvd.). 7. Cookies We use mandatory cookies for login and security (session, CSRF), a language setting, and Google Analytics analytical cookies (aggregate visit statistics). You can restrict cookies from your browser settings; the mandatory ones are needed for the application to work. 8. Security The connection is encrypted (HTTPS/TLS), access to the data is limited to the coach, and passwords are stored only as irreversible hashes. 9. Changes In case of material changes to this policy we will notify you through the Platform or by email.