Privacy notice

This privacy notice explains how MoonBoots Consultancy UK Ltd (“MoonBoots”, “we”, “us” or “our”) collects and uses personal data when you visit apogee.coach, sign up for Apogee Coach (“Apogee”) or use your Apogee account, and what rights you have.

1. Who we are

1.1 MoonBoots Consultancy UK Ltd is the controller of the personal data described in this notice. Our company details are shown at the top of this page.

1.2 We have not appointed a data protection officer. For any question about this notice or your personal data, email hello@apogee.coach.

2. Who this notice is for

2.1 This notice covers visitors to our website; coaches, studio owners and the people who sign up for or manage an Apogee account; people who contact us; and our partners.

2.2 If you are a client of a coach who uses Apogee, your coach is responsible for your personal data in their app, as the controller, and we process it for them as their processor. Your coach’s privacy notice, which you can read in their app, explains how your data is used. If you contact us about it, we will pass your request to your coach.

3. What we collect

3.1 When you visit our website: your IP address, browser and device details, the pages you ask for and when, which our hosting provider records in server logs. Our website loads its fonts from Google Fonts, so when a page loads your browser also sends your IP address to Google.

3.2 When you sign up: your name, email address, mobile number, business name and business address; your chosen web address and brand details, such as your logo and colours; your choice of modules and billing; a password if you set one, which we store only in a scrambled (hashed) form; and any referral code in the link you followed to sign up.

3.3 When you pay us: Stripe collects your card or bank details directly. We receive and keep the card brand and its last four digits, or the last digits of your bank account; the status of your Direct Debit mandate; and a record of each payment, refund, invoice and credit note.

3.4 When you use your account: records of when you sign in, your settings and changes to your plan, requests for setup services, and the emails we exchange with you.

3.5 Partners: the name, contact details and referral information of each partner, and the shares we calculate for them.

3.6 We do not ask for special category data, such as health information, about you as a coach. If you choose to include it in a message to us, we use it only to deal with your message.

4. How we use it, and our lawful bases

4.1 Data protection law requires a lawful basis for each use of personal data. We use your data:

to create and run your account, set up your app on the Apogee platform, provide the modules you choose and take payment: this is necessary for our contract with you;
to send service emails, such as sign-in links, payment notices, invoices, credit notes and notice of changes to our terms: our contract with you, and our legal obligations where they apply;
to keep accounting and tax records and meet company law duties: our legal obligations;
to keep Apogee secure, prevent fraud and misuse, and keep a record of every action taken in our admin tools: our legitimate interests in protecting our business and the people who use Apogee;
to answer your questions and give you help: our contract with you, or our legitimate interests where you are not yet a customer;
to calculate the shares we pay a partner for coaches they referred: our legitimate interests and our contract with the partner;
to understand how Apogee is used and improve it, using anonymised and aggregated information wherever we can: our legitimate interests.

4.2 We do not send you marketing emails unless you have agreed to receive them, and you can opt out at any time.

4.3 We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Cookies

5.1 Our website does not use analytics or advertising cookies.

5.2 When you sign in to your account, we set one cookie to keep you signed in. It is strictly necessary for your account to work, and it ends when you sign out or when it expires.

5.3 On the payment step, Stripe’s payment form may set cookies that Stripe needs to take payments securely and prevent fraud. Stripe’s own privacy policy explains them.

5.4 These cookies are strictly necessary, so we do not ask for your consent to use them.

6.1 Service providers that process personal data for us, and may use it only to provide their services to us:

Railway: hosting and databases, with data held in the European Union;
Stripe: taking payments;
Resend: sending emails;
Cloudflare: our domain’s name servers, and forwarding email sent to our addresses;
the provider of our own email inbox;
Google: the fonts on our website.

6.2 Stripe also acts as a controller in its own right for some payment data, for example to prevent fraud and to meet financial regulations. Stripe’s privacy policy explains this.

6.3 Your coaching app runs on the Apogee platform, which we also operate. We share your account details with it to set up and run your app.

6.4 We may share personal data with our professional advisers, such as accountants, lawyers and insurers, where needed; with the police, regulators or other authorities where the law requires; and with a buyer of our business, under a duty of confidentiality.

6.5 We never sell personal data.

7. Transfers outside the UK

7.1 Some of our providers are based in, or have staff or servers in, the United States or other countries outside the UK. Where personal data is transferred outside the UK, we rely on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, or on the UK’s International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Email us if you would like more information.

8. How long we keep it

8.1 Your account: while your account exists. When your subscription ends, your account stays available, read-only, so that you can export your data, until you ask us to delete it.

8.2 Financial records, including invoices, credit notes and payment records: six years from the end of the financial year they relate to, as UK law requires.

8.3 Emails with you: up to two years after our last contact, unless we need them for longer to deal with a dispute or a legal claim.

8.4 Server logs: for the period our hosting provider keeps them, normally no more than 30 days.

8.5 Partner records: six years after the share they relate to was paid.

8.6 Copies in our backups are removed as those backups expire in the normal cycle, and are kept secure until then.

9. How we keep it secure

9.1 We use encrypted connections (HTTPS) throughout; store passwords only in hashed form; let Stripe, rather than us, hold card and bank details; restrict our admin tools to authorised people and log every action taken in them; back up our databases daily; and host our databases in the European Union.

10. Your rights

10.1 You have the right to:

ask for a copy of your personal data;
ask us to correct data that is wrong or incomplete;
ask us to delete your data;
ask us to restrict how we use it;
object to our use of it where we rely on our legitimate interests;
ask for data you gave us in a portable format;
withdraw your consent at any time, where we rely on consent.

10.2 Some rights apply only in certain circumstances, and we may need to keep some data to meet our legal obligations. To use any of these rights, email hello@apogee.coach. The law gives us one month to respond, which can be extended in limited cases. We may ask you to confirm your identity.

10.3 If you are unhappy with how we use your data, please tell us so that we can try to put it right. You also have the right to complain to the Information Commissioner’s Office, at ico.org.uk or on 0303 123 1113.

11. Children

11.1 Apogee accounts are for businesses, and the person who signs up must be 18 or over. Our website is not aimed at children. Coaches who work with young clients are responsible for their data, as section 2.2 explains.

12. Changes to this notice

12.1 We may update this notice. The date of the latest version is shown at the top of this page, and we will email account holders about changes that materially affect them.