Privacy Policy

1. Information We Collect

Account information

When you create an account, we collect your email address and any profile details you provide (name, business name). This information is used to identify you and power your workspace.

Client and business data

Information you enter about your clients — names, contact details, session notes, check-ins, workout and nutrition programs — is stored and processed solely to provide the Service to you.

Usage and technical data

We may collect information about how you use the Service, including pages visited, features used, session duration, IP address, browser type, and device identifiers. This data helps us improve the product and diagnose issues.

Payment information

Billing is handled by Stripe. We do not store your full card number or CVV. We receive and retain metadata provided by Stripe (e.g., subscription status, customer ID) to manage your account.

2. How We Use Your Information

• Provide, operate, and maintain the Service.
• Manage your account, subscription, and billing.
• Respond to support requests and communicate with you about the Service.
• Monitor and improve product performance and user experience.
• Comply with legal obligations and enforce our Terms.
• Detect and prevent fraud, abuse, or security incidents.

We do not sell your personal data to third parties. We do not use your client data to train AI models or for any purpose other than delivering the Service to you.

3. How We Share Your Information

We share data only as described below:

• Service providers: We use Supabase for database hosting and Stripe for payment processing. These providers process data on our behalf under their own data processing agreements.
• Legal requirements: We may disclose information if required by law, regulation, court order, or to protect the rights, property, or safety of IndigoWave Tech, our users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change.

4. Data Retention

We retain your account and business data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymize your data within 90 days, unless we are required to retain it for legal or compliance purposes.

You can request deletion at any time from Settings → Privacy & data → Delete my data. This starts a 90-day grace period during which the request can still be reversed by contacting us; after the grace period your workspace and its data are permanently removed.

5. Security

We take reasonable technical and organizational measures to protect your data, including encryption at rest and in transit, access controls, and regular security reviews. However, no system is completely secure and we cannot guarantee the absolute security of your data.

If you become aware of a security vulnerability or incident involving the Service, please contact us immediately at hello@indigowavetech.com.

6. Your Rights

Depending on your location, you may have rights regarding your personal data, including:

• Access — request a copy of the data we hold about you.
• Correction — request that we correct inaccurate data.
• Deletion — request that we delete your data (subject to legal requirements).
• Portability — request your data in a machine-readable format.
• Objection — object to certain processing activities.

You can exercise some of these rights directly in the product: Settings → Privacy & data lets you opt out of analytics and request deletion of your data. For access, correction, or portability requests, contact us at hello@indigowavetech.com. We will respond within 30 days.

7. Cookies and Tracking

The Service uses cookies and similar technologies to maintain your session, remember preferences, and analyze usage. Session cookies (set by Supabase Auth) are essential for the Service to function and keep you signed in. Analytics and performance tools help us understand how the product is used and diagnose errors.

You can opt out of analytics at any time from Settings → Privacy & data. You can also configure your browser to refuse cookies, though some parts of the Service may not function correctly without the essential session cookies.

8. Your GDPR Rights (EEA, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, IndigoWave Tech acts as the data controller for your account data and as a data processor for the client and business data you enter on behalf of your own clients.

We process personal data on the following legal bases: performance of our contract with you (to provide the Service), our legitimate interests (to secure, maintain, and improve the Service), your consent (where required, e.g. non-essential analytics), and compliance with legal obligations.

In addition to the rights listed in Section 6, you have the right to withdraw consent at any time, the right to lodge a complaint with your local supervisory authority, and the right not to be subject to decisions based solely on automated processing. We do not transfer your data outside the EEA/UK without appropriate safeguards (such as Standard Contractual Clauses). To exercise any GDPR right, contact us at hello@indigowavetech.com.

9. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the following rights regarding your personal information:

• Right to know — the categories and specific pieces of personal information we have collected about you, the sources, and the purposes for collecting it.
• Right to delete — request deletion of the personal information we hold about you.
• Right to correct — request that we correct inaccurate personal information.
• Right to opt out of sale or sharing — direct us not to sell or share your personal information.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. You can exercise the equivalent of a “Do Not Sell or Share My Personal Information” choice by opting out of analytics under Settings → Privacy & data, and you can submit a deletion request from the same page or by emailing hello@indigowavetech.com. We will verify your request before acting on it and respond within the timeframes required by law.

10. Children's Privacy

The Service is not directed to children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will promptly delete it.

11. International Transfers

Your data may be stored and processed in countries other than your own. By using the Service, you consent to such transfers. We take steps to ensure adequate protections are in place when transferring data internationally.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the revised policy on this page and updating the “Last updated” date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

13. Contact

For questions or concerns about this Privacy Policy or our data practices, contact us:

IndigoWave Tech — Momentum
hello@indigowavetech.com