Privacy policy

1. Data controller

VMSI, trade name of Vincent Maurel, sole proprietor, SIREN 901 847 053, 87c route de la Luye, 05000 Gap, France, contact: contact@spin-coach.fr (the "Controller"). No data protection officer has been appointed.

2. Data processed

• Account: email address, password (hashed, never stored in clear text), display name, creation and sign-in dates.
• Sessions and security: session identifier, browser (user agent), IP address, timestamps; technical logs.
• Hand histories imported by the user: cards, actions, bets, results, tournament identifiers, the user's screen name at the room, and the screen names of other players, which are replaced by an irreversible identifier (salted hash) before any use.
• Training data: answers to exercises, scores, plans, attendance calendar.
• Subscription: plan, status, billing history. Card details are processed exclusively by the payment provider Stripe Payments Europe, Ltd. (Dublin, Ireland); the Controller has no access to them.
• Preferences: chosen language and display theme, kept in cookies or your browser's local storage.
• Account usage log: pages of the application opened (address without its parameters), imports, sign-ins, plan locks encountered, subscription changes, with their date, the language and the type of device (mobile, tablet, desktop); origin of the sign-up (referring site, campaign tag, first page viewed).
• Audience measurement for visitors without an account: pages viewed, referring site, language and type of device. No cookie or identifier is set. A visitor is recognised for one day by a fingerprint computed from their IP address, their browser and a random key renewed and erased every day: the fingerprint cannot be used to recover the IP address or to link two days, and the IP address itself is not kept in this log.

3. Purposes and legal bases

• Providing the Service (account, analyses, training, subscription): performance of the contract.
• Account security, fraud prevention, rate limiting: legitimate interest.
• Service emails (verification, reset, billing, changes to the terms): performance of the contract and legal obligations.
• Emails about features and offers: consent, withdrawable at any time via the unsubscribe link.
• Accounting and tax obligations: legal obligation.
• Usage log and audience measurement: legitimate interest (monitoring operation, user support, improving the Service). This data is not used for advertising and is not passed on to any third party.

4. Third-party data in the hand histories

History files contain opponents' screen names. The Controller pseudonymises them at import and uses them only to produce aggregate statistics ("population"), never displaying an individual profile. This data is kept with the histories of the user concerned and deleted along with them.

5. Recipients and processors

• Hosting: OVH SAS (OVHcloud), servers located in France.
• Encrypted backups: OVH SAS (OVHcloud), France.
• Transactional email: Microsoft Azure Communication Services, data hosted in France.
• Payment: Stripe Payments Europe, Ltd. (Dublin, Ireland), whose privacy policy applies to card data.

No data is sold or transferred to third parties. Transfers outside the European Union, if any, are covered by the European Commission's standard contractual clauses.

6. Retention periods

• Account and histories: for the lifetime of the account, then deleted immediately on the user's request (backups are purged within 30 days).
• Inactive account: deleted after 24 months without sign-in, following notice.
• Sessions: 30 days; technical logs: 12 months.
• Usage log and audience measurement: 13 months; an account's log is erased with the account.
• Invoices and accounting data: 10 years (legal obligation).

7. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability. From "My account" you can change your information, close your sessions and delete your account together with all your data. For any other request: contact@spin-coach.fr. You may lodge a complaint with the French data protection authority (CNIL, cnil.fr) or with the supervisory authority of your country of residence.

8. Security

Passwords hashed with scrypt, signed session cookies restricted to HTTPS, each user's data isolated in a separate database, rate limiting on sensitive endpoints, encrypted backups. In the event of a data breach likely to result in a high risk, the users concerned are informed within the time limits set by the GDPR.

9. Cookies

The Service uses only a strictly necessary session cookie (authentication), a language preference cookie, and browser local storage for your display preferences (theme, training settings). No advertising or third-party tracking cookie is set, so no consent banner is required. Audience measurement works without cookies and writes nothing to your browser. A visitor without an account whose browser sends the "Do Not Track" or "Global Privacy Control" signal is not counted. You can also object by writing to contact@spin-coach.fr.

10. Changes

Any substantial change to this policy is notified by email or through a message in the app before it takes effect.