Privacy policy

1. Who we are

OneRep is run by OneRep AI Ltd (“we”, “us”), a company registered in England and Wales with company number 17528315, at Katharine House, R/O 32 High Street, Northwood, HA6 1BN, United Kingdom. You can contact us about anything in this policy at sam@tryonerep.io.

2. Two kinds of information, two different roles

Coaches and studios who use OneRep. When you sign up, we decide how your account and billing information is used, so for that information we are the data controller.

Clients of those studios. When a studio adds its clients, books their sessions or takes their payments in OneRep, the studio is the data controller and decides how that information is used. We are its data processor: we only use it to run OneRep for that studio, as our terms with the studio set out. If you're a client of a studio, please contact your studio first about your information. We'll help them answer.

3. What we collect

About coaches and studio owners:

• Your name, email address, and your password (stored only in a form that can't be read back) or your Google sign-in.
• Your business details: business and studio names, addresses, phone, website, VAT number and logo.
• Your OneRep subscription: plan, price, trial and payment status. Payments are taken by Stripe; we never see or store your card or bank details.
• Referrals: if a coach invites you to OneRep by email, your email address, used only to send that invite and at most one reminder, and to show them whether you joined.
• How you use OneRep: an activity log of changes made in your studio, and technical information such as your browser and IP address, used to keep the service secure.

About a studio's clients, as entered by the studio or by the client in the OneRep app:

• Contact details: name, email, phone, address, date of birth and emergency contact.
• Training details: sessions booked and attended, packs and memberships, and notes the studio writes.
• Health information the studio or client chooses to record, such as injuries, medical conditions or GP details. This is special category data. The studio is responsible for having a lawful basis to record it, usually the client's explicit consent.
• Payments: what was paid, when and how, with VAT. Card and Direct Debit payments are handled by Stripe on the studio's own account; we never see or store card or bank details.
• Enquiries made through a studio's booking links, including the answers given.

4. Why we use it, and our lawful basis

• To provide OneRep to coaches and studios under our contract with them, and to studios' clients on the studio's behalf.
• To send emails the service needs, such as booking confirmations, reminders, receipts and payment links. Studios choose which of these go to their clients.
• To take payment for OneRep subscriptions, and to keep financial records we must keep by law.
• To keep OneRep secure and working: preventing misuse, fixing faults and improving the service. This is in our legitimate interests.

We don't sell personal information, we don't use it for advertising, and we don't send marketing to studios' clients.

5. Ask, OneRep's assistant

Ask answers questions about a studio's own figures, and can suggest diary changes. To do this, the question and the relevant information from that studio's own data are sent to our AI provider, Anthropic, which processes them only to produce the answer. Under Anthropic's commercial terms, this information is not used to train their models. Ask can only see the data the person asking is allowed to see, and nothing in the diary changes until they confirm it.

6. Who we share it with

We use trusted suppliers to run OneRep. They only process information on our instructions and must keep it safe:

• Supabase: database, sign-in and file storage, hosted in London, UK.
• Vercel: hosting of the OneRep website and app.
• Stripe: payments, for OneRep subscriptions and for studios' own client payments.
• Resend: sending emails.
• Anthropic: the AI behind Ask.
• Google: only if you choose to sign in with Google.
• Cloudflare: our domain and website security.

Some of these suppliers may process information outside the UK, for example in the United States. Where they do, we rely on the safeguards UK law requires, such as the UK's adequacy regulations (including the UK-US data bridge) or the International Data Transfer Agreement.

We may also share information if the law requires it, or to protect the rights and safety of our users or others.

7. How long we keep it

• Coach and studio account information: while the account is open, and for up to 30 days after it closes so it can be restored if closed by mistake.
• A studio's client information: for as long as the studio keeps it in OneRep. When a studio closes its account, its data is deleted within 30 days, unless the law requires us to keep it.
• Financial records (such as OneRep subscription invoices): six years, as UK tax law requires.
• Backups are overwritten on a rolling basis and kept for no longer than needed.

8. Keeping it safe

Each studio's information is kept separate from every other studio's, enforced in the database itself. Coaches only see what their role allows, and clients only see their own records. Information is encrypted when it travels over the internet, passwords are never stored in readable form, and card and bank details never reach OneRep.

9. Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how it's used, and to have it moved to another service. If you're a studio's client, please ask your studio first, as they control your information; we'll help them respond. Otherwise, email sam@tryonerep.io. We'll reply within one month.

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113.

10. Cookies

OneRep only uses cookies that are needed for it to work: to keep you signed in and secure, and to remember choices such as light or dark display. We don't use advertising or tracking cookies, so we don't ask you to accept any.

11. Changes to this policy

If we change this policy in a way that matters, we'll tell studios by email or in the app before the change takes effect. The date at the top shows when it last changed.