Privacy Policy

This Privacy Policy explains how DrillBase (“DrillBase”, “we”, “us”) collects, uses, shares, and protects personal data when you use our coaching platform for racket sport coaches and academies. DrillBase serves coaches and players around the world, and we hold ourselves to a high, international standard of privacy. We aim to comply with the major data-protection frameworks that may apply to our users, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA), and the Personal Data Protection Acts of Thailand and Malaysia (PDPA), as well as widely recognised privacy best practices.

This document is provided for transparency and is not legal advice. Before relying on it, we recommend a qualified privacy lawyer reviews it against your final data practices and the laws of the markets you serve.

1. Who we are

DrillBase is the data controller (or “business”, under applicable laws) for the personal data described below. For privacy questions or to exercise your rights, contact us at hello@drillbase.co or privacy@drillbase.co. Coaches and academies are separately responsible for the personal data of their own students that they enter into DrillBase and use for their coaching business.

2. What data we collect

• Account and identity: your name and email address; your role (coach, player/student, or academy admin); your timezone; for coaches and academies, your business name, address and tax ID where you enter them for invoices and receipts.
• Coaching and progress data: drill logs, session history, goals, DUPR rating, and program enrolment.
• Payment records: invoices, receipts, and the payment slips you upload as proof of a payment made outside the platform. When a payment is made by card through Stripe, Stripe handles the card details; we receive only the payment status, amount, currency and a Stripe reference, never a full card number.
• Subscription billing (coaches and academies): your plan, billing history and Stripe customer reference for the DrillBase subscription. Your card is stored by Stripe, not by us.
• Stripe Connect (coaches and academies): if you connect your own Stripe account, we store your Stripe account ID and whether it is ready to take payments. Stripe collects your identity and bank details directly under its own privacy policy.
• Communications: drill notes, Q&A threads, announcements, support requests, and messages exchanged between coaches and players.
• Technical data: log data, device/browser information, and product-usage analytics collected automatically when you use the app.

3. How we use your data

• To operate the coaching platform and your account.
• To track training progress and surface schedules, programs, and stats.
• To let coaches manage their roster, issue invoices, record payments, and review uploaded payment slips.
• To bill coaches and academies for their DrillBase subscription and to run card payments and marketplace sales through Stripe.
• To send transactional email (sign-in codes, receipts, reminders, and welcome emails).
• To provide AI features: an assistant that helps coaches draft classes and announcements, automatic sorting of support requests, and a pre-check that reads an uploaded payment slip to suggest the amount paid. A coach always confirms the result before anything changes.
• To diagnose errors, keep the service secure, and improve the product.

4. Legal bases and consent

Where a legal basis is required (for example under the GDPR or the Thailand/Malaysia PDPA), we rely on one or more of the following: your consent; performance of our contract with you (providing the service you signed up for); compliance with a legal obligation; and our legitimate interests in securing and improving the platform, balanced against your rights. Product analytics (PostHog) runs only on your consent, given through the cookie banner (Section 6). Error monitoring (Sentry) runs on legitimate interests. Where we rely on consent, you may withdraw it at any time (see Sections 6 and 8); withdrawal does not affect processing already carried out.

5. Who we share data with

We do not sell your personal data. We share it with the service providers (processors) below, only as needed to run DrillBase:

• Supabase: database, authentication, and file storage (your account, coaching data, and uploaded payment slips). Hosted on Amazon Web Services in Singapore.
• Google Cloud (Firebase App Hosting): runs the DrillBase application servers that process your requests.
• Stripe: billing for the DrillBase subscription, card payments to coaches through their own connected Stripe accounts, and marketplace sales. Stripe is an independent controller of the data it collects for payment processing, fraud prevention and compliance.
• Resend: sending transactional email (sign-in codes, receipts, reminders and welcome messages).
• Anthropic: the AI model behind the coach assistant, support-request sorting, and payment-slip reading. We send it the text or image needed for that task and receive a result back.
• PostHog: product analytics to understand and improve how the app is used. Only if you accept analytics cookies.
• Sentry: error monitoring to detect and fix bugs (legitimate interest; not affected by the cookie banner).
• Cloudflare: DNS and network security in front of the site.

We also share data between a coach and their linked players as necessary for coaching (for example, a coach can see their player’s drill logs and invoices), and, on an academy account, with the academy administrators.

6. Cookies and similar technologies

The first time you visit, a banner asks whether you accept analytics cookies. Accept and Decline are equally easy to choose, nothing optional runs until you accept, and the rule is the same in every country. You can change your mind at any time: open cookie settings, or use the Cookie settings link in the site footer or in Settings inside the app.

• Strictly necessary (always on): sign-in session cookies set by our authentication provider (Supabase) so you stay signed in; a cookie that remembers which portal you were using; and db_consent, which remembers your cookie choice for 12 months. These cannot be switched off while using the app.
• Analytics (only with your consent): PostHog stores a small identifier in your browser (cookie or local storage) so we can see which pages and features are used. PostHog is not loaded, and sends nothing, until you accept. We link analytics to a person only once you are signed in. If you later decline, we stop sending analytics and clear the PostHog identifier from your browser.
• Error monitoring: Sentry receives technical error reports (the error, the page, browser type) when something breaks, plus page-load timings for a small sample of visits. It sets no cookies and is not used for analytics or advertising. We run it on the basis of our legitimate interest in keeping the service secure and working, so it is not switched off by the cookie banner.
• We do not use advertising or cross-site tracking cookies.

7. International data transfers

DrillBase operates globally, and our providers may process data in countries other than your own. Our main database is in Singapore. Where we transfer personal data across borders, we use appropriate safeguards required by applicable law, such as the European Commission’s Standard Contractual Clauses for transfers out of the EU/EEA/UK and equivalent mechanisms for transfers governed by other frameworks, to ensure your data remains protected.

8. Your rights, data export and account deletion

Subject to your local law, you generally have the right to:

• Access your personal data and request a copy.
• Rectify inaccurate or incomplete data.
• Request erasure or de-identification of your data.
• Restrict or object to certain processing.
• Request data portability.
• Withdraw consent where processing is based on consent.

You can do the two most common requests yourself, inside the app:

• Download your data. In Settings, open Account & privacy (coaches and academies) or Privacy (players) and choose Download my data. You get one JSON file straight away. A player’s file holds their profile, packages, invoices and payments, classes, drill logs, goals, messages and signed agreements. A solo coach or academy owner’s file holds the account: profile, student list, packages, invoices and payments, classes, programs and drills, announcements, requests and their own activity log. Other academy staff get their own records. The file never contains another account’s data, passwords, or payment-processor identifiers. Uploaded files are listed by path; ask us if you need the files themselves.
• Close your account. Players use Settings, Account, Delete account. Solo coaches and academy owners use Settings, Account & privacy, Close my account. Your login is closed immediately, a card-billed DrillBase plan is cancelled at the end of the paid period, and we delete or de-identify the data within 30 days. Closing a coaching account also ends access for its players and staff when the data is deleted, so download your data first. Academy staff who are not the owner should ask the owner, or email us.

For anything else (correction, restriction, objection, a copy of uploaded files, restoring an account closed by mistake), or if you cannot sign in, email hello@drillbase.co from the address on your account. We will confirm your identity, complete the request within 30 days, and tell you if any records must be kept for legal, accounting or tax reasons (for example invoices). We will not discriminate against you for exercising your rights.

9. Additional rights by region

Depending on where you live, you may have additional rights under local law:

• European Union / EEA / UK (GDPR and UK GDPR): the rights above as data-subject rights, the right to object to processing based on legitimate interests, and the right to lodge a complaint with your national data-protection authority.
• California, USA (CCPA/CPRA): the right to know what personal information we collect and how it is used and shared, the right to delete and to correct it, and the right to opt out of any “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined under the CCPA.
• Thailand and Malaysia (PDPA): data-subject rights including access, correction, erasure, restriction, objection, and data portability, the right to withdraw consent, and the right to lodge a complaint with the relevant national authority (for example Thailand’s Personal Data Protection Committee).

10. Data retention

We keep your personal data for as long as your account is active and as needed to provide the service. When you ask us to close your account, we delete or de-identify your data within 30 days, except where we must retain certain records (for example invoices and receipts) to comply with legal, accounting, or tax obligations.

11. Security

We use industry-standard measures to protect your data, including encrypted connections, access controls, and row-level security so that users can only access data they are authorised to see. No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of any breach as required by applicable law.

12. Children

DrillBase is intended for use by coaches and their players. Where a minor uses the platform, a parent or guardian should provide consent and supervise that use in line with the laws applicable to them.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above. Material changes will be communicated where appropriate.

14. Contact

Questions about this policy or your data? Email hello@drillbase.co or privacy@drillbase.co.