Terms & privacy

1. Who is responsible for your data

Cortico, a sole proprietorship (eenmanszaak) registered in Amsterdam, the Netherlands (KvK no. 98055313), operates this platform and is the controller for your account and for the operation of the platform. For membership records a Club keeps about you (enrolment, attendance, grading, notes and billing status) the Club is the controller and Cortico is its processor under a data processing agreement. Requests about that data are best directed to your Club; we assist them in fulfilling your rights.

2. What we collect

• Account: name, email address, password (stored hashed).
• Family profiles: member names and dates of birth, needed for age-appropriate classes and grading.
• Medical notes: if you want, you can add what the instructor should know about a member, such as allergies or a medical condition. We only save this after you agree to it. Only clubs where that member is currently enrolled can see it. You can change or delete it at any time, and withdrawing your consent deletes it.
• Activity: bookings, attendance, membership plans and payment status.
• Payments: handled by Stripe. We receive confirmation and status, never your full card number.
• Technical: IP address, device and browser details in our hosting provider's logs, used for security and to fix problems. We also count anonymous visits to a few public pages (see section 9).

3. Why we use it

• To provide the service — accounts, bookings, memberships, payments (performance of a contract).
• To keep it secure and make it better (legitimate interests).
• To send product updates — only with your consent, and you can opt out at any time.
• To meet legal obligations, such as financial record-keeping.

4. Children

Children's profiles are created and managed through a parent or legal guardian's own account. A family member does not get a separate login of their own through this platform. We collect no more data about children than is needed to run their classes.

5. Who we share data with

Your Club(s) see the data needed to run your membership. We use these service providers to run Cortico:

• Supabase (Supabase Inc., US): our database, sign-in and file storage, including member photos and medical notes. Stored in the EU (Frankfurt).
• Vercel (Vercel Inc., US): hosts the website and app. Our servers run in Frankfurt; Vercel's network and request logs (including IP addresses) are worldwide.
• Resend (Resend Inc., US): sends our emails, such as sign-in links, booking confirmations and club announcements. Resend stores email data, such as your address and the message, in the United States.
• Stripe (Stripe Payments Europe, Ireland): payments. Card details go to Stripe only. Stripe is itself responsible for its fraud prevention and its own legal duties.
• PostHog (EU cloud): anonymous visit counts on our public pages (see section 9).
• Sign in with Google: only if you choose to sign in with Google. Google then shares your name and email address with us.
• OpenStreetMap (OpenStreetMap Foundation, UK): when club staff search for a venue address or view a map, the search text and their IP address go to OpenStreetMap. Map marker images load from unpkg.com.

We disclose data to authorities only where legally required. We never sell personal data.

6. International transfers

Our database and files are stored in the EU (Frankfurt), and our servers run there too. Several of our providers are US companies, and some data leaves the EEA: Resend stores email data in the United States, Vercel's network and logs are worldwide, and Google and OpenStreetMap (UK) receive the requests described above. Where a provider processes data for us outside the EEA, we rely on an adequacy decision (such as the one for the UK) or the EU Standard Contractual Clauses.

7. How long we keep it

These periods are approximate:

• Your account: while it is open. If you delete your account, we anonymise you and your family members straight away. Family members with no activity for 24 months are anonymised automatically.
• Medical notes: until you change or delete them, or withdraw your consent. They are also erased when a profile is anonymised.
• Unfinished sign-ups: booking and checkout details (which can include medical notes) are deleted after 30 days. Trial bookings that did not lead to a membership, and join requests that were not approved, are deleted after 12 months.
• Emails: we delete the message text once it is sent, and the send record 30 days later. Resend keeps its own copy according to its retention settings.
• Payment records: at least 7 years, as Dutch bookkeeping law requires.
• Club records such as attendance, bookings and grading: kept according to your Club's own policy. Ask your Club.
• Backups: deleted data can stay in our database provider's backups for a short time, until those backups are replaced.
• Security and audit logs (such as sign-up events with IP address): kept to protect accounts; we are setting a fixed limit.

8. Your rights

You can access, correct, delete or export your data, restrict or object to processing, and withdraw consent at any time. Email privacy@cortico.app. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own country.

9. Cookies and analytics

We use essential cookies for login and security. Using PostHog's EU cloud, we count anonymous visits to a few public pages, such as the home page, club pages, sign-in and this policy. We record which kind of page was visited (for example “a club page”), plus general device details: browser and operating system, device type, screen size, language and time zone. We never record the full web address, search terms or the page you came from. We set no cookies for this and store nothing on your device; your visit gets a random ID that lasts only until you close or reload the page and is not linked to you or your account. PostHog does not receive your IP address. Nothing is counted inside your account or in the club admin app. We do not use advertising trackers.

10. Changes and contact

We'll post updates to this policy here and notify you of material changes. Cortico, Amsterdam — privacy@cortico.app.