Privacy Policy

1. OUR COMMITMENT

Mysportally is committed to protecting the privacy of its users in accordance with Law 25 (Quebec) and industry best practices.

2. DATA WE COLLECT

• Identification Data: first name, last name, email address.
• Training Data: athletic profile, goals, planned workouts and interactions between Coach and Athlete (e.g., messaging).
• Activity data via third-party services: when this feature is offered, with your explicit consent, we may import activity data from a watch or connected device (e.g., distance, duration, GPS, heart rate if available; e.g., Suunto, Intervals.icu, Garmin, Polar). This data may be considered sensitive.
• Technical Data: information sent by your device and browser when you access the website (e.g., IP address, browser type, request timestamps). It may be processed through our technical providers (hosting, authentication) for security, operations and troubleshooting purposes, including maintaining your session.
• Contact form (dedicated page, with or without an account): first name, last name, email address, phone number if provided, reason for contact, message content; assignment of a tracking reference; if you are signed in, an account identifier may be linked to the request.
• Coach paid Platform subscription data: technical transaction or subscription identifiers, access status, free-trial consumption history per campaign (if applicable), processed when paying through an external payment service provider; Mysportally does not store your full card details on its own servers.
• Abuse-prevention data: technical elements used to detect duplicate accounts or circumvention (e.g. email address, account identifiers, session or login data, payment-provider identifiers), as necessary to enforce the Terms of Use.
• Google authentication data: when you use "Continue with Google", we receive from Google, through our authentication provider, your email address, your name (first and last name when Google provides them, including as a full name), your Google profile photo URL when available, and a technical identifier used to recognize your Google account. We do not receive your Google password. The photo URL is stored in your Mysportally profile to display your avatar; you may change or remove it from My profile.
• Email notification preferences: choices stored in your account regarding account alerts and, where applicable, commercial emails.
• Audience and usage analytics data: pages viewed, navigation paths, on-screen interactions and session recordings (session replay) processed via Microsoft Clarity to measure audience, understand journeys and improve the experience; advertising measurement and conversion data (pages visited, journey events, advertising identifiers) processed via Google Ads (gtag). This data is intended for aggregated analysis and evaluating our campaigns; we do not seek to associate it with your email address. A technical account identifier may be used to link sessions for a signed-in user, without including messaging content or private notes (masked areas).
• Data sent to a connected AI assistant: when you voluntarily connect a compatible AI client (MCP protocol — e.g. Claude) to your account, with your explicit consent and the access level you choose (read-only, or read and write), that AI client may receive your athletic profile, goals, intensity zones (heart rate, pace or power depending on the sport) and training history, in order to propose a plan. If you authorized write access, it may also create, modify or delete planned workouts and goals on your behalf, after your confirmation. This information may be considered sensitive.

3. USE OF DATA

• Provide and maintain the Mysportally service.
• Enable Coaches to track Athlete progress.
• Improve user experience and technical functionality.
• Communicate with you regarding your account.
• Process and respond to support requests submitted through the Contact form, including by email, and retain those requests for as long as needed to handle them and for customer support follow-up.
• Manage Coaches’ paid Platform subscription and related access status (including through an external payment service provider, as strictly necessary).
• Prevent abuse (including duplicate accounts or unauthorized use of a free trial) and enforce our Terms of Use.
• Create, authenticate, and secure your account, including when signing in or signing up with Google, and manage linking between an existing account and Google.
• Send you email alerts about events related to your use of the Platform (for example activity concerning a coaching request or coaching relationship), when such alerts are offered and according to your preferences where they are configurable.
• With your consent only, send you commercial emails (product news, tips, offers, and promotions).
• Measure audience and usage journeys (pages, conversion funnels) and improve the interface using Microsoft Clarity analytics (including session recordings and heatmaps), and measure the effectiveness of our advertising campaigns and remarketing via Google Ads (gtag), within the limits described in Section 2.

4. CONSENT AND SENSITIVE DATA

When you connect a third-party service (when this feature is available), you provide your express consent to the processing of your activity data. You may withdraw this consent at any time by disconnecting the service in Connected devices, which stops importing new data.

Sharing with a coach. You may authorize a linked coach to view activities you log on the Platform or import from a watch / connected device (checkbox on the coaching request, then setting on My coaches). You may withdraw this authorization at any time for each coach. Withdrawal does not necessarily disconnect your device.

For the Contact form, submitting the form constitutes consent to process the information you provide for the purpose of responding to your request, within the limits described in Sections 2 and 3.

For a first-time signup via Google, accepting these terms and the Privacy Policy, selecting your profile (Athlete or Coach), and completing the signup process constitute your consent to process the information received from Google for the purpose of creating and managing your account. You may withdraw this consent by deleting your account or ceasing to use the Platform; deletion may however limit or prevent access to the service.

Service emails and alerts. Mysportally may send communications to the email address associated with your account that are necessary to operate or secure the service (including authentication and account management). We may also send email alerts about events related to your activity on the Platform. Where an alert is configurable, you may enable or disable it at any time in My notifications (account menu). Disabling an alert does not affect emails strictly necessary for account management or security. Processing is based on performance of our contract (essential emails) and, for configurable alerts, our legitimate interest in informing you of events relevant to your use of the Platform, subject to your right to object through your preferences.

Commercial emails. When you consent (at account creation or later), Mysportally may send commercial emails (product news, tips, offers, and promotions) to the email address associated with your account. This consent is separate from accepting the Terms of Use and this policy, and from account alerts. You may withdraw it at any time through your account preferences. Withdrawal does not stop emails required to operate or secure the service.

Audience analytics and online advertising. By continuing to browse the site, you accept cookies and similar technologies used by Microsoft Clarity for audience measurement, journey analysis and session recordings, and by Google Ads (gtag) for conversion measurement and remarketing, within the limits described in Sections 2, 3, 5 and 11. You may limit some cookies through your browser settings; this may reduce the quality of usage statistics without preventing essential use of the service.

Connecting an AI assistant. When this feature is available, you may connect a compatible AI client to your account through a standard authorization protocol. A dedicated screen shows you the client's name and asks you to explicitly choose the access level granted: read-only, or read and write. You may revoke this access at any time from Connected devices (AI Tools section); revocation immediately blocks any further reading or writing, but does not retroactively delete workouts or goals already created. The provider of the AI client you choose to connect is not selected, vetted, or controlled by Mysportally: it acts as a separate controller for its own processing, under its own privacy policy, which we encourage you to review before connecting it. Mysportally requires every connected AI client to obtain your confirmation before deleting a workout or goal, but cannot technically guarantee that a third-party client complies with this requirement: you remain responsible for monitoring the actions of an AI client you have connected.

5. SHARING AND DISCLOSURE

We never sell your personal data. Sharing is limited to:

When you sign in with Google, Google also processes your information as a separate controller for its own purposes (management of your Google account, security, etc.). We encourage you to review Google's privacy policy.

• Your linked Coach(es): for the execution of the service (tracking, calendar, messaging). If you have multiple coaches, each coach sees the details of their own sessions; other coaches only see that a time slot is busy, without the content. Goals and facilities may be shared with all of your linked coaches. Activities imported from a watch / connected device are visible to a coach only if you have consented for that relationship.
• Technical providers required to operate the website (hosting, authentication, database).
• Legal obligations: if required by law.
• Transactional email delivery providers, when needed to route service-related communications (including Contact form requests and configurable email alerts in your account), including commercial emails when you have consented, strictly as required for those deliveries.
• External payment service provider: when you pay for Coach access to the Platform, data strictly necessary for payment and billing may be shared with that provider, which acts as a processor for that part of the processing and applies its own commitments to you during the transaction.
• Authentication providers: including our authentication infrastructure provider (e.g. Supabase) and, when you choose Google, Google as an identity provider. These parties process information strictly necessary for authentication, security, and technical operation of the service, in accordance with their own policies and our contractual instructions, as applicable.
• Microsoft Clarity (Microsoft): for audience measurement, journey analysis and session recordings / heatmaps. Microsoft processes this data under its own privacy policy; processing may involve a transfer outside Quebec (including the United States). Google Ads (Google LLC): for advertising conversion measurement and remarketing via gtag; Google processes this data under its own privacy policy; processing may involve a transfer outside Quebec (including the United States).
• AI client you connect (when this feature is available): at your request and according to the access level you choose, we send this client the information described in Section 2 and, if you authorize it, receive from it workouts or goals to create on your behalf. Unlike the providers listed above, this client is chosen by you among any software compatible with an open protocol (MCP); it acts as a separate controller for its own processing, not as a processor for Mysportally. This processing may involve a transfer outside Quebec depending on the provider you choose.

6. RETENTION AND CROSS-BORDER TRANSFERS

Your data is retained as long as your account is active. Your personal information may be stored on servers located outside the province of Quebec (e.g., Canada or the United States), which you hereby accept.

When you connect an AI client (Section 4), the information you choose to send it may also be processed by that provider on servers located outside Quebec, depending on its own location and privacy policy.

7. SECURITY

We implement physical, technical, and administrative security measures (encryption, restricted access) to protect your data against unauthorized access or leaks.

8. YOUR RIGHTS (LAW 25)

• Right of access and rectification of your data.
• Right to erasure (deletion of your account).
• Right to portability of your data.
• Right to withdraw consent at any time.

9. DATA PRIVACY OFFICER

To exercise your rights or for any questions, please contact our officer:

Martin Faisant

📧 martin.faisant@mysportally.com

10. PRIVACY INCIDENTS

In the event of a data breach or privacy incident presenting a risk of serious injury, Mysportally undertakes to notify the Commission d’accès à l’information du Québec and the affected users, as required by law.

11. COOKIES

We use cookies and similar technologies that are strictly necessary to operate the service, including keeping you signed in and enabling secure return to the Platform after Google authentication. You may configure your browser to refuse cookies, but this may prevent authentication and limit some features.

We also use Microsoft Clarity, which may set cookies or similar technologies to measure audience, analyze journeys and produce session recordings and heatmaps, and Google Ads (gtag), which may set cookies or similar technologies to measure advertising conversions and remarketing. These cookies are not required for authentication; refusing them may limit the quality of usage statistics and the evaluation of our campaigns.