Privacy policy

01Who we are

The Service is operated by Sylorya, [Registered address — to be completed], Morocco ("Sylorya", "we", "us").

For any privacy question or request, email us at support@sylorya.com.

02Controller and processor roles

Sylorya has two kinds of users: coaches (the coaching business, which we call an organization, and its team members) and the clients those coaches invite.

• Client data — the coach is the controller. When a coaching business adds clients and collects their training, nutrition, check-in, photo and message data, that business decides why and how the data is used. It is the data controller, and Sylorya acts as its data processor, handling the data only on its instructions and to provide the Service.
• Account and billing data — we are the controller. For the information we need to run our own business — coach accounts, logins, subscriptions, billing, support conversations, security logs and product usage — Sylorya is the data controller.

If you are a client, your coach is your first point of contact for questions about your data. You can still contact us and we will help, or pass your request to your coach.

03Information we collect

Account information

• Name, email address and password (stored only as a secure hash).
• Organization name and logo, team members and their roles.
• Profile picture, if you add one.
• Subscription plan and billing status. Payment card details are collected and stored by Paddle, not by us.

Client profile information

• Name, email address and the coach the client is assigned to.
• Goals, notes and other information the coach or client chooses to record.

Health and fitness data

Depending on how a coach uses the Service, we store data that may count as health data under privacy law:

• Body weight, body fat percentage and body measurements.
• Check-in answers, such as energy, sleep, stress or how a week went.
• Workout logs, programs, sets, repetitions and loads.
• Nutrition targets and meal logs.
• Progress photos.
• Messages exchanged between coaches and clients.

Usage and technical data

• IP address, browser and device type, operating system and app version, collected in server logs when you use the Service.
• Login times, security events and error reports used to keep the Service working.
• Emails we send you and whether they were delivered.

We do not buy personal data, and we do not use third-party advertising or tracking tools in the Service.

04How we use information

• To provide the Service: accounts, programs, logging, check-ins, photos and chat.
• To send essential emails such as verification, invitations and password resets.
• To process subscriptions and payments through Paddle.
• To keep the Service secure, prevent abuse and fix errors.
• To answer support requests.
• To understand, in aggregate, how features are used so we can improve them. We do not sell personal data or use client health data for advertising.
• To comply with legal obligations, such as tax and accounting rules.

05Legal bases for processing

Where privacy laws such as the GDPR, the UK GDPR or Moroccan Law 09-08 apply, we rely on the following legal bases for the data we control:

• Contract — to create your account and provide the Service you signed up for.
• Legitimate interests — to secure the Service, prevent fraud, fix errors and improve the product, balanced against your rights.
• Legal obligation — to keep financial records and respond to lawful requests.
• Consent — where we ask for it, for example for optional emails. You can withdraw consent at any time.

Health data collected by coaches. Health and fitness data is a special category of personal data. The coach, as controller, is responsible for having a valid legal basis to collect it — usually the client's explicit consent — and for telling clients how it will be used. Our terms of service require coaches to do this. We process this data only to provide the Service to that coach and their client.

06Sharing and sub-processors

We share personal data only with the service providers that help us run Sylorya, under contracts that require them to protect it and use it only to provide their services to us:

Inside a coaching business, data is visible according to team roles: owners and admins can see all clients of their organization, while coaches and assistants see the clients assigned to them. Clients see only their own data.

We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger or sale of our business, in which case this policy will continue to apply. We do not sell personal data.

07International transfers

Our team is based in Morocco, and some of our providers process data in the United States, the European Union and other countries. Where data is transferred out of the European Economic Area, the United Kingdom or another country with transfer rules, we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses offered by our providers.

08How long we keep data

• Account and client data is kept for as long as the account or organization is active. A coach can delete client records at any time.
• After deletion, data is removed from our live systems promptly, normally within 30 days. Copies in encrypted backups expire on a rolling schedule and are not restored except to recover from an incident.
• Billing records are kept as long as tax and accounting law requires. Paddle keeps its own records as merchant of record.
• Logs and error reports are kept for a limited period, generally no longer than 90 days.

09Security

We use technical and organizational measures appropriate to the sensitivity of the data, including:

• Encryption in transit (HTTPS) for all traffic, and encryption at rest by our providers.
• Passwords stored only as strong one-way hashes.
• Strict separation of each organization's data from every other.
• Role-based access inside each organization.
• Private file storage for progress photos, served only through short-lived links.
• Rate limiting, security headers and monitoring for errors and abuse.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify affected coaches and, where required, the authorities and affected individuals without undue delay.

10Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Export your data in a portable format. Coaches and clients can export their data from their settings inside the app.
• Correct inaccurate data, most of which you can edit directly in the app.
• Delete your data. You can delete your account from your settings inside the app; an organization owner can delete client records and the organization.
• Restrict or object to certain processing, and withdraw consent where processing is based on consent.
• Complain to your local data protection authority.

To use any of these rights, use the in-app tools or email support@sylorya.com. We will answer within one month and may need to verify your identity first. If you are a client and the request concerns data your coach controls, we will forward it to your coach and support them in responding.

11Cookies and local storage

We use only strictly necessary cookies: secure, HTTP-only cookies that keep you signed in and protect your session. Because they are essential for the Service to work, they do not require consent.

We store your light or dark theme choice in your browser's local storage. We do not use advertising cookies, cross-site tracking or third-party analytics cookies. When you open the Paddle checkout to pay for a plan, Paddle may set its own cookies needed to process the payment securely.

12Children

The Service is not intended for anyone under 16. Coaches must not create accounts for, or collect data about, clients under 16 through Sylorya. If you believe a child under 16 has provided us personal data, contact us and we will delete it.

13Changes to this policy

We may update this policy as the Service or the law changes. We will change the "last updated" date above and, for material changes, notify account owners by email or in the app before the change takes effect.

14Contact us

Sylorya
[Registered address — to be completed]
Morocco
Email: support@sylorya.com