01Who we are
Coach Cadence is a service operated by Store Relevance Ltd, a company registered in England & Wales.
- Company no.
- 12390186
- Registered office
- Clare House, Frieth Road, Marlow, SL7 2JQ, United Kingdom
- Data controller
- Store Relevance Ltd
- ICO registration
- Registration pending
- Contact for privacy
- james@jdturnbull.com
In this policy, "Coach Cadence", "we", "us" and "our" mean Store Relevance Ltd. "You" means anyone whose personal data we hold.
02What this policy covers
Three surfaces, and the data that flows through each:
- This marketing website at site-cadence.vercel.app and any future domain we publish under.
- The Coach Cadence WhatsApp service, the messages you exchange with the coach, and the media you send (voice, images, locations, documents).
- The Strava connection, the activity history, segment efforts, and profile data we read from your Strava account after you authorise us.
It does not cover websites or services run by third parties that we link to (Strava, Meta/WhatsApp, etc.). Their own privacy policies apply to them.
03What we collect
From WhatsApp
- Your WhatsApp phone number and the WhatsApp ID it routes to.
- The text content of messages you send to the coach.
- Media you send: voice notes, images, videos, location pins, and documents (including GPX route files and PDFs).
- Voice notes are transcribed into text by our speech-to-text provider; we store both the original audio reference and the transcript.
- Message metadata (timestamps, delivery state, read receipts).
From Strava (after you authorise us)
- Strava profile data: name, sex, weight, FTP if you've set it, city/country, profile picture, measurement preference.
- Activity records: every cycling activity you upload, distance, duration, elevation, heart rate, power, speed, perceived effort, GPS polyline (for outdoor rides).
- Segment effort records and their related segment metadata (name, location, average grade, climb category).
- OAuth tokens needed to read your data on an ongoing basis.
That we derive
- Rollup metrics, weekly volume, weekly load, training stress (TSS / hrTSS / estimated), load trend, consistency, training patterns.
- Memories, short text records of things worth remembering about you that the coach extracts after conversations (preferences, constraints, goals, context, tone). You can ask the coach to forget any of these at any time.
- An athlete card, your profile, goals, availability, FTP, weight, timezone, and inferred home base.
- A plan, your current training programme, phases, weeks, and individual sessions.
From your use of this website
- Basic server access logs (IP address, timestamp, user agent, requested URL) held briefly for security and debugging purposes.
- That's it. We do not run analytics, advertising, or fingerprinting on this site. See Cookies below.
04Why we use it (lawful bases)
Under UK GDPR we need a lawful basis for every purpose we use your data for. We rely on:
Performance of a contract
When you use Coach Cadence, you're entering into an agreement with us (set out in our Terms). To deliver the coaching service, receive your messages, read your Strava history, generate coaching responses, send replies, we need to process your data. We do this under the lawful basis of performing that contract.
Consent
For anything that goes beyond what's strictly needed to deliver the service, we rely on your consent, which you can withdraw at any time. This includes:
- Processing health-related data (heart rate, training load, weight, perceived effort), see below.
- Using anonymised excerpts of your conversations to improve the quality of the coach. If you'd rather we didn't, tell the coach in WhatsApp and we'll exclude you from that.
Legitimate interests
For service operations that aren't strictly contractual, keeping the service secure, fixing bugs, monitoring reliability, we rely on our legitimate interests, balanced against your rights and expectations.
05Health-related data
Some of the data we process is what UK GDPR calls "special category" data, specifically, data concerning health. Heart rate, training load, weight, perceived effort, fatigue and soreness all fall into this bucket. We treat it as special category data and process it only on the basis of your explicit consent, which you give when you connect Strava and start a conversation with the coach.
You can withdraw that consent at any time. Withdrawing it means we can no longer provide the coaching service in any meaningful way, so disconnect Strava and tell the coach to stop, and we'll delete what we hold per the schedule in How long we keep it.
We do not sell this data. We do not share it with insurers, employers, advertisers, or any party whose interest is not directly delivering your coaching.
06Who we share it with
We use third-party services ("sub-processors") to deliver Coach Cadence. Each one only ever sees the data it needs to do its job, under a written data-processing agreement and equivalent data-protection standards.
- Anthropic
- LLM inference, the model that generates coaching responses. Receives your assembled context per turn. Anthropic's enterprise terms confirm prompts and outputs are not used to train their public models.
- OpenAI
- Embeddings only, short numeric representations of memory entries, used to retrieve relevant memories. No conversation content is sent for training.
- Deepgram
- Speech-to-text, transcribes inbound voice notes. Audio is processed and not retained on Deepgram's side.
- Gemini for image generation (plan calendars, summaries); Maps Directions & Static Maps APIs for route generation. We send the minimum context needed (location, distance, elevation target).
- Strava
- We read your data from Strava on your authorisation, via their public API. We do not write to Strava.
- Meta / WhatsApp
- The transport layer. Messages move through WhatsApp's infrastructure on the way to and from you. WhatsApp's own privacy terms apply to that leg.
- Convex
- Our primary database and file storage. Your messages, activities, memories, and plan live here.
- Trigger.dev
- Durable workflow orchestration for long-running tasks (Strava backfill, outbound message delivery).
- Fly.io
- Hosts the always-on WhatsApp bridge process.
- Vercel
- Hosts this marketing website.
- Weather provider
- We send a date and location to fetch a forecast, no personal identifiers.
We don't share your data with anyone for marketing or advertising. We don't sell it. We don't share it with any party outside this list without telling you first.
07International transfers
Several of the sub-processors above are based in the United States. When your data is transferred to them, we rely on the following safeguards under UK GDPR:
- The UK Extension to the EU-US Data Privacy Framework (the "data bridge") for transfers to certified US providers; or
- UK International Data Transfer Agreements and/or the EU Standard Contractual Clauses where the data bridge does not apply.
We assess each sub-processor's safeguards before onboarding and keep our records up to date. Email us if you want details for a specific provider.
08How long we keep it
Defaults, these are tuneable and we'll tell you if they change:
- Account data
- For as long as your account is active, plus 90 days.
- Conversation & activity data
- Deleted within 30 days of you disconnecting Strava or asking the coach to stop.
- Memories
- Deleted within 30 days of account deletion. You can delete individual memories any time by asking the coach.
- Voice transcripts
- Stored alongside the message; deleted on the same schedule as conversation data.
- Server / access logs
- 12 months, then deleted.
- Things we need to keep for legal reasons
- For example, records of consent and transactional records, for the period required by applicable law (typically 6 years for UK tax law).
09Security
We follow standard practices appropriate for the data we hold: encryption in transit (TLS), encryption at rest where supported by our providers, access controls, and least-privilege credentials for all service-to-service calls.
No system is bulletproof. If we ever experience a personal data breach that's likely to result in a risk to your rights, we'll tell you and the ICO without undue delay, in line with UK GDPR requirements.
10Your rights
Under UK GDPR you have the following rights over your personal data. To exercise any of them, email james@jdturnbull.com, we'll respond within one month.
- Access, a copy of the personal data we hold about you.
- Rectification, correction of anything that's wrong.
- Erasure, deletion of your data ("right to be forgotten"), subject to anything we're legally required to keep.
- Portability, a machine-readable export of your data, where applicable.
- Objection, to processing based on legitimate interests.
- Restriction, to pause our processing while a concern is being resolved.
- Withdraw consent, at any time, with no effect on processing already carried out.
- Complain to the ICO, the Information Commissioner's Office is the UK regulator for data protection. You can complain to them at ico.org.uk/make-a-complaint. We'd appreciate the chance to fix things first, but you don't have to come to us before going to them.
You can also just tell the coach in WhatsApp. "Stop and delete my data" is a valid request. We'll confirm in writing.
12Children
Coach Cadence is intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has interacted with the coach, please contact us and we'll delete the relevant data.
13Changes to this policy
We'll update this policy when our practices change. The "effective" and "last reviewed" dates at the top of this page tell you when it was last touched. For material changes (new sub-processors handling material data, changes to retention or lawful bases) we'll notify active users via WhatsApp before the change takes effect.
14How to contact us
For anything in this policy, questions, requests, complaints, or suggestions, james@jdturnbull.com is the address.
Post:
Data Privacy, Store Relevance Ltd
Clare House, Frieth Road
Marlow, SL7 2JQ, United Kingdom