1. About this policy
This Privacy Policy explains how Athly Operations Pty Ltd (ACN 696 739 027 / ABN 59 696 739 027), trading as Athly ("Athly", "we", "us", "our"), collects, uses, shares, and protects the personal information of people in South Africa who use the Athly Service. Our registered office is Level 2/315 Brunswick St, Fortitude Valley QLD 4006, Australia.
Athly operates a subscription platform on which elite athletes' coaching methodologies are delivered to you through an AI coaching experience (the "Service"), available at getathly.com and through our progressive web app.
We handle your personal information in line with the Protection of Personal Information Act 4 of 2013 ("POPIA"). As an Australian company we are also bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
In POPIA's terms, Athly is the responsible party for your personal information, and the service providers listed in Section 5 are our operators.
If you live outside South Africa, the Privacy Policy for your country applies instead; you can switch between them at the top of this page.
This policy does not cover:
- How athletes' own personal information (voice, likeness, methodology) is handled under their agreements with Athly. That is dealt with separately in the privacy notice annexed to each athlete's agreement.
- Third-party websites or services we link to. Their privacy practices are their own.
2. The personal information we collect
We collect only the information we need to provide the Service.
a. Account and identity information
- Name and email address
- Password (stored only in hashed form; we never see it in plain text)
- Mobile phone number, where you give us one when you apply for a place with an athlete (see Section 11A)
- Your self-declared age (see Section 9)
b. Onboarding and profile information
- Sport and position
- Competitive level
- Training goals
- Training days and current training setup
- The athlete you subscribe to
c. Content you generate when using the AI coach
- The text of messages you send to and receive from your AI coach
- Voice recordings you create when you use voice input. Voice input is transcribed to text on receipt and the raw audio is deleted within 24 hours (see Section 10). We do not use your voice to identify you.
- Your training progress, completed sessions, and tier progression
d. Special personal information: health
The Service is a coaching product. While using the AI coach you may tell it about your health, injuries, physical condition, or mental wellbeing (for example, that you are sore, injured, or struggling). POPIA treats information about your health as special personal information (section 26), and we may only process it with your consent (Section 6).
Do not provide more health information than you choose to. The AI coach gives general fitness information, not personal medical advice. Please do not share detailed medical history, diagnoses, or clinical information.
e. Payment information
Subscription payments are processed by Stripe. Stripe collects and processes your card details directly; Athly does not see, receive, or store full card numbers. We receive only a payment token and limited transaction metadata (for example, that a payment succeeded, the last four digits, and billing country).
f. Technical and usage information
- Device type, operating system, browser
- IP address and approximate location derived from it
- Server logs and records of your interactions with the Service, kept for security, troubleshooting, and service integrity
- Referral or attribution information recording which athlete's link, code, or landing page you signed up through (see Section 4)
- Product analytics events (see below), and cookies and similar technologies — see our separate Cookie & Tracking Notice
We use PostHog for product analytics, to understand how the Service is used so that we can improve it. We do not use advertising trackers, advertising pixels, or cross-site behavioural targeting, and we do not sell or share analytics data with advertising networks.
We do not collect identity numbers or other government identifiers, and we ask that you do not provide them.
g. What you must give us, and what happens if you do not
| Information | Required or optional | If you do not provide it |
|---|---|---|
| Name, email address, password | Required | We cannot create your account |
| Your age | Required | We cannot create your account |
| Payment details (collected by Stripe) | Required to subscribe | You cannot subscribe |
| Onboarding and profile answers | Optional, but used to personalise your coaching | Your coaching is less personal to you |
| Mobile number | Required only to apply for a place with an athlete | You cannot apply through that form |
| Health information in chat | Optional | The coach cannot adapt your training to an injury or condition |
| Voice input | Optional | You use text instead |
| Sharing your details with your athlete | Optional | The athlete receives nothing that identifies you |
| Marketing messages | Optional | You receive service messages only |
No law requires you to give us your personal information. We keep payment records because tax and financial-records law that applies to us requires it (Section 10).
3. How we collect personal information
We collect personal information:
- Directly from you — when you create an account, complete onboarding, chat with the AI coach, use voice input, apply for a place with an athlete, or contact us.
- Automatically — through cookies, analytics, and server logs as you use the Service (see the Cookie & Tracking Notice).
- From our service providers — limited to what they tell us in order to run the Service, for example Stripe confirming a payment outcome.
Sign-up is by email address and password. We do not offer social or third-party login.
4. Why we use your information, and on what grounds
POPIA allows us to process personal information only on a lawful ground (section 11). For each purpose, the ground we rely on is:
| Purpose | Ground under POPIA section 11(1) |
|---|---|
| Creating and administering your account, and authenticating you | (b) necessary to perform our contract with you |
| Providing the Service — AI coaching, training programs, progress tracking, and tier progression personalised to your answers and chat history | (b) contract |
| Processing your subscription payments and managing billing (via Stripe) | (b) contract |
| Keeping payment and financial records | (c) obligation imposed by law |
| Attributing your subscription to the athlete whose link, code, or landing page you signed up through, so that we can calculate and pay that athlete's revenue share | (f) our legitimate interest |
| Responding to your enquiries and complaints | (b) contract, and (f) legitimate interest |
| Security, integrity, and performance of the Service; detecting and preventing fraud, misuse, and breaches of our Acceptable Use Policy | (f) legitimate interest |
| Product analytics, to improve the Service | (f) legitimate interest |
| Processing health information you share in chat | (a) your consent (Section 6) |
| Marketing messages | (a) your consent, or as our customer (Section 11) |
| Sharing your name and email with your athlete | (a) your consent |
We do not sell your personal information.
Use of your content to train or improve AI models
We do not currently use your conversations, voice recordings, or profile information to train or fine-tune AI models. Your content is used to generate responses to you and to deliver the Service to you, not as training data for any model, whether ours or a third party model.
This may change in the future. If we later use your content to help train or improve AI models, it will first be de-identified — your name, email address, and any other detail that could reasonably identify you removed — so that the training data is anonymous and cannot be traced back to you. We will not use raw voice recordings for training. They are deleted within 24 hours of transcription in any event (see Section 10).
If we ever propose to train a model on information that still identifies you, we will ask for your express opt-in consent first. Either way, we will update this policy and give you reasonable notice before any such change takes effect (see Section 16).
Sharing your details with the athlete you subscribe to
Only if you separately opt in, we will give the athlete whose coaching you subscribe to your name and email address.
This is entirely optional. It is not required in order to subscribe, it is asked for separately from your acceptance of the Terms of Service, and it is switched off unless you actively turn it on. By opting in, you agree that the athlete may send you their own marketing by email. You can withdraw at any time by emailing contact@getathly.com.
If you do opt in:
- The athlete receives your name and email address only. Nothing else.
- The athlete may use it to promote their own professional activities.
- Under our agreement with the athlete, they must not use it to promote a competing coaching product, and they must comply with the privacy and direct marketing laws that apply to them, including identifying themselves and offering an unsubscribe option in any marketing message.
If you do not opt in, the athlete receives nothing that identifies you.
Separately, and regardless of whether you opt in, we may share aggregated and de-identified insights with the athlete — for example, how many subscribers completed a program. This never identifies you.
We never disclose the content of your conversations with the AI coach to the athlete.
5. Who we share your information with
To run the Service we use service providers who process personal information on our behalf (operators). Each is engaged only for the function listed, under a written contract that requires it to keep your information confidential, to protect it with appropriate security measures, and to tell us if it is compromised.
| Provider | Function | Data involved | Location |
|---|---|---|---|
| OpenAI, Inc. / Anthropic PBC | AI model inference (generating coach responses) | Your messages and relevant profile context | United States |
| ElevenLabs, Inc. | Voice synthesis of coach responses | Text to be voiced; voice interaction data | United States |
| Supabase | Database and authentication | Account, profile, chat, and progress data | United States |
| Amazon Web Services, Inc. | Cloud hosting and storage | Most categories of data we hold | United States |
| Vercel Inc. | Application hosting and delivery | Technical and server log data | United States |
| Stripe, Inc. | Payment processing | Payment and billing data | United States / Ireland |
| PostHog | Product analytics | Usage and interaction events, device and browser information, IP address | United States |
| Resend | Transactional and marketing email | Name, email | United States |
| ClickSend Pty Ltd | SMS delivery | Mobile number, message content | Australia |
| Twilio Inc. | SMS delivery to numbers outside Australia | Mobile number, message content | United States |
We also use third-party tools to produce the athletes' promotional content. Those tools process the athlete's own material and do not receive or process your personal information.
We do not otherwise disclose your personal information except:
- With your consent (including the optional athlete disclosure in Section 4)
- Where required by law (for example, a court order, or to a regulator such as the Information Regulator)
- To protect the safety of a person, or to prevent or investigate a serious crime or serious threat
- To a buyer or successor in the event of a sale, merger, or restructure of Athly, subject to this policy continuing to apply
6. Health information and your consent
We process health information you share with the AI coach only with your consent (POPIA section 27(1)(a)), and only to adapt your coaching. We do not use it for marketing.
We ask for that consent separately, when you first start using the coach. It is never pre-ticked, and you can use the Service without giving it. If you do not consent, please do not share health information with the coach.
You can withdraw your consent at any time by emailing contact@getathly.com. When you do, we stop processing health information you share from then on and, if you ask, delete the chat content that contains it. Withdrawing consent does not affect processing that took place before you withdrew it.
7. Where your information goes outside South Africa
Every service provider listed in Section 5 stores or processes personal information outside South Africa, in the United States, Australia, and (for Stripe) Ireland. Athly itself is in Australia.
The level of protection in those countries is not the same as POPIA's.
- Australia has a general privacy law, the Privacy Act 1988 (Cth), which binds Athly and ClickSend.
- Ireland is subject to the European Union's General Data Protection Regulation.
- The United States has no single federal privacy law equivalent to POPIA. Protection there depends on state law and on the contract with each provider.
We protect your information in transit to and inside those countries by:
- binding agreements with each provider that require them to protect it to a standard substantially similar to POPIA's conditions for lawful processing, and that restrict passing it on (POPIA section 72(1)(a));
- relying on the transfer being necessary to perform our contract with you for the information we need to provide the Service (section 72(1)(c)); and
- for health information, your consent (section 72(1)(b)), given as part of the consent in Section 6.
8. How we secure your information
We take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage, unauthorised destruction, and unlawful access or processing (POPIA section 19). Our security program includes:
- AES-256 encryption of personal information at rest
- TLS 1.2 or higher for data in transit
- Multi-factor authentication on all administrative and privileged access
- Role-based access control with least-privilege defaults, limiting staff access to personal information on a need-to-know basis
- Hashing of passwords
- A documented incident response procedure (see Section 13)
- Regular vulnerability assessment of production systems
- Written security requirements flowed down to our providers
No method of transmission or storage is completely secure.
9. Age — 16 or over, and parent or guardian consent under 18
The Service is for users aged 16 and over. We ask for your age at the start of sign-up, before we collect any other personal information. If you are under 16, we will not create an account, and we do not retain the information you entered.
If you are 16 or 17. POPIA treats anyone under 18 as a child, and we may process a child's personal information only with the prior consent of a parent or guardian (sections 34 and 35(1)(a)). So:
- We ask you for your parent's or guardian's name and email address, and use them only to send the consent request.
- We send them a request that explains what we collect, why, where it is processed (including outside South Africa), and that you may share health information with the coach.
- Until they consent, we process nothing beyond your age and the details needed to send the request. If they do not consent within 7 days, we delete their details and yours.
- Your parent or guardian can ask to see your information, ask us to correct or delete it, and withdraw their consent at any time by emailing contact@getathly.com. If they withdraw it, we close your account.
If we become aware that we hold personal information about a person under 18 without that consent, or about anyone under 16, we will delete it. If you believe this has happened, contact us at contact@getathly.com.
10. How long we keep your information
We keep personal information only for as long as we need it for the purposes in this policy, or as the law requires (POPIA section 14). After that we delete or de-identify it so that it cannot be reconstructed in an intelligible form. Our retention periods are:
| Data | Retention |
|---|---|
| Account and profile information | For the life of your account, then deleted within 90 days of account closure |
| Chat messages and coaching history | For the life of your account; you may delete individual content where the Service allows |
| Voice recordings (raw audio) | Transcribed on receipt; raw audio deleted within 24 hours |
| Voice transcriptions | Treated as chat content, above |
| Payment records | 7 years, to meet tax and financial-records law that applies to us |
| Server and security logs | 12 months |
11. Direct marketing and communications
We may send you:
- Service messages (for example, billing, security, or changes to the Service). These are part of providing the Service and are not marketing.
- Marketing messages by email or SMS. We send these only if you have opted in, or, where you are our customer, about our own similar services, having given you the chance to refuse them when we collected your details (POPIA section 69). Every marketing message identifies Athly and tells you how to opt out, free of charge. You can opt out at any time via the unsubscribe link or at contact@getathly.com.
If you have opted in to share your details with your athlete (Section 4), that athlete may also send you marketing messages. They are required to include an unsubscribe option. Unsubscribing from the athlete does not unsubscribe you from Athly, and unsubscribing from Athly does not unsubscribe you from the athlete — they are separate senders. You can also ask us to stop sharing your details with the athlete at any time by emailing contact@getathly.com.
We do not use health information for direct marketing.
11A. SMS and text message communications
If you apply for a place with one of our athletes, the application form asks for your mobile number and you tick a box to confirm we may text you about that application. The box is never pre-ticked, and the application cannot be submitted without it.
What we send. The outcome of your application, the details of any place we offer you, and reminders about the deadline on that offer. Message frequency varies and is no more than four messages in relation to an application. Message and data rates may apply, depending on your mobile plan.
How to stop. Reply STOP to any message and we will stop texting you. Reply HELP for help, or email contact@getathly.com. Opting out of text messages does not cancel your subscription or stop service emails.
How we handle your mobile number. We use it only for the purposes described above and to contact you about the Service. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
We disclose your mobile number only to the messaging providers listed in Section 5, who send the messages on our behalf under contract and may not use it for any other purpose. It is not disclosed to the athlete you apply to, and it is not included in the optional athlete disclosure described in Section 4, which covers name and email address only.
11B. Text messages to South African numbers
The messages described in Section 11A are about an application you made. They are not marketing. To a South African number they are sent by Twilio Inc. (United States). If we ever text you marketing, Section 11 applies to it, and we will only send it if you have agreed to receive it.
12. Your rights under POPIA
You have the right to:
- Know that we are collecting your personal information, and why (this policy).
- Access your information: ask us, free of charge, whether we hold personal information about you, and ask for a copy of it (POPIA section 23). Confirming whether we hold information is always free. If a request for a copy involves a fee allowed by law, we will tell you the amount in writing before we proceed.
- Correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading, or obtained unlawfully, and ask us to delete or destroy information we are no longer entitled to keep (section 24). If we do not agree to a correction, you can ask us to attach a note to the information recording that you asked for it.
- Object to processing we carry out on the ground of legitimate interests (section 11(3)), and object at any time to direct marketing. When you object, we stop that processing unless the law allows us to continue.
- Withdraw consent at any time, where we rely on it (section 11(2)(b)).
- Ask us to restrict processing in the circumstances set out in section 14(6), for example while you contest the accuracy of information.
- Not be subject to a decision based solely on automated processing that has legal consequences for you or affects you to a substantial degree (section 71). Your coaching recommendations are generated automatically to personalise your training; you are free to follow or ignore them. We do not suspend or close accounts automatically: a person reviews that decision, and you can contact us to make representations.
- Be told if your personal information is compromised (Section 13).
- Complain to the Information Regulator (Section 14), and to bring civil proceedings (section 99).
To exercise any of these rights, email contact@getathly.com. It is free. We will verify your identity before releasing or changing any information, and we will tell you the outcome in writing within 30 days.
13. If your information is compromised
If there are reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible after we discover it (POPIA section 22). We will tell you by email what happened and its possible consequences, what we have done about it, what you can do to protect yourself, and, if we know it, who accessed your information.
14. Complaints
If you think we have mishandled your personal information:
- Email contact@getathly.com with "Privacy Complaint" in the subject line.
- We will acknowledge within 2 business days and aim to resolve within 30 days.
- We will tell you the outcome and our reasons.
You can complain to the Information Regulator (South Africa) at any time, whether or not you have complained to us first:
- Website: inforegulator.org.za (complaints are made on the Regulator's Form 5)
- Email: POPIAComplaints@inforegulator.org.za
- Telephone: 010 023 5200
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
15. Information Officer
Our Information Officer is name or title to be confirmed, who can be contacted at contact@getathly.com. A manual under the Promotion of Access to Information Act 2 of 2000 will be published at getathly.com if it is required.
16. Changes to this policy
We may update this policy as the Service, our providers, or the law change. The current version is always at getathly.com. Where a change is material, we will give you reasonable notice (for example, by email or in-app) before it takes effect.
17. Contact
Athly Operations Pty Ltd (ABN 59 696 739 027)
Level 2/315 Brunswick St, Fortitude Valley QLD 4006, Australia
contact@getathly.com