Privacy notice and analytics settings

EF PRODUCT LABS LTD, operating as Repit, is responsible for account, billing, security, support and direct service-operation information. A coach, gym, school, team or other organisation may be the controller for client information it chooses to manage through Repit; in that situation, Repit processes the information on its instructions.

EF PRODUCT LABS LTD is registered in England and Wales under company number 17285911. Its registered office is 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

Privacy questions and requests can be sent to support@repit.coach. If your request concerns information managed by a coach or organisation, we may direct it to that controller.

Some Repit features can contain health-related or other special-category information. Those features should only be used where the responsible controller has an appropriate UK GDPR Article 6 basis and Article 9 condition. Where Repit asks an individual for consent, it must be freely given, specific, informed and capable of withdrawal.

Coaches and organisations must not require unnecessary sensitive information or use Repit as an emergency or medical record system.

Information may be shared with:

• the coaches, clients and workspace members authorised by the relevant relationship and permissions;
• Supabase for database, authentication, storage and server services;
• Vercel for web hosting and delivery;
• Stripe and connected payment providers for web payments and billing;
• Apple, Google and RevenueCat where app distribution or in-app subscriptions apply;
• Resend and similar delivery providers for transactional email;
• OpenAI for requested AI features, subject to configured data controls;
• PostHog only for optional analytics after consent; and
• professional advisers, regulators, courts or authorities where legally required.

Repit does not sell personal information or share it with third parties for their independent direct marketing.

AI features can analyse the context supplied to a conversation and propose coaching actions. Coaches are expected to review proposals before applying them. Repit does not intend AI outputs to make solely automated decisions that produce legal or similarly significant effects about an individual.

Do not place information in an AI conversation unless it is necessary for the requested task and you are authorised to use it.

Some providers may process information outside the United Kingdom. Where required, Repit relies on safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, and contractual and technical protections. You can ask us for more information about safeguards relevant to your data.

Current provider terms include the PostHog DPA and the Supabase DPA.

We keep account and service information while it is needed to provide Repit. Retention then depends on the record's purpose: security and support records are kept for a proportionate investigation period; optional attribution records follow the periods below; and financial, tax, contract and transaction records may be retained for the legally required period.

Deletion removes or de-identifies information according to the account lifecycle described on our account-deletion page. Backups and provider systems may take additional time to age out, and legal holds may temporarily override normal deletion.

Depending on the circumstances, UK data-protection law gives you rights to be informed, access your information, correct it, erase it, restrict processing, receive portable data, object, withdraw consent, and challenge certain automated decisions.

Send a request to support@repit.coach. We may verify your identity and normally respond within one month. You can complain to the UK Information Commissioner's Office at ico.org.uk, although we would appreciate the opportunity to resolve the concern first.

Repit uses access controls, scoped permissions, encryption in transit, logging and provider security controls designed to protect information. No system is completely secure. If we become aware of an incident, we investigate, contain it and notify affected people or regulators where required.

Coach accounts are for adults. Where an organisation uses Repit with a young athlete, the organisation is responsible for appropriate authority, notices, safeguarding and age-appropriate use. Contact us if you believe a child's information has been provided without proper authority.

Product marketing is optional. You can unsubscribe using the link in an email or contact us. Service, security, billing and account messages are not marketing and may still be sent when necessary.

During coach setup, Repit may ask for country, coaching context and a categorical source describing how you heard about Repit. Choosing AI assistant or Other allows an optional detail of up to 120 characters. You can choose Prefer not to say, and these questions do not affect access.

Repit keeps self-reported answers separate from observed attribution. A browser-readable consent cookie is not treated as server proof. Until purpose-specific server-verifiable consent is available, the experiment currently uses the self-report-only path.

The information is used for experiment qualification and bounded acquisition comparisons. Raw source detail is deleted after 90 days, and the minimised user-level record is deleted or irreversibly aggregated after day 150. Account deletion removes the user-level experiment record and pending enrolment job.

We review this notice when our processing, providers or legal obligations change. We will publish the new effective date and bring material changes to users' attention where appropriate.