x²coach (operated by MUSKOX INTERNATIONAL SRL) respects your privacy. This policy explains what personal data we collect, why, how we use it, and what rights you have over it.
x²coach is operated by MUSKOX INTERNATIONAL SRL, a company registered in Romania (CUI 42976383, Trade Register No. J08/1655/2020), with registered office at Str. Carpaților 65, Bl. P3, Sc. A, Ap. 2, Brașov, Romania, 500269. For any privacy-related request, contact us at office@x2coach.com.
We collect: (a) account data you provide directly — name, email, password, payment details (processed by Stripe, we do not store card numbers); (b) practice data you and your clients enter into the platform — session notes, behavioral check-ins (sleep, energy, mood, habits), motivational scores, messages, and progress records; (c) technical data — IP address, browser type, device information, collected automatically for security and analytics; (d) communication data — emails, support requests, application form submissions.
We process your data on these legal bases under GDPR Article 6: performance of a contract (to provide the service you signed up for), legitimate interest (to improve the platform, prevent fraud, and ensure security), consent (where you explicitly opt in, e.g. marketing communications), and legal obligation (accounting and tax records).
Some data processed on the platform — sleep, mood, energy, behavioral patterns — relates to wellbeing and may be considered a special category under GDPR Article 9 depending on context. We process this data only on the basis of explicit consent given by the client when they use the practitioner's workspace, for the sole purpose of supporting the coaching relationship. We do not use this data for advertising and do not sell it.
We share data with service providers who help us run the platform, strictly to the extent needed: Supabase (database hosting, EU/US data centers), Vercel (application hosting), Stripe (payment processing), Resend (transactional email delivery). Each provider acts as a data processor under contract and is bound by confidentiality and security obligations. We do not sell personal data to third parties.
Some of our service providers may process data outside the European Economic Area (notably in the United States). Where this occurs, we rely on Standard Contractual Clauses or equivalent safeguards recognized under GDPR to ensure your data remains protected.
We retain account and practice data for as long as your account is active, plus a reasonable period afterward for legal and accounting purposes (typically up to 5 years for financial records, per Romanian tax law). You can request earlier deletion as described below.
Under GDPR, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure ('right to be forgotten'); restrict or object to processing; receive your data in a portable format; withdraw consent at any time; and lodge a complaint with a supervisory authority (in Romania, the ANSPDCP — www.dataprotection.ro). If you are a California resident, you additionally have rights under the CCPA, including the right to know what personal information we collect and the right to request deletion; we do not sell personal information. To exercise any of these rights, contact office@x2coach.com.
We use cookies for essential site functionality and analytics. See our separate Cookie Policy for details.
We use industry-standard measures including encryption in transit (TLS) and access controls to protect your data. No system is perfectly secure, and we cannot guarantee absolute security, but we take reasonable steps to protect your information.
We may update this policy from time to time. Material changes will be communicated via email or a notice on the platform. The 'last updated' date above reflects the most recent revision.
For any question about this policy or your data, contact us at office@x2coach.com.