Privacy Policy

Bogas Training. Last updated: September 16, 2026

Bogas Training is a coaching platform for independent fitness and nutrition coaches, built and operated by Bogas Solutions LLC ("Bogas", "we", "us"), a software company based in Puerto Rico (United States). A coach opens an account (a "workspace") and uses it to talk to prospects and clients, book calls, deliver training and nutrition programs, and collect payments. The coach's clients use the client app and the coach's public pages.

This policy explains what personal data we collect through bogastraining.com, the coach console, the client app and the integrations a coach connects, how we use and protect it, and the rights you have. It applies whether you are a coach, a coach's client, or someone who messaged a coach.

1. Roles: who is responsible for what

• The coach is the business you are dealing with. Their leads, clients, conversations, plans and payments belong to the coach's workspace.
• Bogas operates the platform and processes that data on the coach's behalf. For the messaging integrations described in section 4, Bogas acts as a technology provider: we connect the coach's own WhatsApp Business, Instagram and Facebook Messenger accounts to the coach's workspace so the coach can receive and reply to messages from their own customers.
• Each workspace is isolated from every other workspace at the database level. One coach cannot see another coach's data.

2. Data we collect

On this website

• Nothing beyond standard server logs (IP address, browser, pages requested) kept for security and troubleshooting. Demo requests are sent by email from your own mail client.

From coaches (workspace owners and their staff)

• Account data: name, email, business name, brand assets (logo, colors), time zone, custom domain.
• Credentials for the integrations the coach chooses to connect (Meta, Google, Stripe, Plaid). We store the access tokens those services issue, encrypted; we never receive the coach's passwords.

From leads and clients of a coach

• Contact details submitted in the coach's qualification form or booking page: name, phone, email, goals and answers to the form.
• Appointments booked with the coach (date, time, video-call link).
• Client-app data: membership, assigned routines and nutrition plans, workout logs, progress check-ins and photos the client chooses to upload.
• Messaging data from the coach's connected WhatsApp, Instagram and Messenger accounts (section 4).

3. Payments and bank data

• Stripe. Memberships and packages are charged through Stripe. Card numbers are entered on Stripe's own pages and never touch our servers; we receive the payment status, amount, the last four digits and the customer reference.
• Plaid. A coach may connect their own business bank account through Plaid Link to reconcile deposits. Authentication happens between the coach, their bank and Plaid; we never see bank login credentials. We receive read-only balances and transactions, used only for reconciliation inside that coach's workspace. Access tokens are stored in an encrypted vault and are deleted when the coach disconnects the bank. Plaid's handling of data is governed by the Plaid End User Privacy Policy.

4. Messaging via Meta platforms (WhatsApp, Instagram, Messenger)

A coach can connect their own WhatsApp Business number, Instagram professional account and Facebook Page to their workspace using Meta's official login and Embedded Signup flows. In this arrangement Bogas Solutions LLC is the technology provider and the coach is the business the customer chose to message.

• What we receive. When a customer messages the coach's connected account we receive what is needed to deliver it into the coach's inbox: the message text and attachments, the sender's platform-scoped ID and public profile name, the phone number (for WhatsApp) and timestamps. For Instagram and Facebook we also read basic account and Page information (name, ID, profile picture) to show which account is connected.
• WhatsApp on the coach's phone (coexistence). A coach who keeps using the WhatsApp Business app on their phone can link that same number. When they do, and only if they accept it in WhatsApp, Meta shares with the workspace the coach's WhatsApp contact list and the recent message history of that number, so the console mirrors the conversations the coach already has. Messages the coach sends from their phone are mirrored into the workspace. The coach keeps full use of the number on their phone.
• What we do with it. Route conversations into the owning coach's workspace, let the coach reply, keep the conversation history so the coach can serve the customer, and send the reminders and follow-ups the coach configures (on WhatsApp, only with message templates approved by Meta and within Meta's messaging rules). Messaging data is processed on the coach's behalf and is never sold, rented, licensed or used for advertising.
• Assisted replies. A coach may turn on an assistant that drafts or sends replies in the coach's voice. To do that, the content of the conversation is processed by our AI provider (Anthropic) under contractual terms that prohibit using it to train models. Replies go out from the coach's own connected account, only to people who messaged that account, and the coach sets the limits.
• Your controls. A customer can stop a conversation at any time in the messaging app (block the account, or reply "stop"; on WhatsApp "STOP" also turns off the coach's automated messages). A coach can disconnect any Meta account from the console at any time, which revokes our access at Meta; we also honor Meta's deauthorization and data deletion callbacks.

Meta's own handling of your data is governed by the WhatsApp Privacy Policy and the Meta Privacy Policy. To have the messaging data we hold deleted, see our Data Deletion Instructions.

5. Calendar and video calls

A coach may connect their Google account. We create, update and delete the appointment events booked through the coach's booking page (including a Google Meet link), read the coach's calendar to check availability, and access only the Google Drive files the coach picks by hand (for example, exercise videos), never the whole Drive. Google's handling of data is governed by the Google Privacy Policy. Our use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

6. How we use data

• To provide, operate and support the service for the coach and their clients.
• To send the transactional and follow-up messages the coach configures, within the rules of each channel.
• To secure the platform: authentication, audit logging, abuse and fraud prevention.
• We do not sell personal data, and we do not use a coach's business, financial or messaging data for advertising or for any purpose other than operating the service.

7. Service providers

We rely on a small set of providers that process data on our behalf under their own security commitments: Google Cloud (hosting, United States), Supabase (managed database), Stripe (payments), Plaid (bank connections), Google (calendar and video calls), Meta Platforms (messaging integrations in section 4) and Anthropic (assisted replies). Providers may only use the data to render their service to us. We may also disclose information where required by law.

8. Security

All traffic is encrypted in transit (HTTPS/TLS). Data is encrypted at rest. Access is role-based with least privilege and enforced server-side on every request, with workspace isolation at the database layer (row-level security). Third-party tokens live in an encrypted vault, never in code or logs. Webhooks from Meta and Stripe are verified by signature before they are processed.

9. Retention and deletion

• We keep data while the coach's account is active. When a coach closes their account, workspace data (including messaging, calendar, payment and bank data) is deleted from production systems within 30 days; backups are overwritten on their normal rotation.
• Disconnecting an integration deletes its stored credential immediately.
• A client can delete their own account from the client app. A client or a person who messaged a coach can also ask us to delete their data at any time; see the Data Deletion Instructions.
• Records we must keep by law (for example, payment records for tax purposes) are kept for the legally required period, separated from the person's identity where possible.

10. Your rights

You may request access to, correction of, or deletion of your personal data, and ask us to stop contacting you, by writing to security@bogassolutions.com. If your data is held in a coach's workspace we will coordinate with that coach and confirm the outcome to you. You may also contact the coach directly.

11. Children

Bogas Training is directed to adults and businesses. We do not knowingly collect data from anyone under 18; a coach who works with minors is responsible for obtaining the consent of a parent or guardian.

12. Changes

We may update this policy from time to time. The current version is always published at this address with its revision date.