Cookie Policy

Version: 1.6 Effective date: 8 April 2026 Last updated: 18 September 2026

⚠️ Notice: This document was prepared as a solid legal foundation tailored to iBetterCoach. Before publication it must be reviewed by a Portuguese lawyer specialised in GDPR and digital law.

1. Legal framework

This Cookies Policy governs the use of cookies and browser local storage on the iBetterCoach platform (the "Platform"), available at www.ibettercoach.com.

The use of these technologies is regulated by:

• Regulation (EU) 2016/679 of 27 April 2016 (GDPR)
• Directive 2002/58/EC (ePrivacy Directive), transposed into Portuguese law by Law 41/2004 of 18 August, as amended by Law 46/2012
• Law 58/2019 of 8 August, ensuring the execution of the GDPR in the Portuguese legal order
• Guidelines of the Portuguese Data Protection Authority (CNPD) on cookies and identifiers
• Guidelines 03/2022 on deceptive design patterns in social media platform interfaces of the European Data Protection Board (EDPB) — guidance applied by analogy to cookie consent interfaces (deceptive design patterns / dark patterns)

iBetterCoach upholds the principle of prior, free, specific, informed and unambiguous consent for any non-strictly-necessary cookie, pursuant to Article 5(3) of the ePrivacy Directive.

2. What cookies are

Cookies are small text files placed on the user's device (computer, mobile phone or tablet) when the user visits the Platform. In the current implementation, they keep the authenticated session active and remember whether the application's sidebar is open.

The Platform also uses browser local storage (localStorage) to store the choice shown in the banner and the light/dark theme preference. For the purposes of this Policy, that storage is described with the same transparency applied to cookies.

3. Cookie categories

iBetterCoach uses two categories of technology: strictly necessary cookies and storage and, only after consent, analytics technologies on public pages aimed at professionals. The Vercel tools described below do not use third-party cookies; Microsoft Clarity may use the cookies identified in section 3.2 (the identification of the data controller that determines the purposes is subject to qualification under legal review — see section 10).

3.1 Strictly necessary (no consent required)

Essential to the Platform's basic operation. Without them, services such as authentication, session persistence, security or fraud prevention would not be possible.

The user's choice in the banner is stored in browser local storage (localStorage), under a versioned technical key (ibc-cookie-consent-v3), and not in a cookie. The light/dark theme is also stored in local storage.

Legal basis: legitimate interest of the data controller in the technical operation of the service (Article 6(1)(f) GDPR) and the exception in Article 5(3) of the ePrivacy Directive. (The identification of the data controller is subject to qualification under legal review — see section 10.)

3.2 Analytics technologies (consent only)

On the public presentation pages for professionals (/, /ciencia, /en and /en/science), the user may authorise Microsoft Clarity, Vercel Web Analytics and Vercel Speed Insights. Their scripts are not loaded and no analytics request is made before that authorisation. These tools are not mounted in the authenticated application, authentication pages, Athlete consent flows or the mobile application.

When analytics is accepted, the Platform sends analytics_Storage: granted to Clarity through Consent API V2 and always keeps ad_Storage: denied. The choice does not authorise advertising, marketing or remarketing, and these tools are not used as the source of truth for billing or product events.

Clarity collects interactions on authorised public pages, such as page rendering, clicks, pointer movements and scrolling. The project is configured with balanced masking. Authenticated-area data, health data, prescriptions, photographs, Athlete forms and billing identifiers are not sent to Clarity.

Vercel Web Analytics receives anonymous page-view events, including path, referrer, approximate location, browser and device type, which it uses to produce aggregated statistics. According to Vercel, it does not collect personal identifiers to track users across applications or websites; a technical hash distinguishes a visitor session and is discarded after 24 hours. Speed Insights receives anonymous performance data points (Web Vitals) and their technical attribution, together with network, browser, device, operating system and country information; Vercel states that these data points do not enable browsing across pages to be reconstructed or a user to be identified. These tools do not use third-party cookies.

iBetterCoach applies a closed allowlist of the four public pages above, removes parameters and fragments from each event's URL field and uses the strict-origin referrer policy so that analytics requests do not include a path, parameters or fragments in the Referer header. This does not change the browser's initial request to open a page whose own address contains parameters; public links must therefore not carry emails, tokens or other personal data in their URL.

3.3 Technologies not used

The Platform does not use advertising, marketing or remarketing cookies. Advertising storage is always denied in the signal sent to Clarity.

4. Consent banner

On the first visit to the public presentation pages (/, /ciencia, /en and /en/science), the user sees a banner with these characteristics:

1. Two buttons shown side by side and with the same dimensions: "Accept analytics" and "Reject".
2. One-click rejection, without submenus.
3. Optional analytics scripts and their network requests remain absent until explicit acceptance.
4. No deceptive design patterns (dark patterns) — there are no acceptance timers, pre-ticked boxes or wording that hides the rejection option.

The choice is stored in localStorage, under the key identified in section 3.1. The banner is not displayed in the authenticated application, which does not load these analytics tools.

The public-page footer permanently provides "Cookie preferences". There, the user can change or withdraw authorisation as easily as it was given. Withdrawal sends a denial signal to Clarity, stops new collection by all three tools and clears Clarity cookies in the browser, without affecting the lawfulness of earlier processing, pursuant to Article 7(3) GDPR.

5. Managing and disabling cookies

The user may manage cookies and local storage directly in the browser:

• Chrome: Settings → Privacy and security → Cookies and other site data
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Cookies and site permissions

Warning: disabling strictly necessary cookies may prevent the Platform from working correctly, including login.

6. Third-party services and international transfers

Of the services below, Clerk places the authentication cookies identified in section 3.1. Supabase supports the Platform's infrastructure without placing non-essential cookies in the browser. Vercel supports the infrastructure and, after consent, receives the anonymous Web Analytics events and Speed Insights performance data points described above. Microsoft Clarity receives data from public B2B pages only after consent:

For EU customers, the Clarity service is contracted with Microsoft Ireland Operations Limited. Microsoft states that the data is stored in its cloud service and that transfers between that entity and Microsoft Corporation in the United States are governed by Standard Contractual Clauses. Microsoft describes itself as the data controller for Clarity data. This qualification and its impact on the information provided to data subjects remain subject to the legal review identified in this Policy. Further information is available in the Microsoft Privacy Statement.

Transfers outside the European Economic Area associated with the authentication service are governed by a DPA and Standard Contractual Clauses (SCC) approved by the European Commission, in line with the Schrems II ruling (C-311/18).

7. Retention period

Essential cookies have the duration indicated in the table in section 3.1. According to Clarity documentation, session playback data is retained for 30 days; aggregated click and heatmap data, as well as labelled or favourite sessions, may be retained for 9 months. Vercel states that the technical identifier for a Web Analytics visitor session is automatically discarded after 24 hours; retention of aggregated dashboard data depends on the service plan and configuration and must be confirmed during legal review. Withdrawing consent prevents new collection in that browser but does not retroactively erase data already collected. Deletion of data associated with a specific individual is subject to the provider's technical limitations and must be handled through the contact identified in section 8.

8. Data subject rights

Even in the cookie context, the user retains the rights set out in the GDPR, namely:

• Right of access, rectification and erasure (Articles 15, 16 and 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)
• Right to withdraw consent, where consent is the applicable legal basis, at any time and without affecting the lawfulness of prior processing (Article 7(3) GDPR)
• Right to lodge a complaint with CNPD (www.cnpd.pt)

Exercising the right to erasure deletes the personal data associated with the user, but does not cover records that iBetterCoach is legally required to retain, in particular tax/accounting billing records. The full data retention and deletion policy is set out in the Privacy Policy.

What remains to be decided (RJ-03): counsel and the accountant must state, by record type, the exact period, start date, exceptions and fields that must remain. Minimisation, separation or pseudonymisation of identifiers will be promised only to the extent legally compatible with retention duties.

To exercise these rights, the user may contact iBetterCoach at privacy@ibettercoach.com.

9. Changes to this Policy

This Policy may be updated to reflect legal changes, new features or new processors. Whenever there are substantial changes, the user will be notified and, where applicable, invited to renew consent.

The version in force is always available at https://www.ibettercoach.com/en/legal/cookies.

10. Contact and data controller

⚠️ [UNDER LEGAL REVIEW] Qualification of the data controller

This point is being determined through legal advice and may alter the framing of several sections of this document. There are two possible readings of iBetterCoach's role: (a) Data processor of the Athlete's data, processed on behalf of the Professional (data controller), under the DPA; or (b) Data controller, possibly as a joint controller with the Professional (Article 26 GDPR), given that iBetterCoach maintains a direct relationship with the Athlete (own account, acceptance of the Terms and consent provided directly to the Platform) and processes data for its own purposes (metrics/gamification, product improvement and security). The final determination will be reflected in this section, in the DPA document and in the consent flows. Pending validation by a lawyer specialised in GDPR.

What this section is intended to do: identify who determines the purposes and means of strictly necessary storage and analytics technologies on the public website, and who is accountable to the visitor.

Specific question and requested decision (RJ-01): iBetterCoach chooses to activate the technologies, while some providers may perform roles of their own. Counsel should provide a technology-by-technology matrix stating the controller, any processor or independent third-party controller, legal basis, duration, recipients and disclosure duties. Until then, these are working hypotheses.

Entity operating the website and deciding to use these technologies: SOFTBRICK, LDA, tax number 519595270, Rampa Doutor Barreto, 15, 9000-688 Funchal, Portugal (each party's qualification for each technology remains subject to decision RJ-01 above).

Privacy and data-protection contact: privacy@ibettercoach.com (alternative channel: dpo@ibettercoach.com).

Pending DPO decision (RJ-05): assess whether appointment is mandatory or voluntarily advisable and, if applicable, formally appoint and notify the DPO. Until then, neither address is presented as evidence of a formally appointed DPO.

Supervisory authority: Portuguese Data Protection Authority (CNPD), Av. D. Carlos I, 134 - 1.º, 1200-651 Lisbon, www.cnpd.pt

Document prepared for iBetterCoach. Requires formal legal review before publication.