Version: 1.3 Effective date: 8 April 2026 Last updated: 27 July 2026
⚠️ Notice: This document was prepared as a solid legal foundation tailored to iBetterCoach. Before publication it must be reviewed by a Portuguese lawyer specialised in GDPR and digital law.
1. Legal framework
This Cookies Policy governs the use of cookies and browser local storage on the iBetterCoach platform (the "Platform"), available at www.ibettercoach.com.
The use of these technologies is regulated by:
- Regulation (EU) 2016/679 of 27 April 2016 (GDPR)
- Directive 2002/58/EC (ePrivacy Directive), transposed into Portuguese law by Law 41/2004 of 18 August, as amended by Law 46/2012
- Law 58/2019 of 8 August, ensuring the execution of the GDPR in the Portuguese legal order
- Guidelines of the Portuguese Data Protection Authority (CNPD) on cookies and identifiers
- Guidelines 03/2022 on deceptive design patterns in social media platform interfaces of the European Data Protection Board (EDPB) — guidance applied by analogy to cookie consent interfaces (deceptive design patterns / dark patterns)
iBetterCoach upholds the principle of prior, free, specific, informed and unambiguous consent for any non-strictly-necessary cookie, pursuant to Article 5(3) of the ePrivacy Directive.
2. What cookies are
Cookies are small text files placed on the user's device (computer, mobile phone or tablet) when the user visits the Platform. In the current implementation, they keep the authenticated session active and remember whether the application's sidebar is open.
The Platform also uses browser local storage (localStorage) to store the choice shown in the banner and the light/dark theme preference. For the purposes of this Policy, that storage is described with the same transparency applied to cookies.
3. Cookie categories
iBetterCoach uses a single category of cookies: strictly necessary cookies (the identification of the data controller that determines the purposes is subject to qualification under legal review — see section 10).
3.1 Strictly necessary (no consent required)
Essential to the Platform's basic operation. Without them, services such as authentication, session persistence, security or fraud prevention would not be possible.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
__session | Clerk | Keep the user authenticated | Session |
__client_uat | Clerk | Support client authentication management | 1 year |
__refresh_<id> | Clerk | Automatic session renewal | 1 year |
sidebar_state | iBetterCoach | Remember whether the sidebar is open | 7 days |
The user's choice in the banner is stored in browser local storage (localStorage), under the key ibc-cookie-consent-v1, and not in a cookie. The light/dark theme is also stored in local storage.
Legal basis: legitimate interest of the data controller in the technical operation of the service (Article 6(1)(f) GDPR) and the exception in Article 5(3) of the ePrivacy Directive. (The identification of the data controller is subject to qualification under legal review — see section 10.)
3.2 Cookies not used
The Platform currently does not use functionality, analytics, statistics, marketing or behavioural advertising cookies. If any non-essential cookie is introduced, this Policy will be updated and the user will be invited to provide explicit consent before activation.
4. Consent banner
On the first visit to the public presentation pages (/ and /ciencia), the user sees a banner with these characteristics:
- Two buttons shown side by side and with the same dimensions: "Accept" and "Reject".
- One-click rejection, without submenus.
- No non-essential cookie is placed before or after the choice, because the current implementation does not use that category of cookies.
- No deceptive design patterns (dark patterns) — there are no acceptance timers, pre-ticked boxes or wording that hides the rejection option.
The choice is stored only in localStorage, under the key identified in section 3.1. The banner is not displayed in the authenticated application, which also does not place non-essential cookies.
If the Platform introduces analytics or other non-essential cookies, it will have to update this Policy, obtain consent before activating them and provide a permanent means in the footer to review and withdraw that consent, pursuant to Article 7(3) GDPR.
5. Managing and disabling cookies
The user may manage cookies and local storage directly in the browser:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
Warning: disabling strictly necessary cookies may prevent the Platform from working correctly, including login.
6. Third-party services and international transfers
Of the services below, Clerk places the authentication cookies identified in section 3.1. Vercel and Supabase support the Platform's infrastructure but do not place non-essential cookies in the browser:
| Processor | Function | Location | Safeguard |
|---|---|---|---|
| Clerk (Clerk Inc., USA) | Authentication | USA | Standard Contractual Clauses (SCC) + DPA |
| Vercel (Vercel Inc., USA) | Server-side application execution | EU — Dublin (dub1) | SCC + DPA |
| Supabase (Supabase Inc., USA) | PostgreSQL database and file storage | EU — Ireland (eu-west-1) | SCC + DPA |
Transfers outside the European Economic Area associated with the authentication service are governed by a DPA and Standard Contractual Clauses (SCC) approved by the European Commission, in line with the Schrems II ruling (C-311/18).
7. Retention period
No non-essential cookie is placed. Essential cookies have the duration indicated in the table in section 3.1.
8. Data subject rights
Even in the cookie context, the user retains the rights set out in the GDPR, namely:
- Right of access, rectification and erasure (Articles 15, 16 and 17)
- Right to restriction of processing (Article 18)
- Right to data portability (Article 20)
- Right to object (Article 21)
- Right to withdraw consent, where consent is the applicable legal basis, at any time and without affecting the lawfulness of prior processing (Article 7(3) GDPR)
- Right to lodge a complaint with CNPD (www.cnpd.pt)
Exercising the right to erasure deletes the personal data associated with the user, but does not cover the records that iBetterCoach is legally required to retain (in particular tax/accounting billing records — ⚠️ [to be confirmed by the lawyer] the exact retention period), which are kept for the legal period, anonymising the user's identifier wherever possible. The full data retention and deletion policy is set out in the Privacy Policy.
To exercise these rights, the user may contact iBetterCoach at privacy@ibettercoach.com.
9. Changes to this Policy
This Policy may be updated to reflect legal changes, new features or new processors. Whenever there are substantial changes, the user will be notified and, where applicable, invited to renew consent.
The version in force is always available at https://www.ibettercoach.com/en/legal/cookies.
10. Contact and data controller
⚠️ [UNDER LEGAL REVIEW] Qualification of the data controller
This point is being determined through legal advice and may alter the framing of several sections of this document. There are two possible readings of iBetterCoach's role: (a) Data processor of the Athlete's data, processed on behalf of the Professional (data controller), under the DPA; or (b) Data controller, possibly as a joint controller with the Professional (Article 26 GDPR), given that iBetterCoach maintains a direct relationship with the Athlete (own account, acceptance of the Terms and consent provided directly to the Platform) and processes data for its own purposes (metrics/gamification, product improvement and security). The final determination will be reflected in this section, in the DPA document and in the consent flows. Pending validation by a lawyer specialised in GDPR.
Entity responsible for cookies and contact: iBetterCoach — [legal name to be defined, VAT number, address] (qualification as data controller and/or data processor subject to the legal review above) Data Protection Officer (DPO): [to be appointed if applicable] Email: privacy@ibettercoach.com Supervisory authority: Portuguese Data Protection Authority (CNPD), Av. D. Carlos I, 134 - 1.º, 1200-651 Lisbon, www.cnpd.pt
Document prepared for iBetterCoach. Requires formal legal review before publication.