Legal

Privacy Policy

Effective [REPLACE: effective date] · v1.0 · GDPR + UK-GDPR

Coaching is intimate. The pulse you collect carries sleep, mood, body. We treat it that way. We don't sell it, mine it, or train AI on it.

01 · What we collect

Two kinds of data:

  • Account data, your email, name, password hash, billing info (via Stripe), login timestamps.
  • Client data, what your clients send through Pulse, plans they complete, nutrition they log, notes you attach. You're the controller; we're the processor.

02 · How we use it

Strictly to run Atletafit, authenticate you, display your clients' data, bill you, respond to support requests. We use aggregate, anonymised usage metrics to improve the product. We don't train machine-learning models on identifiable client health data, period.

03 · Who we share with

Only the subprocessors listed below, and only what they need to do their job. We don't sell data. We don't share it with advertisers. If a legal request comes in, we fight it where we can and tell you unless a gag order prevents us.

04 · Subprocessors

A short list, reviewed quarterly:

Provider
Purpose
Region
AWS (Frankfurt)
Core hosting + database
EU
Stripe
Payments, billing
EU + US (SCCs)
Cloudflare
CDN, DDoS protection
Global edge
Postmark
Transactional email
EU
Tigris
Video + image storage
EU

05 · Your rights

You can access, export, rectify, or delete your data at any time from your account settings. Your clients can do the same, addressed to you, we'll help you respond within 30 days. Full GDPR + UK-GDPR rights apply, including the right to object and the right to lodge a complaint with your local supervisory authority (in the UK, the ICO).

06 · Retention

Active account data lives as long as your account does. When you cancel, we keep data for 90 days in case you come back, then hard-delete. Billing records we retain for 7 years as required by UK tax law.

07 · Contact

Data protection officer: dpo@atletafit.com. We'll acknowledge within 72 hours and substantively within 30 days.