Privacy Policy
Last updated: July 2026
1. Data controller
AthletePro (the “Service”) is operated by Borja Alfaraz. For any question regarding the processing of your data, contact info@athletepro.es.
2. Data we collect
- Account data: name, email and password (the latter stored hashed with bcrypt).
- Physical and sports data (only if you provide it): height, weight, CdA, critical power (CP), W′, MMP. Required to personalise the pacing model.
- Activity data (only if you upload it): FIT files from your rides, which may include power, heart rate, cadence, speed and GPS position. Used to analyse your actual performance.
- Plans and routes: GPX files you upload, segments, weather conditions, notes.
- Technical data: IP address, browser, OS (in server logs, kept 30 days for security incident detection).
3. Purpose and legal basis
- Provide the service (contract execution, GDPR art. 6.1.b): generate your pacing plan, render charts, allow export.
- Account security (legitimate interest, GDPR art. 6.1.f): logs, rate-limiting, anti-brute-force.
- Legal obligations (GDPR art. 6.1.c): invoicing where applicable.
- Heart-rate and health data (GDPR art. 9.2.a, explicit consent): if you upload heart rate or other data that may reveal health information, we process it solely to generate your analysis, with your consent, and never share it with third parties for other purposes. You can withdraw consent and delete it at any time.
Your athletes' data. When a coach adds athletes and uploads their data, the coach is the controller of that data and the Service acts as processor on their behalf. The coach must have a legal basis (e.g. the athlete's consent) to process it. A data processing agreement (DPA) is available on request at info@athletepro.es.
4. Retention
We keep your data while your account is active. If you request deletion, the data is removed within a maximum of 30 days, except for what we must retain by legal obligation.
5. Your rights
You may exercise the rights of access, rectification, erasure, objection, restriction and portability at any time by writing to info@athletepro.es. You also have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es) or your local supervisory authority within the EU.
6. Cookies and local storage
We only use strictly necessary cookies for the service to work:
ap_token(HttpOnly cookie, session or 30 days with “Remember me”): keeps you signed in.ap_theme,ap_lang(localStorage): remember your theme (light/dark) and language.
We do not use analytics or advertising cookies. To know how many people visit the site we use Cloudflare Web Analytics, which works without cookies, without device fingerprinting and without identifying anyone: it counts page views and where they come from, nothing else. That is why no prior consent is required (Spanish LSSI art. 22.2).
7. Data processors and transfers
To run the service we rely on a small number of carefully selected data processors, all offering adequate GDPR safeguards. By category:
- Hosting and infrastructure (database, backend, CDN), preferably in the European Union.
- Payment and subscription processing: card data is handled directly by a PCI-DSS certified payment provider; we never see or store it.
- Sending of transactional emails (account verification, notices).
- Optional integrations that only activate if you connect them (e.g. importing your own routes).
- Weather and mapping sources, which receive no personally identifiable data.
For security reasons we do not publish the specific identity of each provider. We will provide the full, up-to-date list of sub-processors on request at info@athletepro.es.
International transfers. Some providers may process data outside the European Economic Area. In those cases the transfer relies on the European Commission's Standard Contractual Clauses or other adequate safeguards under GDPR art. 46.
8. Changes
Any substantial change will be announced on this page with an updated date. If the changes affect your rights, we will notify you by email.